Banco Bilbao Vizcaya Argentaria S.A.: Insufficient fulfilment of data subjects rights

[Web Doc. No. 10291895] Decision of September 3, 2026 Register of Decisions No. 613 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “Regulation”); HAVING REGARD TO the Code on the Protection of Personal Data (Legislative Decree No. 196 of June 30, 2003), (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc.

No. 9107633 (hereinafter “Regulation No. 1/2019 of the Data Protection Authority”); HAVING CONSIDERED the documentation on file; HAVING CONSIDERED the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the Office of the Data Protection Authority, adopted by resolution of June 28, 2000 (web doc. No. 1098801); RAPPORTEUR: Prof. Pasquale Stanzione; 1. FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1. Origin of the preliminary investigation By letter dated March 11, 2026 (ref. no. 37012), this Authority received a complaint in which the complainant alleged having received in-app commercial communications from Banco Bilbao Vizcaya Argentaria, S.A., Italian branch, with headquarters at Corso Vittorio Emanuele 9, 20122 Milan, Tax ID and VAT No. 06862150155 (hereinafter the “Company”).

In a letter dated May 25, 2026 (Ref. No. 80020/26), the complainant reiterated the allegations, emphasizing that the contested processing did not comply with applicable regulations. 2. INITIATION OF PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND SANCTIONING MEASURES AND THE PARTY’S DEFENSES 2.1. Initiation of proceedings (Article 166, paragraph 5, of the Code) Based on the review of the evidence gathered during the activities described above and the determination of the alleged violations, by notice dated June 23, 2026 (Ref. No. 97228), served in accordance with Article 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures provided for in Article 58, para 2, of the Regulation against the Company in its capacity as controller, inviting the Company to submit written defenses or documents or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981).

The alleged violations in question relate to the following provisions: - Articles 5(1)(a), 12, and 21 of the Regulation, in that the Company did not properly address the objection raised by the complainant within the time limits prescribed by applicable law, nor did it provide an adequate response; - Articles 5(1)(a) and 24 of the Regulation, in that the Company failed to implement appropriate technical and organizational measures to ensure the transparency and fairness of data processing. 2.2. The Company’s Defense (Article 166, paragraph 6, of the Code) In its defense brief dated July 22, 2026 (Ref. No. 112376), the controller stated that it had provided the complainant, through its call center, with the correct instructions for disabling in-app commercial notifications and that, however, there was subsequently a failure to synchronize the revocation made by the customer on their BBVA app with the corresponding record in the CRM team’s database.

The Company clarified that what occurred was a one-time, isolated technical glitch in the coordination of internal systems, noting that the complainant had contacted only Customer Service without using the email address designated for exercising rights (i.e., dirittiprotezionedati@bbva.it) nor that of BBVA’s DPO (dpo.italy@bbva.com), both of which are listed in the privacy policy. The Company also made a point of clarifying, on the one hand, that it had sent a letter of clarification and an apology for the incident to the complainant once it understood the inconvenience caused to him; and, on the other hand, that it had verified internally that the misalignment that occurred was limited solely to the complainant and that, in any case, it had been resolved. Finally, the Company outlined the technical, organizational, and training measures adopted to implement its approach to personal data protection. 3.

THE DATA PROTECTION AUTHORITY’S ASSESSMENTS Based on the facts outlined above and the statements made in the defense brief—to which the Company responds pursuant to Article 168 of the Code—the Authority confirms the violations identified in the notice of charges for the reasons set forth below. 3.1 REGARDING THE POSSIBLE VIOLATION OF ARTICLES 5(1)(A), 12, AND 21 OF THE REGULATION First, reference is made to the provision of Article 21 of the Regulation, which, in para 2, expressly provides that “Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is related to such direct marketing.” In the present case, the complainant, in communications dated October 2 and December 9, 2025, appears to have expressed to the controller’s Customer Service department his objection to processing for the purposes of commercial communications and, as confirmed by the Company itself, had also duly indicated his objection through the settings of the BBVA App.

In its briefs, the Company disputes the fairness of the complainant’s exercise of the right to object, arguing that he did not use the correct email addresses—namely, those specified in its privacy policy (dirittiprotezionedati@bbva.it and dpo.italy@bbva.com); in fact, had he contacted those addresses, the Company clarifies, “it would have processed the request as a data subject right pursuant to Articles 15–22 of the GDPR, taking direct action on the Customer’s profile to the extent necessary to protect the Customer’s rights to revoke marketing consent.” This exception does not appear to be in line with the principles set forth by the Regulation regarding the exercise of data subjects’ rights. In fact, from this perspective, Article 12 of the Regulation places the burden on the controller to facilitate the exercise of rights by data subjects and to respond without delay and in any case within one month of receiving the request.

Furthermore, in Guidelines 1/2022 (on data subject rights—right of access, Version 2.1, adopted on March 28, 2023), it is generally stated that “there are no specific requirements regarding the format of the request.” The controller should provide simple and appropriate communication channels that the data subject can use without difficulty. However, the data subject is not required to use these specific channels and may instead submit the request to an official contact point of the controller. The controller, however, is not obligated to respond to requests sent to entirely random or apparently incorrect addresses.” In the present case, the complainant expressed his objection by correctly adjusting the settings of the BBVA App, a procedure that has been established as the standard method for exercising this right. Therefore, it appears that the complainant strictly followed the instructions provided, in this specific case, by the Company for exercising the right in question.

In light of the continued receipt of unsolicited in-app commercial communications, the complainant also exercised his right to object by contacting the controller’s Customer Service, which evidently failed to forward the relevant request to the appropriate departments. Yet the request had been clearly understood by the Customer Service representative, to the extent that the representative provided instructions on how to adjust the settings of the BBVA App (which, as mentioned, is the standard procedure). Based on an analysis of the events, it appears that the complainant had correctly expressed his objection through the App provided by the Company, in accordance with the information received from Customer Service. Therefore, the subsequent objection raised by the complainant to Customer Service itself should be considered superfluous—a mere confirmation of what had already been correctly communicated using the tools provided by the Company itself.

In its defense, the Company represented that the issue encountered by the complainant was an isolated incident limited to the “technical alignment process between the Bank’s internal systems and its CRM unit, and did not involve the incorrect recording of the change in preference made by the customer, which is in fact properly recorded in the Bank’s systems.” This statement, however, amounts to confirming that the Company did not act on the request—albeit due to an alleged technical glitch—despite the fact that the data subject had correctly exercised his right to object to the processing. In any case, it is noted that the Company, after resolving the technical misalignment that caused the failure to implement the objection expressed by the complainant, it also implemented additional measures aimed at ensuring “that, in particular, the call center always has adequate knowledge of internal procedures—including a strengthening of internal escalation protocols when risky situations such as the one in question arise.”

Furthermore, the assessments just carried out highlight the controller’s obligation to provide a response to the data subject (Art. 12 of the Regulation), a response that the Company failed to send. The responses provided to the data subject, in fact, were limited to indicating the standard procedure for changing the settings of the BBVA App, without providing information regarding the actions taken by the data controller to address the request (which, in fact, do not appear to have been taken immediately). The Company stated that it took action only after receiving the notice from the Data Protection Authority’s Office—and thus in May 2026—demonstrating, among other things, that the technical handling of the request was relatively straightforward through the alignment of internal systems. However, between October 2025 and May 2026, there were at least ten reports of unsolicited commercial communications.

Yet, as early as the outcome of the second report in December 2025, the Company had all the necessary information to conduct the same internal checks (checks that were, as mentioned, only carried out in May 2026) and to take appropriate action, but Customer Service did not properly address the issue raised by the complainant. Ultimately, while acknowledging that the Company provided the option to object by sending an email or a certified letter, it cannot be considered that such instructions authorize the data controller to ignore expressions of intent that the data subject correctly communicated, in this case, through the settings of the BBVA app and also to Customer Service; nor can this justify a failure to respond to the data subject regarding the exercise of his or her rights. The Company, therefore, failed to properly (at least initially) and promptly address or respond to the complainant’s objection, as also acknowledged in the note provided to this Office (“That said, there was a lack of synchronization between the Bank’s internal systems and its Customer Relationship Management (“CRM”) unit—which is responsible for sending commercial communications—thereby causing a delay in implementing the deactivation of notifications, as a result of which these notifications erroneously continued”).

Therefore, the violation of Articles 5(1)(a), 12, and 21 of the Regulation is confirmed. For the sake of completeness, it is also noted that the Company has already been the recipient of Decision No. 413 of July 10, 2025 (web doc. No. 10168555), by which, among other things, this Authority “found that the conduct engaged in by BBVA with respect to the delayed response to the access request submitted by the complainant is unlawful, under the terms set forth above, in relation to Articles 12(3) and (4) and 15 of the Regulation.” This finding, therefore, is relevant for the purposes of the assessments provided for in Article 83(2)(e) of the Regulation. 3.2 ON THE POSSIBLE VIOLATION OF ARTICLES 5(1)( A) AND 24 OF THE REGULATION Among the general obligations that the Regulation imposes on the controller is the obligation to implement appropriate technical and organizational measures to ensure—and be able to demonstrate—that processing is carried out in accordance with the Regulation.

Among the principles underlying the provisions of the Regulation are those of fairness and transparency referred to in Art 5(a). During the investigation, it emerged that on December 10, 2025, the Company’s Customer Service department communicated the following to the complainant: “We would like to inform you that only email communications can be adjusted; the App is the same for all customers, and we cannot remove the pop-up notifications—we in Customer Service do not set them up. We repeat: the App is the same for everyone. If you do not need promotional notifications, you can simply ignore them.” In other words, the complainant was informed that the Company had no way to modify the settings of its App to stop the receipt of commercial communications, presenting these messages as unavoidable and inviting the complainant to ignore them if not a data subject. However, the above appears to be contradicted by the technical measures implemented by the Company itself, which—in order to honor the complainant’s objection—stated that it had complied with the complainant’s request by blocking commercial notifications sent within the BBVA app.

The discrepancy between what the Company implemented and reported to this Office and what Customer Service communicated to the complainant appears to be the result of inadequate organizational measures, which, in effect, led to the dissemination of incorrect and non-transparent information regarding the processing activities carried out within the controller’s organization. This is of particular significance given that Customer Service represents the first point of contact between data subjects and the controller. Therefore, the violation of Articles 5(1)(a) and 24 of the Regulation is confirmed. 4. CONCLUSIONS In light of these considerations, the allegations set forth in the notice initiating proceedings pursuant to Art. 166 of the Code are confirmed, as the statements made during the preliminary investigation, the defenses raised, and the evidence submitted in the case file are insufficient to rebut the findings made by the Office; furthermore, none of the cases provided for in Art. 11 of Regulation No. 1/2019 apply.

Therefore, the Authority finds that the conduct of the controller was unlawful for: a) failing to properly address the data subject’s objection within the prescribed time limits, b) failing to provide an appropriate response to the data subject’s request, and c) failing to implement appropriate technical and organizational measures to ensure the transparency and fairness of the processing, all of which constitute violations of the following articles, respectively: - Articles 5(1)(a), 12, and 21 of the Regulation; - Articles 5(1)(a) and 24 of the Regulation. 5. CORRECTIVE MEASURES Having established, under the aforementioned terms, the unlawfulness of the processing activities under review, it is necessary to require the Company: a) pursuant to Article 58(2)(d) of the Regulation, to adopt appropriate technical and organizational measures to facilitate the exercise of the rights provided for by data protection legislation and to respond, without undue delay and in a proper manner, the relevant requests for the exercise of the data subject rights; b) pursuant to Article 157 of the Code, to notify the Authority, within 30 days of the notification of this order, of the actions taken, providing more detailed descriptions than those already provided, in order to implement the measures imposed; Failure to comply with the provisions of this section may result in the imposition of the administrative fine provided for in Article 83(5) of the Regulation.

Pursuant to Article 58(2)(i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction order (see Articles 18 of Law No. 689 of November 24, 1981, and 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). 6.1. Assessment of the Conduct and Determination of the Applicable Penalty Given that the violation of Articles 5(1)(a), 12, 21, and 24 of the Regulation occurred as a result of interconnected processing operations, Article 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, the violations are all subject to the penalty provided for in Article 83(5) of the Regulation, as also referred to in Article 166(2) of the Code, the total amount of the fine is to be set at up to 4% of the annual worldwide revenue for 2025. 6.2.

Determination of the Administrative Fine (Article 83, para 2, of the Regulation) The amount of the administrative fine shall be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account the following: the nature of the violation, which concerned the provisions relating to the exercise of the data subject rights; the duration of the violation, which lasted for 7 months (from October 2025 to May 2026); the involvement of only one data subject and the purpose pursued, namely marketing (see Article 83(2)(a) of the Regulation); the negligent nature of the violation (see Article 83(2)(b) of the Regulation); the nature of the personal data involved (contact information) (see Article 83(2)(g) of the Regulation), it is considered that, in the present case, the severity of the violation committed by the controller is low (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60).

That said, given that the controller is an entity with an annual turnover exceeding 500 million euros, it is considered that, for the purposes of determining the amount of the fine, the following circumstances should be taken into account: as a mitigating factor, the adoption of measures, during the investigation, aimed at bringing the violation to an end (see Art. 83, para. 2, subpar. c), of the Regulation); as an aggravating factor, the accountability—which is deemed to be of medium severity—for failing to adopt organizational measures (appropriate training of the Customer Service department) adequate to facilitate the exercise of data subjects’ rights (see Art. 83(2)(d) of the Regulation); as an aggravating factor, the Data Protection Authority’s previous decision No. 413 of July 10, 2025 (web doc. No. 10168555), in which, among other things, violations relevant to those at issue in the present investigation were found against the Company (see Art. 83(2)(e) of the Regulation).

In light of the aforementioned factors, assessed as a whole, and in accordance with the principles of effectiveness, proportionality, and deterrence set forth in Art. 83, para 1, of the Regulation, it is hereby determined that the amount of the monetary penalty shall be 5,508,000.00 euros (five million five hundred eight thousand/00) for the violation of Articles 5, para 1, letter a), 12, 21, and 24 of the Regulation. In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the ancillary sanction of publishing this section of the decision containing theon the Data Protection Authority’s website, given the nature of the violation—which concerned the exercise of the data subject rights—as well as the risks to the rights and freedoms of data subjects, and also in light of the previous decision adopted against the Company for related violations.

FOR THESE REASONS - pursuant to Articles 57 and 83 of the Regulation, the processing of personal data carried out by Banco Bilbao Vizcaya Argentaria, S.A., Italian branch, represented by its current legal representative, with registered office at Corso Vittorio Emanuele 9, 20122 Milan, Tax ID and VAT No. 06862150155, is hereby declared unlawful due to the violation of Articles 5(1)(a), 12, 21, and 24 of the Regulation, as set forth in the reasoning; - Pursuant to Article 58, para 2, subparagraph d) of the Regulation, the Company is hereby ordered to adopt appropriate technical and organizational measures to facilitate the exercise of the rights provided for by the legislation on data protection and to comply, without undue delay and in a proper manner, the relevant requests for the exercise of the data subject rights; - Pursuant to Article 157 of the Code, the Company is required to notify the Authority, within 30 days of the notification of this order, of the actions taken, providing more detailed descriptions than those already provided, in order to implement the measures imposed; Any failure to comply with the provisions of this section may result in the imposition of the administrative fine provided for in Art. 83(5) of the Regulation.

IT IS ORDERED pursuant to Articles 58(2)(i) and 83 of the Regulation, as well as Article 166 of the Code, that the Company pay the sum of 5,508,000.00 euros (five million five hundred eight thousand/00) as an administrative fine for the violations set forth in the grounds of this decision. IT IS ORDERED that, in the event the dispute is not settled pursuant to Article 166, paragraph 8, of the Code, the Company shall pay the sum of 5,508,000.00 euros (five million five hundred eight thousand/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the imposed penalty within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, applicable to the filing of an appeal as indicated below; IT IS HEREBY ORDERED pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction specified in the same Art 10, under penalty of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori [Web Doc. No. 10291895] Decision of September 3, 2026 Register of Decisions No. 613 of September 3, 2026 THE DATA PROTECTION AUTHORITY AT today’s meeting, attended by Prof. Pasquale Stanzione, Chair; Prof. Ginevra Cerrina Feroni, Vice Chair; Dr. Agostino Ghiglia, Member; and Dr. Luigi Montuori, Secretary General; HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “Regulation”); HAVING REGARD TO the Code on Data Protection (Legislative Decree No. 196 of June 30, 2003), (hereinafter the “Code”); HAVING REGARD TO Regulation No. 1/2019 concerning internal procedures with external relevance, aimed at carrying out the tasks and exercising the powers entrusted to the Data Protection Authority, approved by Resolution No. 98 of April 4, 2019, published in the Official Gazette No. 106 of May 8, 2019, and at www.gpdp.it, web doc.

No. 9107633 (hereinafter “Regulation of the Data Protection Authority No. 1/2019”); HAVING REGARD TO the documentation on file; HAVING REGARD TO the observations submitted by the Secretary General pursuant to Art. 15 of the Data Protection Authority Regulation No. 1/2000 on the organization and operation of the office of the Data Protection Authority, adopted by resolution of June 28, 2000 (web doc. No. 1098801); RAPPORTEUR: Prof. Pasquale Stanzione; 1. FACTS AND COURSE OF THE PRELIMINARY INVESTIGATION 1.1. Origin of the preliminary investigation By letter dated March 11, 2026 (Ref. No. 37012), this Authority received a complaint in which the complainant alleged that they had received in-app commercial communications from Banco Bilbao Vizcaya Argentaria, S.A., Italian branch, with headquarters at Corso Vittorio Emanuele 9, 20122 Milan, Tax ID and VAT No. 06862150155 (hereinafter the “Company”).

In a letter dated May 25, 2026 (Ref. No. 80020/26), the complainant reiterated the allegations, emphasizing that the contested processing was non-compliant with applicable regulations. 2. INITIATION OF PROCEEDINGS FOR THE ADOPTION OF CORRECTIVE AND PENALTY MEASURES AND THE PARTY’S DEFENSE 2.1. Initiation of proceedings (Art. 166, paragraph 5, of the Code) Based on the review of the evidence gathered during the activities described above and the determination of the alleged violations, by notice dated June 23, 2026 (Ref. No. 97228), served in accordance with Article 166, paragraph 5, of the Code, the Office initiated proceedings to adopt the measures provided for in Article 58, para 2, of the Regulation against the Company in its capacity as controller, inviting the Company to submit a written defense or supporting documents or to request a hearing before the Authority (Article 166, paragraphs 6 and 7, of the Code, as well as Article 18, paragraph 1, of Law No. 689 of November 24, 1981).

The alleged violations in question relate to the following provisions: - Articles 5(1)(a), 12, and 21 of the Regulation, in that the Company did not properly address the objection raised by the complainant within the time limits prescribed by applicable law, nor did it provide an adequate response; - Articles 5(1)(a) and 24 of the Regulation, in that the Company failed to implement appropriate technical and organizational measures to ensure the transparency and fairness of the processing. 2.2. The Company’s Defense (Article 166, paragraph 6, of the Code) In its defense brief dated July 22, 2026 (Ref. No. 112376), the controller stated that it had provided the complainant, through its call center, with the correct instructions for disabling in-app marketing notifications and that, nevertheless, there was subsequently a failure to synchronize the withdrawal made by the customer on their BBVA app with the corresponding record in the CRM team’s database.

The Company clarified that what occurred was a one-time, isolated technical glitch in the coordination of internal systems, noting that the complainant had contacted only Customer Service without using the email address designated for exercising rights (i.e., dirittiprotezionedati@bbva.it) or that of BBVA’s DPO (dpo.italy@bbva.com), both of which are listed in the privacy policy. The Company also made a point of clarifying, on the one hand, that it had sent a letter of clarification and apology to the complainant once it understood the inconvenience caused to him; and, on the other hand, that it had verified internally that the misalignment that occurred was limited solely to the complainant and that, in any case, it had been resolved. Finally, the Company outlined the technical, organizational, and training measures adopted to implement its approach to personal data protection. 3. THE AUTHORITY’S ASSESSMENTS Based on the facts outlined above and the statements made in the defense brief—for which the Company is accountable pursuant to Article 168 of the Code—the Authority confirms the violations identified in the notice of violation for the reasons set forth below. 3.1 REGARDING THE POSSIBLE VIOLATION OF ARTICLES 5(1)(A), 12, AND 21 OF THE REGULATION First, reference is made to the provision of Article 21 of the Regulation, which, in para 2, expressly provides that “Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is related to such direct marketing.”

In the present case, the complainant, in communications dated October 2 and December 9, 2025, appears to have expressed to the controller’s Customer Service department his objection to processing for the purpose of commercial communications and, as confirmed by the Company itself, had also duly indicated his objection through the settings of the BBVA app. In its briefs, the Company disputes the fairness of the complainant’s exercise of the right to object, arguing that he did not use the correct email addresses—namely, those specified in its privacy policy (i.e., dirittiprotezionedati@bbva.it and dpo.italy@bbva.com); in fact, had he contacted those addresses, the Company clarifies, “it would have handled the request as a data subject’s right under Articles 15–22 of the GDPR, taking direct action on the Customer’s profile to the extent necessary to protect the Customer’s right to withdraw marketing consent.”

This exception does not appear to be in line with the principles set forth by the Regulation regarding the exercise of data subjects’ rights. In fact, from this perspective, Article 12 of the Regulation places the burden on the controller to facilitate the exercise of rights by data subjects and to respond without delay and, in any case, within one month of receiving the request. Furthermore, Guidelines 1/2022 (on data subject rights—Right of access, version 2.1, adopted on March 28, 2023) state, in general terms, that “there are no specific requirements regarding the format of the access request.” The controller should provide simple and appropriate communication channels that the data subject can use without difficulty. However, the data subject is not required to use these specific channels and may instead submit the request to an official contact point of the controller. The controller, however, is not obligated to act on requests sent to entirely random or apparently incorrect addresses.”

In the present case, the complainant expressed his objection by correctly adjusting the settings of the BBVA app, a procedure that has been established as the standard method for exercising this right. Therefore, it appears that the complainant precisely followed the instructions provided, in this specific case, by the Company for exercising the right in question. In light of the continued receipt of unsolicited in-app commercial communications, the complainant also exercised his right to object by contacting the controller’s Customer Service department, which evidently failed to forward the request to the relevant departments. Yet the request had been clearly understood by the Customer Service representative, to the extent that the representative provided instructions on how to adjust the settings of the BBVA App (which, as mentioned, is the standard procedure). An analysis of the events reveals that the complainant had correctly expressed his objection through the App provided by the Company, in accordance with the information received from Customer Service.

Therefore, the subsequent objection raised by the complainant to the same Customer Service department should be considered redundant—a mere confirmation of what had already been correctly communicated using the tools provided by the data controller itself. In its defense, the Company represented that the issue encountered by the complainant was an isolated incident limited to the “technical alignment process between the Bank’s internal systems and its CRM unit, and not to the correct recording of the change in preference made by the customer, which is in fact properly recorded in the Bank’s systems.” This statement, however, amounts to confirming that the Company did not act on the request—albeit due to an alleged technical glitch—despite the fact that the data subject had correctly exercised his right to object to the processing. In any case, it is noted that the Company, after resolving the technical misalignment that caused the failure to implement the objection expressed by the complainant, it also implemented additional measures aimed at ensuring “that, in particular, the call center always has adequate knowledge of internal procedures—including a strengthening of internal escalation protocols—when risky situations such as the one in question arise.”

Furthermore, the assessments just carried out highlight the controller’s obligation to provide a response to the data subject (Art. 12 of the Regulation), a response that appears not to have been sent by the Company. The responses provided to the data subject, in fact, were limited to indicating the standard procedure for changing the settings of the BBVA App, without providing information regarding the actions taken by the data controller to address the request (which, in fact, do not appear to have been taken immediately). The Company stated that it took action only after receiving the notice from the Data Protection Authority’s Office—and thus in May 2026—demonstrating, among other things, that the technical handling of the request was relatively straightforward through the alignment of internal systems. However, between October 2025 and May 2026, there were at least ten reports of unsolicited commercial communications.

Yet, as early as the outcome of the second report in December 2025, the Company had all the necessary information to conduct the same internal checks (checks that were, as mentioned, only carried out in May 2026) and to take appropriate action, but Customer Service failed to properly address the issue raised by the complainant. Ultimately, while acknowledging that the Company provided the option to object by sending an email or a certified letter, it cannot be considered that such instructions authorize the data controller to ignore expressions of intent that the data subject correctly represented, in this case, through the settings of the BBVA App and also to Customer Service; nor can this justify a failure to respond to the data subject regarding the exercise of their rights. The Company, therefore, appears not to have properly (at least initially) and promptly followed up on or responded to the complainant’s objection, as also acknowledged in the note provided to this Office (“That said, there was a lack of synchronization between the Bank’s internal systems and its Customer Relationship Management (“CRM”) unit—which is responsible for sending commercial communications—thereby causing a delay in implementing the deactivation of notifications, as a result of which these notifications continued to be sent in error”).

Therefore, the violation of Articles 5(1)(a), 12, and 21 of the Regulation is hereby confirmed. For the sake of completeness, it is also noted that the Company has already been the recipient of Decision No. 413 of July 10, 2025 (web doc. No. 10168555), in which, among other things, this Authority “found that the conduct engaged in by BBVA with respect to the delayed response to the request for access submitted by the complainant is unlawful, under the terms set forth above, in relation to Articles 12(3) and (4) and 15 of the Regulation.” This finding, therefore, is relevant for the purposes of the assessments provided for in Article 83(2)(e) of the Regulation. 3.2 ON THE POSSIBLE VIOLATION OF ARTICLES 5(1)( A) AND 24 OF THE REGULATION Among the general obligations that the Regulation imposes on the controller is the requirement to implement appropriate technical and organizational measures to ensure—and be able to demonstrate—that processing is carried out in accordance with the Regulation.

Among the principles underlying the provisions of the Regulation are those of fairness and transparency referred to in Art 5(a). During the investigation, it emerged that on December 10, 2025, the Company’s Customer Service department communicated the following to the complainant: “We would like to inform you that we can only adjust email communications; the App is the same for all customers, and we cannot remove the pop-up notifications—we in Customer Service do not set them up. We repeat: the App is the same for everyone. If you do not need promotional notifications, you can ignore them.” In other words, the complainant was informed that the Company had no way to modify the settings of its App to stop the receipt of commercial communications, presenting these messages as unavoidable and inviting the complainant to ignore them if not a data subject. However, the above appears to be contradicted by the technical measures implemented by the Company itself, which—in order to honor the complainant’s objection—stated that it had complied with the complainant’s request by blocking the commercial notifications sent within the BBVA app.

The discrepancy between what the Company implemented and reported to this Office and what Customer Service communicated to the complainant appears to be the result of inadequate organizational measures, which, in effect, led to the dissemination of incorrect and non-transparent information regarding the processing activities carried out within the data controller’s organization. This is of particular significance given that Customer Service represents the first point of contact between data subjects and the controller. Therefore, the violation of Articles 5(1)(a) and 24 of the Regulation is confirmed. 4. CONCLUSIONS In light of these considerations, the allegations set forth in the notice initiating the proceedings pursuant to Art. 166 of the Code are confirmed, as the statements made during the preliminary investigation, the defenses raised, and the evidence submitted in the case file are insufficient to rebut the findings made by the Office; furthermore, none of the cases provided for in Art. 11 of Regulation No. 1/2019 apply.

Therefore, the Authority finds that the conduct of the controller was unlawful for: a) failing to properly address the data subject’s objection within the prescribed time limits, b) failing to provide an appropriate response to the data subject’s request, and c) failing to implement appropriate technical and organizational measures to ensure the transparency and fairness of the processing, all of which constitute violations of the following articles, respectively: - Articles 5(1)(a), 12, and 21 of the Regulation; - Articles 5(1)(a) and 24 of the Regulation. 5. CORRECTIVE MEASURES Having established, under the terms set forth above, that the processing operations under review were unlawful, it is necessary to require the Company to: a) pursuant to Article 58, para 2, subparagraph d) of the Regulation, to adopt appropriate technical and organizational measures to facilitate the exercise of the rights provided for by data protection legislation and to respond, without undue delay and in a proper manner, the relevant requests for the exercise of the data subject rights; b) pursuant to Article 157 of the Code, to notify the Authority, within 30 days of notification of this order, of the actions taken, providing more detailed descriptions than those already provided, in order to implement the required measures; Failure to comply with the provisions of this section may result in the imposition of the administrative fine provided for in Art. 83(5) of the Regulation.

Pursuant to Articles 58(2)(i) of the Regulation and Article 166 of the Code, the Data Protection Authority has the power to impose an administrative fine pursuant to Article 83 of the Regulation, by issuing an injunction (see Article 18 of Law No. 689 of November 24, 1981, and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019). 6.1. Assessment of the Conduct and Determination of the Applicable Sanction Given that the violation of Articles 5(1)(a), 12, 21, and 24 of the Regulation occurred as a result of interrelated processing operations, Article 83, para 3, of the Regulation applies, pursuant to which the total amount of the administrative fine shall not exceed the amount specified for the most serious violation. Given that, in the present case, the violations are all subject to the penalty provided for in Article 83(5) of the Regulation, as also referred to in Article 166, paragraph 2, of the Code, the total amount of the fine shall be set at up to 4% of the annual global turnover for 2025. 6.2.

Determination of the Administrative Fine (Article 83, para 2, of the Regulation) The amount of the administrative fine must be determined based on the circumstances of each individual case, taking due account of the factors set forth in Art. 83(2) of the Regulation. Taking into account the following: the nature of the violation, which concerned the provisions relating to the exercise of the data subject rights; the duration of the violation, which lasted for 7 months (from October 2025 to May 2026); the involvement of a single data subject and the purpose pursued, namely marketing (see Article 83(2)(a) of the Regulation); the negligent nature of the violation (see Art. 83(2)(b) of the Regulation); the nature of the personal data involved (contact information) (see Art. 83(2)(g) of the Regulation), it is considered that, in the present case, the severity of the violation committed by the controller is low (see European Data Protection Board, “Guidelines 4/2022 on the calculation of administrative fines under the GDPR” of May 24, 2023, paragraph 60).

That said, given that the controller is an entity with an annual turnover exceeding 500 million euros, it is considered that, for the purposes of determining the fine, the following circumstances should be taken into account: as a mitigating factor, the adoption of measures, during the investigation, aimed at bringing the violation to an end (see Art. 83, para. 2, subpar. c), of the Regulation); as an aggravating factor, the accountability—which is deemed to be of moderate severity—for failing to adopt organizational measures (appropriate training of the Customer Service department) adequate to facilitate the exercise of data subjects’ rights (see Article 83(2)(d) of the Regulation); as an aggravating factor, the Data Protection Authority’s previous decision No. 413 of July 10, 2025 (web doc. No. 10168555), in which, among other things, violations relevant to those at issue in the present investigation were found against the Company (see Art. 83(2)(e) of the Regulation).

In light of the aforementioned factors, evaluated as a whole, and in accordance with the principles of effectiveness, proportionality, and deterrence set forth in Art. 83, para 1, of the Regulation, it is hereby determined that the amount of the monetary penalty shall be 5,508,000.00 euros (five million five hundred eight thousand/00) for the violation of Articles 5, para 1, letter a), 12, 21, and 24 of the Regulation. In conclusion, it is deemed that, pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the ancillary sanction of publishing this section of the decision containing theon the Data Protection Authority’s website, given the nature of the violation—which concerned the exercise of the data subject rights—as well as the risks to the rights and freedoms of data subjects, and also in light of the previous decision adopted against the Company for related violations.

FOR THESE REASONS - pursuant to Articles 57 and 83 of the Regulation, the processing of personal data carried out by Banco Bilbao Vizcaya Argentaria, S.A., Italian branch, represented by its current legal representative, with registered office at Corso Vittorio Emanuele 9, 20122 Milan, Tax ID and VAT No. 06862150155, is hereby declared unlawful for violating Articles 5(1)(a), 12, 21, and 24 of the Regulation, as set forth in the grounds for this decision; - Pursuant to Article 58, para 2, subparagraph d) of the Regulation, the Company is required to adopt appropriate technical and organizational measures to facilitate the exercise of the rights provided for by the legislation on data protection and to comply, without undue delay and in a proper manner, the relevant requests for the exercise of the data subject rights; - Pursuant to Article 157 of the Code, the Company is required to notify the Authority, within 30 days of the notification of this order, of the actions taken, providing more detailed descriptions than those already provided, in order to implement the measures imposed; Failure to comply with the provisions of this section may result in the imposition of the administrative fine provided for in Art. 83(5) of the Regulation.

IT IS ORDERED pursuant to Articles 58(2)(i) and 83 of the Regulations, as well as Article 166 of the Code, that the Company pay the sum of 5,508,000.00 euros (five million five hundred eight thousand/00) as an administrative fine for the violations set forth in the grounds of this decision. IT IS ORDERED that the Company, in the event of failure to settle the dispute pursuant to Article 166, paragraph 8, of the Code, pay the sum of 5,508,000.00 euros (five million five hundred eight thousand/00), in accordance with the procedures set forth in the attachment, within 30 days of the service of this order, failing which the necessary enforcement measures will be taken pursuant to Art. 27 of Law No. 689/1981. It is noted that, pursuant to Article 166, paragraph 8, of the Code, the offender retains the right to settle the dispute by paying—again in accordance with the procedures set forth in the attachment – of an amount equal to half of the imposed penalty within the time limit set forth in Article 10, paragraph 3, of Legislative Decree No. 150 of September 1, 2011, provided for the filing of an appeal as indicated below; IT IS HEREBY ORDERED pursuant to Article 154-bis, paragraph 3, of the Code and Article 37 of the Data Protection Authority’s Regulation No. 1/2019, that this decision be published on the Data Protection Authority’s website; pursuant to Article 166, paragraph 7, of the Code and Article 16, paragraph 1, of the Data Protection Authority’s Regulation No. 1/2019, the publication of the injunction order on the Data Protection Authority’s website; pursuant to Article 17 of the Data Protection Authority’s Regulation No. 1/2019, the recording of the violations and the measures adopted in accordance with Article 58(2) of the Regulation in the Authority’s internal register provided for in Article 57(1)(u) of the Regulation.

Pursuant to Article 78 of the Regulation, as well as Article 152 of the Code and Article 10 of Legislative Decree No. 150 of September 1, 2011, an appeal against this decision may be filed with the ordinary courts, by filing an appeal with the ordinary court of the jurisdiction identified in said Art 10, under penalty of inadmissibility, within thirty days from the date of notification of the decision, or within sixty days if the appellant resides abroad. Rome, September 3, 2026 THE PRESIDENT Stanzione THE RAPPORTEUR Stanzione THE SECRETARY GENERAL Montuori