The Italian Data Protection Authority issued a final decision on 3 July 2026 finding BBVA infringed Articles 5, 12, 21 and 24 of the GDPR by failing to honor a customer's objection to direct marketing. BBVA was ordered to pay an administrative fine of EUR 5 508 000 and to adopt technical and organisational measures to respect data‑subject rights.
Why it matters: The enforcement highlights the obligation of controllers to promptly honor opt‑out requests and the financial risk of non‑compliance.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
