Article 21 GDPR — enforcement

Cited in 120 decisions · €88.7M total fines · median €8,250 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (38)

Read Article 21 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2020-07-14	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 7 Art. 13	€400
2020-07-02	De Vere Spain S.L. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 21	€4,000
2020-06-16	BELGIUM DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights	🇪🇺 Belgian Data Protection Authority (APD)	Art. 17 Art. 21 Art. 31	€1,000
2020-05-29	Non-profit organisation Insufficient fulfilment of data subjects rights	🇪🇺 Belgian Data Protection Authority (APD)	Art. 6 Art. 21	€1,000
2020-03-25	Dante International Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 21	€3,000
2020-02-03	Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 21	€20,000
2020-02-03	Banco Bilbao Vizcaya Argentaria S.L. Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 21	€6,670
2020-01-15	TIM (telecommunications operator) Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 21	€27,800,000
2020-01-01	CZECH REPUBLIC DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 12 Art. 15	€19,200
2020-01-01	Ski rental company Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 7 Art. 12	—
2020-01-01	Bank Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 48 Art. 21 Art. 23	—
2019-12-16	SC Enel Energie S.A. (Electricity Distributor) Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7 Art. 21	€6,000
2019-12-11	Eni Gas e Luce Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 21	€8,500,000
2019-11-21	Futura Internationale Insufficient fulfilment of data subjects rights	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 6 Art. 13 Art. 14	€500,000
2019-10-18	Wind Hellas Telecommunications Insufficient fulfilment of data subjects rights	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 21	€20,000
2019-10-08	Legal Person Insufficient fulfilment of data subjects rights	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 21	€400
2019-10-07	Telecommunication Service Provider Non-compliance with general data processing principles	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 21 Art. 25	€200,000
2019-09-19	Delivery Hero Insufficient fulfilment of data subjects rights	🇪🇺 Data Protection Authority of Berlin	Art. 15 Art. 17 Art. 21	€195,407
2019-06-26	Financial Enterprise Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 21	€2,850
2019-01-01	Hamburger Volksbank eG Insufficient fulfilment of data subjects rights	🇪🇺 Data Protection Authority of Hamburg	Art. 21	—

← previous 101–120 of 120