Article 22 GDPR — enforcement
Cited in 26 decisions · €1.7B total fines · median €100,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (7)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-08-21 | Uber Technologies Inc. Non-compliance with general data processing principles | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 22Art. 13Art. 14 | €824,990,000 |
| 2026-08-21 | AP (The Netherlands) - Uber B.V and Uber Technologies Inc. | 🇳🇱 AP (The Netherlands) | Art. 22 | €824,990,000 |
| 2026-08-19 | Garante per la protezione dei dati personali (Italy) - 10266250 | 🇮🇹 Garante per la protezione dei dati personali (Italy) | Art. 5Art. 6Art. 7Art. 12 | €15,300 |
| 2026-07-23 | TIM S.p.A. Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 15 | €9,516,000 |
| 2026-03-07 | Italian DPA finds Cerved Group failed to disclose creditworthiness scores in Art. 15 | 🇮🇹 Garante per la protezione dei dati personali (Italy) | Art. 51Art. 5Art. 12Art. 15 | €400,000 |
| 2026-02-26 | S.M. Trattamento Acqua di XX Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 4Art. 5Art. 6Art. 7 | €30,000 |
| 2026-01-09 | DSB (Austria) - DSB-D124.2437/25 | 🇦🇹 DSB (Austria) | Art. 2Art. 41Art. 4Art. 42 | — |
| 2025-04-29 | Energia Verde S.p.A. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €100,000 |
| 2025-04-29 | Energia Verde S.p.A. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €100,000 |
| 2024-11-27 | E.ON Energia spa Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €892,783 |
| 2024-11-13 | Foodinho Srl Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 12 | €5,000,000 |
| 2024-06-20 | Fastweb S.p.A. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 7Art. 12 | €1,000,000 |
| 2023-09-23 | CHATWITH.IO WORLDWIDE, S.L. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 13Art. 22 | €12,000 |
| 2023-05-31 | Deutsche Kreditbank Insufficient fulfilment of data subjects rights | 🇪🇺 Data Protection Authority of Berlin | Art. 5Art. 15Art. 22 | €300,000 |
| 2022-11-03 | Burwebs S.L. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 12Art. 13Art. 25 | €75,000 |
| 2022-10-31 | TECHPUMP SOLUTIONS S.L. Non-compliance with general data processing principles | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 5Art. 6Art. 8Art. 12 | €525,000 |
| 2022-05-18 | Clearview Al Inc. Non-compliance with general data processing principles | 🇪🇺 Information Commissioner (ICO) | Art. 5Art. 6Art. 9Art. 14 | €9,000,000 |
| 2022-04-18 | JIMBO NETWORKS, S.L. Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6Art. 13Art. 22 | €9,000 |
| 2022-04-18 | Website operator Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 6Art. 13Art. 22 | €1,800 |
| 2022-04-13 | RAMONA FILMS, S.L. Insufficient fulfilment of information obligations | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 13Art. 22 | €8,000 |
| 2021-07-22 | Deliveroo Italy s.r.l. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 13Art. 22Art. 25 | €2,500,000 |
| 2021-07-06 | AEPD fines Bankia/Caixabank for sending commercial mail despite objection | 🇪🇸 AEPD (Spain) | Art. 61Art. 6Art. 221Art. 22 | €50,000 |
| 2021-06-10 | Foodinho s.r.l. Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 13Art. 22Art. 25 | €2,600,000 |
| 2021-03-10 | Self Employed Person Insufficient legal basis for data processing | 🇪🇺 Czech Data Protection Auhtority (UOOU) | Art. 5Art. 6Art. 12Art. 13 | €200 |
| 2020-10-16 | AEPD (Spain) - PS/00032/2020 | 🇪🇸 AEPD (Spain) | Art. 22 | €30,000 |
1–25 of 26 next →