Banco Bilbao Vizcaya Argentaria S.A.

What happened

The Italian DPA has imposed a fine of EUR 5,508,000 on Banco Bilbao Vizcaya Argentaria S.A. In a complaint, the data subject stated that despite having objected to receiving commercial communications through the controller's app, they had received such material. It was found that, although the data subject's objection had been implemented, it had not been synchronised with the controller's CRM. Following the authorities' inquiry, the user's account was corrected. The controller did not comply with the data subject's objection within a reasonable timeframe, nor did they implement adequate technical and organisational measures to ensure the transparency and fairness of the processing. Although the data subject had used the correct method to inform the controller of their objection, they were informed by customer services that only communications via email could be changed whilst app notifications would remain unaffected.

Summary from the CMS Enforcement Tracker, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(a)Read →
• Art. 12Transparent information, communication and modalities for the exercise of the rights of the data subjectRead →
• Art. 21Right to objectRead →
• Art. 24Responsibility of the controllerRead →

• Accountability
• Data principles
• Data subject rights
• Transparency