Banco Bilbao Vizcaya Argentaria S.A.

Summary

The Italian DPA has imposed a fine of EUR 5,508,000 on Banco Bilbao Vizcaya Argentaria S.A. In a complaint, the data subject stated that despite having objected to receiving commercial communications through the controller's app, they had received such material. It was found that, although the data subject's objection had been implemented, it had not been synchronised with the controller's CRM. Following the authorities' inquiry, the user's account was corrected. The controller did not comply with the data subject's objection within a reasonable timeframe, nor did they implement adequate technical and organisational measures to ensure the transparency and fairness of the processing. Although the data subject had used the correct method to inform the controller of their objection, they were informed by customer services that only communications via email could be changed whilst app notifications would remain unaffected.