GDPR enforcement in 2021
531 decisions · €1.3B total fines · ← 2020 · 2022 →
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2021-01-04 | Innovasjon Norge Insufficient legal basis for data processing | 🇪🇺 Norwegian Supervisory Authority (Datatilsynet) | Art. 5Art. 6 | €95,500 |
| 2021-01-04 | Vodafone España, S.A.U. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5 | €54,000 |
| 2021-01-01 | Bank Insufficient technical and organisational measures to ensure information security | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 5Art. 32 | €4,000,000 |
| 2021-01-01 | Customer loyalty program Unknown | 🇪🇺 Austrian Data Protection Authority (dsb) | €700,000 | |
| 2021-01-01 | SLOVAKIA DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles | 🇪🇺 Slovak Data Protection Office | Art. 5Art. 28 | €40,000 |
| 2021-01-01 | Electronics store Non-compliance with general data processing principles | 🇪🇺 Data Protection Authority of Niedersachsen | Art. 5Art. 17Art. 35 | €16,000 |
| 2021-01-01 | Energy supplier Unknown | 🇪🇺 Data Protection Authority of Hamburg | €12,500 | |
| 2021-01-01 | Energy supplier Unknown | 🇪🇺 Data Protection Authority of Hamburg | €12,500 | |
| 2021-01-01 | Car trading group Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Hamburg | €10,100 | |
| 2021-01-01 | Private individual Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Hamburg | Art. 5Art. 6 | €5,000 |
| 2021-01-01 | Police officer Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Hessen | Art. 5Art. 6 | €1,800 |
| 2021-01-01 | Police officer Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Hessen | Art. 5Art. 6 | €600 |
| 2021-01-01 | Private individual Non-compliance with general data processing principles | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 5Art. 9 | €600 |
| 2021-01-01 | SLOVAKIA DPA: Insufficient cooperation with supervisory authority Insufficient cooperation with supervisory authority | 🇪🇺 Slovak Data Protection Office | Art. 31 | €500 |
| 2021-01-01 | Police officer Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Hessen | Art. 5Art. 6 | €500 |
| 2021-01-01 | Police officer Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Hessen | Art. 5Art. 6 | €400 |
| 2021-01-01 | Restaurant Non-compliance with general data processing principles | 🇪🇺 Data Protection Authority of Hessen | Art. 5 | €170 |
| 2021-01-01 | SLOVAKIA DPA: €100 fine Unknown | 🇪🇺 Slovak Data Protection Office | €100 | |
| 2021-01-01 | GERMANY DPA: Insufficient technical and organisational measures to ensure information security Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Niedersachsen | Art. 32 | — |
| 2021-01-01 | Company Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Hamburg | Art. 32 | — |
| 2021-01-01 | Physician Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Brandenburg | Art. 6 | — |
| 2021-01-01 | Private individual Non-compliance with general data processing principles | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 5 | — |
| 2021-01-01 | Private individual Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Brandenburg | Art. 6 | — |
| 2021-01-01 | Real estate agent Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Brandenburg | Art. 6Art. 12 | — |
| 2021-01-01 | Medical clinic Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Berlin | Art. 5Art. 6 | — |