Italian DPA fines BBVA EUR 5,508,000 for failing to respect objection to direct marketing
The Italian DPA fined BBVA EUR 5,508,000 for failing to give effect to a customer's objection to direct marketing, resulting in unsolicited promotional notifications for seven months. The DPA also ordered BBVA to adopt measures to facilitate data subject rights and report back within 30 days.
- Framework
- GDPR
- Who it concerns
- Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA)
What changed?
Each point with the sentence from the source that says it.
The Italian DPA found that BBVA failed to give effect to the customer’s objection correctly and in a timely manner.
The Italian DPA found that BBVA failed to give effect to the customer’s objection correctly and in a timely manner.
The DPA rejected BBVA’s argument that the customer should have used the dedicated email addresses indicated in its privacy policy.
The DPA rejected BBVA’s argument that the customer should have used the dedicated email addresses indicated in its privacy policy.
The DPA also found deficiencies in BBVA’s technical and organisational measures.
The DPA also found deficiencies in BBVA’s technical and organisational measures.
The Italian DPA found infringements of Articles 5(1)(a), 12, 21 and 24 GDPR and imposed an administrative fine of EUR 5 508 000.
The Italian DPA found infringements of Articles 5(1)(a), 12, 21 and 24 GDPR and imposed an administrative fine of EUR 5 508 000.
The DPA ordered BBVA to adopt appropriate technical and organisational measures to facilitate the exercise of data subject rights and to ensure that requests are handled correctly and without undue delay.
The DPA ordered BBVA to adopt appropriate technical and organisational measures to facilitate the exercise of data subject rights and to ensure that requests are handled correctly and without undue delay.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Data Protection Policy
Review the Data Protection Policy to ensure it includes procedures for handling data subject objections to direct marketing through any channel, not just designated ones.
- DSAR Procedure
Update the DSAR Procedure to clarify that objections to marketing must be acted upon promptly regardless of how they are submitted.
- Consent Management Policy
Review the Consent Management Policy to ensure technical measures synchronize objection preferences across all systems that send marketing communications.