Skip to content

Article 34 GDPR — enforcement

Cited in 68 decisions · €84.0M total fines · median €26,350 · top authority: 🇪🇺Polish National Personal Data Protection Office (UODO) (24)

Date ↓ Company / party Authority Articles Fine
2021-12-07 Psykoterapiakeskus Vastaamo
Non-compliance with general data processing principles
🇪🇺 Deputy Data Protection Ombudsman Art. 5Art. 33Art. 34 €608,000
2021-10-14 Bank Millennium S.A
Insufficient fulfilment of data breach notification obligations
🇪🇺 Polish National Personal Data Protection Office (UODO) Art. 33Art. 34 €78,000
2021-06-30 Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra
Insufficient fulfilment of data breach notification obligations
🇪🇺 Polish National Personal Data Protection Office (UODO) Art. 33Art. 34 €3,000
2021-06-21 Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A.
Insufficient fulfilment of data breach notification obligations
🇪🇺 Polish National Personal Data Protection Office (UODO) Art. 33Art. 34 €35,300
2021-04-22 Cyfrowy Polsat S.A.
Insufficient technical and organisational measures to ensure information security
🇪🇺 Polish Data Protection Authority (UODO) Art. 24Art. 32Art. 34 €245,000
2021-03-25 Fastweb S.p.A.
Non-compliance with general data processing principles
🇪🇺 Italian Data Protection Authority (Garante) Art. 5Art. 6Art. 7Art. 12 €4,500,000
2021-03-24 Budapest Főváros Kormányhivatala XI. kerületi Hivatalát (11th District Public Health Department of the Government Office of the Capital City Budapest)
Insufficient technical and organisational measures to ensure information security
🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) Art. 32Art. 33Art. 34 €27,700
2021-01-22 BELGIUM DPA: Insufficient technical and organisational measures to ensure information security
Insufficient technical and organisational measures to ensure information security
🇪🇺 Belgian Data Protection Authority (APD) Art. 5Art. 24Art. 32Art. 33 €25,000
2021-01-05 POLAND DPA: Insufficient fulfilment of data breach notification obligations
Insufficient fulfilment of data breach notification obligations
🇪🇺 Polish National Personal Data Protection Office (UODO) Art. 34Art. 58 €19,000
2021-01-05 Śląski Uniwersytet Medyczny (Medical University of Silesia)
Insufficient fulfilment of data breach notification obligations
🇪🇺 Polish National Personal Data Protection Office (UODO) Art. 33Art. 34 €5,500
2020-12-28 Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A.
Insufficient fulfilment of data breach notification obligations
🇪🇺 Polish National Personal Data Protection Office (UODO) Art. 33Art. 34 €18,930
2020-12-16 Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.)
Insufficient technical and organisational measures to ensure information security
🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) Art. 25Art. 32Art. 34 €55,400
2020-12-09 TUiR Warta S.A.
Insufficient fulfilment of data breach notification obligations
🇪🇺 Polish National Personal Data Protection Office (UODO) Art. 33Art. 34 €18,850
2020-06-30 Lejre Municipality
Non-compliance with general data processing principles
🇪🇺 Danish Data Protection Authority (Datatilsynet) Art. 5Art. 6Art. 33Art. 34 €6,700
2020-04-29 National Government Service Centre (NGSC)
Insufficient fulfilment of data breach notification obligations
🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten) Art. 33Art. 34 €18,700
2019-04-05 Hungarian political party
Insufficient fulfilment of data breach notification obligations
🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) Art. 33Art. 34 €34,375
2019-01-01 Hamburger Verkehrsverbund GmbH (HVV GmbH)
Insufficient fulfilment of data breach notification obligations
🇪🇺 Data Protection Authority of Hamburg Art. 33Art. 34 €20,000
2018-01-01 GERMANY DPA: Insufficient fulfilment of data breach notification obligations
Insufficient fulfilment of data breach notification obligations
🇪🇺 Data Protection Authority of Hamburg Art. 33Art. 34 €20,000