Italy's data protection authority has imposed a fine of approximately €5,508,000 on BBVA for failing to respect a customer's objection to direct marketing, according to a notice from the European Data Protection Board.
The case centres on a customer who had exercised a right to object to receiving marketing communications, and whose objection was not subsequently honoured by the bank's processing systems or marketing operations.
Financial institutions operating across the European Union, including those with cross-border customer bases, are directly affected by this type of enforcement, as it signals continued scrutiny of how objection and preference records are implemented operationally rather than merely documented in policy.
The published summary does not detail which specific processing activities or systems failed to reflect the customer's objection, nor does it specify the timeframe over which the marketing continued.
While this enforcement action concerns data protection rather than the EU AI Act, it is relevant to organisations preparing AI governance programmes because it illustrates a recurring enforcement pattern: regulators penalise gaps between stated policy and operational reality.
As a compliance matter, organisations deploying AI systems that process personal data, including those used for marketing personalisation or customer profiling under the AI Act's broader governance framework, should treat this as a reminder that consent, objection, and preference signals need to be technically enforced across all connected systems, not just recorded centrally.
Firms building compliance workflows ahead of the EU AI Act's phased obligations may find it useful to audit how objection and consent flags propagate through automated decision-making pipelines, since failures of this kind can trigger both data protection penalties and scrutiny under AI-specific transparency requirements.