Article 17 GDPR — enforcement
Cited in 161 decisions · €90.1M total fines · median €7,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (36)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2025-04-10 | Tensa Art Design S.A. Insufficient legal basis for data processing | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 6Art. 12Art. 15Art. 17 | €15,000 |
| 2025-04-10 | Immobiliare Valdalpone S.r.l. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €15,000 |
| 2025-04-10 | Tensa Art Design S.A. Insufficient legal basis for data processing | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 6Art. 12Art. 15Art. 17 | €15,000 |
| 2025-04-10 | Immobiliare Valdalpone S.r.l. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €15,000 |
| 2025-03-20 | ONE UNITED PROPERTIES S.A Insufficient legal basis for data processing | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 6Art. 12Art. 15Art. 17 | €2,000 |
| 2025-03-13 | Encore Thermoengineering s.r.l. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 17 | €20,000 |
| 2025-03-11 | Noy Business Tranzactions SRL Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 12Art. 15Art. 17 | €1,000 |
| 2025-01-27 | Orange Romania SA Non-compliance with general data processing principles | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 5Art. 6Art. 7Art. 12 | €40,000 |
| 2024-10-30 | Untold SRL Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 12Art. 15Art. 17 | €15,000 |
| 2024-09-23 | PPC ENERGIE MUNTENIA S.A. Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 12Art. 17 | €2,000 |
| 2024-09-16 | Vodafone România SA Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 12Art. 15Art. 17 | €3,000 |
| 2024-09-16 | SC Class IT Outsourcing SRL Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 12Art. 17 | €1,000 |
| 2024-06-27 | METRO SA Insufficient technical and organisational measures to ensure information security | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 15Art. 17Art. 24Art. 32 | €50,000 |
| 2024-06-25 | BANCO CETELEM, S.A. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6Art. 17 | €150,000 |
| 2024-06-20 | Fastweb S.p.A. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €1,000,000 |
| 2024-06-04 | Ambitious People Group B.V. Insufficient fulfilment of data subjects rights | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 12Art. 17 | €6,000 |
| 2024-05-30 | Corint Logistic SRL. Insufficient fulfilment of data subjects rights | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 5Art. 17Art. 21 | €2,000 |
| 2024-02-08 | Aylo Social LTD Insufficient fulfilment of data subjects rights | 🇪🇺 Cypriot Data Protection Commissioner | Art. 17 | €1,500 |
| 2024-01-04 | Website operator Insufficient fulfilment of data subjects rights | 🇪🇺 Austrian Data Protection Authority (dsb) | Art. 17Art. 25Art. 58 | €10,000 |
| 2023-11-07 | Municipality Insufficient legal basis for data processing | 🇪🇺 Hellenic Data Protection Authority (HDPA) | Art. 6Art. 17 | €5,000 |
| 2023-10-18 | FESTINA LOTUS S.A. Insufficient fulfilment of data subjects rights | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 17 | €600 |
| 2023-08-31 | Mednow Medical Center di Giugni Marco Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 12Art. 15 | €10,000 |
| 2023-07-18 | Università Telematica E-Campus Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €75,000 |
| 2023-07-18 | Compara Facile S.r.l. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €40,000 |
| 2023-06-29 | Greek DPA: Google breached Art. 17 GDPR erasure right over outdated criminal case links | 🇬🇷 HDPA (Greece) | Art. 122Art. 12Art. 123Art. 17 | — |