Italy fines BBVA €5.5M after one opt-out never reached its CRM
Italy's Garante fined BBVA €5,508,000 after a customer's marketing opt-out failed to sync to the CRM unit sending promotions, which kept arriving for seven months. The EDPB published the decision on 9 October 2026; it covered breaches of GDPR Articles 5(1)(a), 12, 21 and 24.
- €5.5M fine: a customer's opt-out never reached the CRM due to a sync failure
- Promotions kept arriving from October 2025 to May 2026 — at least 10 messages
- Regulator rejected BBVA's claim that the customer used the wrong channel
- EDPB also published a €16.7M Wind Tre fine over the same type of failure
Read next
Policy