Italian DPA fines BBVA €5.508 million for ignoring customer’s objection to direct marketing

What happened

The Italian Data Protection Authority issued a final decision on 3 July 2026 finding BBVA infringed Articles 5, 12, 21 and 24 of the GDPR by failing to honor a customer's objection to direct marketing. BBVA was ordered to pay an administrative fine of EUR 5 508 000 and to adopt technical and organisational measures to respect data‑subject rights.

Penalty

administrative fine of EUR 5 508 000

Why it matters for trust and compliance

• Its status is in effect. It is in force now.
• The enforcement highlights the obligation of controllers to promptly honor opt‑out requests and the financial risk of non‑compliance.
• Takes effect July 3, 2026.
• Penalty: administrative fine of EUR 5 508 000.
• It relates to GDPR. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Review consent, cookie and tracking practices against the requirement.
2. Check that privacy notices describe the practices this addresses.
3. Confirm access, correction, deletion and opt-out requests are handled within the required time.
4. Inventory where this data is shared or sold and whether opt-outs are honoured.
5. Inventory AI or automated decision systems in scope and their assessments.