GDPR enforcement in 2019
171 decisions · €88.8M total fines · ← 2018 · 2020 →
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2019-03-26 | A.P. EOOD Insufficient legal basis for data processing | 🇪🇺 Data Protection Commision of Bulgaria (KZLD) | Art. 5Art. 6 | €5,100 |
| 2019-03-25 | PORTUGAL DPA: Insufficient fulfilment of information obligations Insufficient fulfilment of information obligations | 🇪🇺 Portuguese Data Protection Authority (CNPD) | Art. 13 | €2,000 |
| 2019-03-21 | CZECH REPUBLIC DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 5 | €10,000 |
| 2019-03-19 | PORTUGAL DPA: Insufficient fulfilment of information obligations Insufficient fulfilment of information obligations | 🇪🇺 Portuguese Data Protection Authority (CNPD) | Art. 13 | €2,000 |
| 2019-03-04 | Unnamed financial institution Insufficient fulfilment of data subjects rights | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 13Art. 17Art. 6 | €3,200 |
| 2019-03-01 | Bergen Municipality Insufficient technical and organisational measures to ensure information security | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 5Art. 32 | €170,000 |
| 2019-03-01 | N26 Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Berlin | Art. 6 | €50,000 |
| 2019-02-28 | Mayor's Office of the city of Kecdkemét Insufficient legal basis for data processing | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6 | €3,200 |
| 2019-02-28 | CZECH REPUBLIC DPA: Insufficient technical and organisational measures to ensure information security Insufficient technical and organisational measures to ensure information security | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 32 | €582 |
| 2019-02-26 | Telecommunication service provider Insufficient legal basis for data processing | 🇪🇺 Bulgarian Commission for Personal Data Protection (KZLD) | Art. 6Art. 5 | €27,100 |
| 2019-02-26 | CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 15 | €776 |
| 2019-02-22 | Employer Insufficient fulfilment of data subjects rights | 🇪🇺 Bulgarian Commission for Personal Data Protection (KZLD) | Art. 15 | €500 |
| 2019-02-20 | Debt collector Non-compliance with general data processing principles | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5 | €1,560 |
| 2019-02-18 | Lands Authority Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Commissioner of Malta | Art. 5Art. 32 | €5,000 |
| 2019-02-08 | Bank Non-compliance with general data processing principles | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5 | €1,560 |
| 2019-02-05 | PORTUGAL DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights | 🇪🇺 Portuguese Data Protection Authority (CNPD) | Art. 15 | €20,000 |
| 2019-02-05 | Private person Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Sachsen-Anhalt | Art. 6Art. 5 | €2,500 |
| 2019-02-04 | Credit brokerage Insufficient technical and organisational measures to ensure information security | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 32 | €1,165 |
| 2019-02-04 | Car renting company Insufficient fulfilment of information obligations | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 5 | €1,165 |
| 2019-01-21 | Google LLC Insufficient legal basis for data processing | 🇪🇺 French Data Protection Authority (CNIL) | Art. 13Art. 14Art. 6Art. 5 | €50,000,000 |
| 2019-01-17 | Bank Insufficient legal basis for data processing | 🇪🇺 Bulgarian Commission for Personal Data Protection (KZLD) | Art. 6Art. 5 | €500 |
| 2019-01-10 | Employer Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 6 | €388 |
| 2019-01-01 | GERMANY DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles | 🇪🇺 Data Protection Authority of Niedersachsen | Art. 5 | €294,000 |
| 2019-01-01 | Taxa 4x35 Non-compliance with general data processing principles | 🇪🇺 Danish Data Protection Authority (Datatilsynet) | Art. 5 | €160,000 |
| 2019-01-01 | GERMANY DPA: Insufficient technical and organisational measures to ensure information security Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Baden-Wuerttemberg | Art. 32 | €80,000 |