Article 21 GDPR — enforcement

Cited in 131 decisions · €101.4M total fines · median €9,850 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (38)

Read Article 21 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2021-03-25	Fastweb S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€4,500,000
2021-03-11	Vodafone España, S.A.U. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 28 Art. 24 Art. 44 Art. 21	€8,150,000
2021-03-11	Planet Group Spa Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 21 Art. 12	€80,000
2021-02-24	Avilon Center 2016 S.L. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 48 Art. 21 Art. 23	€12,000
2021-02-11	Vamavi Phone S.L. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 48 Art. 21 Art. 23 Art. 28	€24,000
2021-01-12	BELGIUM DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 6 Art. 12 Art. 21	€10,000
2020-12-22	Iberdrola Clientes, SAU Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 48 Art. 21 Art. 23	€6,000
2020-12-07	Perfomeclic Insufficient legal basis for data processing	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 14 Art. 21 Art. 28	€7,300
2020-11-18	Carrefour France Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 12 Art. 13 Art. 15	€2,250,000
2020-11-12	Vodafone Italia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€12,251,601
2020-07-31	Tour & People Max S.L. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 21	€1,500
2020-07-14	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 7 Art. 13	€400
2020-07-02	De Vere Spain S.L. Insufficient fulfilment of data subjects rights	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 21	€4,000
2020-06-16	BELGIUM DPA: Insufficient fulfilment of data subjects rights Insufficient fulfilment of data subjects rights	🇪🇺 Belgian Data Protection Authority (APD)	Art. 17 Art. 21 Art. 31	€1,000
2020-05-29	Non-profit organisation Insufficient fulfilment of data subjects rights	🇪🇺 Belgian Data Protection Authority (APD)	Art. 6 Art. 21	€1,000
2020-03-25	Dante International Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 21	€3,000
2020-02-03	Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 21	€20,000
2020-02-03	Banco Bilbao Vizcaya Argentaria S.L. Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 21	€6,670
2020-01-15	TIM (telecommunications operator) Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 21	€27,800,000
2020-01-01	CZECH REPUBLIC DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 12 Art. 15	€19,200
2020-01-01	Bank Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 48 Art. 21 Art. 23	—
2020-01-01	Ski rental company Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 7 Art. 12	—
2019-12-16	SC Enel Energie S.A. (Electricity Distributor) Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7 Art. 21	€6,000
2019-12-11	Eni Gas e Luce Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 17 Art. 21	€8,500,000
2019-11-21	Futura Internationale Insufficient fulfilment of data subjects rights	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 6 Art. 13 Art. 14	€500,000

← previous 101–125 of 131 next →