What happened
A BBVA Italia customer switches off commercial communications in the app. The promotional notifications continue. He objects a second time, this time writing to customer service. They continue anyway. This goes on from October 2025 to May 2026, about seven months, until on 11 March 2026 he complains to the authority. By decision no. 613 of 3 September 2026 the authority fined the bank 5,508,000 euro, finding breaches of Articles 5, 12, 21 and 24 GDPR, and ordered it to adopt technical and organisational measures ensuring that data subject requests are handled correctly and promptly.
The bank's defence was technical: a malfunction in the CRM, the software that holds customer data together. The objection had been recorded, it simply was not propagated to the systems that send the notifications. Put that way it sounds like bad luck; seen from the data subject's side it is exactly the same as never having recorded it.
Why a malfunction is not an excuse
Article 21(3) does not say the controller must take note of the objection: it says the data shall no longer be processed for direct marketing purposes. That is an obligation of result, not of diligence. And Article 24 requires appropriate technical and organisational measures, including those that check the other measures work. An objection that goes into the system and does not come out the other side is proof that such a check was missing.
- Objection to direct marketing is absolute: there is no balancing, no legitimate interest that survives it, and the data subject owes no reason.
- It must be applied without undue delay, and the reference deadline is the one in Article 12(3): one month.
- Recording the preference and propagating it are two different operations: the second is the one that counts, and almost nobody tests it.
- A second complaint from the same person is an alarm: it means the first one did not work and nobody noticed.
- The controller must be able to demonstrate that the objection was applied, not merely received — that is Article 5(2).
The half-hour test almost nobody runs
It is called a propagation test and it goes like this: take a service mailbox, subscribe it, object through the channel a customer would use, and then wait. If something still arrives after two weeks, the problem exists and is documented before an authority documents it. It is worth running on every system that sends communications: email, SMS, in-app notifications, telephone. They are often four different systems, and the objection has to reach all four.
Then there is the point that makes this decision useful well beyond banking. A malfunction is a kind of risk the register of processing cannot see: the register says objections are handled, and formally that is true. What the register does not say is whether, between the form and the sending system, there is a step that can break silently. No template asks that question: the DPO who goes and looks does.
What to do today, concretely. For every client that sends commercial communications, three lines in the file: which systems the messages come out of, where the objection is recorded, and who verified — with a date — that the second stops the first. If the third line is empty, that is the line to fill this week, because it is the only one an authority would ask you to prove.
Official source:Garante per la protezione dei dati personali — decisionsOfficial source:Altalex — When the CRM defeats the right to object to direct marketingOfficial source:Cybersecurity360 — BBVA fine: when the CRM defeats the right to objectLooking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
