Article 3 GDPR — enforcement

Cited in 4 decisions · €2.2M total fines · median €158,000 · top authority: 🇮🇹Garante per la protezione dei dati personali (Italy) (2)

Date ↓	Company / party	Authority	Articles	Fine
2026-07-14	Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 32 Art. 51	€2,000,000
2026-07-03	Italian DPA finds GDPR applies to US-based Character.AI service	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 32 Art. 3 Art. 52 Art. 5	€158,000
2021-11-14	Vodafone România SA Insufficient technical and organisational measures to ensure information security	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 3	€2,900
2019-09-03	CNPD (Portugal) - Deliberação 2019/494	🇵🇹 CNPD (Portugal)	Art. 288 Art. 2 Art. 3 Art. 56	—