Article 16 GDPR — enforcement

Cited in 20 decisions · €23.1M total fines · median €25,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (9)

Read Article 16 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-07-17	AEPD (Spain) - EXP202103746	🇪🇸 AEPD (Spain)	Art. 51 Art. 5 Art. 12 Art. 15	—
2026-06-18	Acquirente Unico S.p.A. Insufficient fulfilment of data subjects rights	🇮🇹 Italian Data Protection Authority (Garante)	Art. 12 Art. 16 Art. 28	€90,000
2026-03-07	Italian DPA finds Cerved Group failed to disclose creditworthiness scores in Art. 15	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 12 Art. 15	€400,000
2025-11-24	DSB (Austria) - 2025-0.950.759	🇦🇹 DSB (Austria)	Art. 51 Art. 5 Art. 51 Art. 61	—
2025-09-11	Comune di Nichelino Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 16	€18,000
2025-09-11	Comune di Nichelino Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 16	€18,000
2025-04-29	Energia Verde S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€100,000
2025-04-29	Energia Verde S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€100,000
2025-04-02	Hospital Non-compliance with general data processing principles	🇲🇹 Data Protection Commissioner of Malta	Art. 5 Art. 6 Art. 14 Art. 16	€20,000
2024-06-20	Fastweb S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€1,000,000
2024-05-23	Azienda Socio-sanitaria Territoriale Rhodense Insufficient fulfilment of data subjects rights	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 16	€4,500
2024-01-01	Company Insufficient fulfilment of data subjects rights	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 15 Art. 16	€12,000
2023-08-31	Mednow Medical Center di Giugni Marco Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 12 Art. 15	€10,000
2023-05-17	Website operator Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€60,000
2022-11-02	CAIXABANK S.A. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 16	€25,000
2022-05-18	Clearview Al Inc. Non-compliance with general data processing principles	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 9 Art. 14	€9,000,000
2021-09-15	Société nouvelle de l’annuaire français Insufficient fulfilment of data subjects rights	🇪🇺 French Data Protection Authority (CNIL)	Art. 16 Art. 17 Art. 30 Art. 31	€3,000
2020-11-12	Vodafone Italia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€12,251,601
2020-01-01	CZECH REPUBLIC DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 12 Art. 15	€19,200
2020-01-01	Ski rental company Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 7 Art. 12	—