Article 35 GDPR — enforcement

Cited in 102 decisions · €509.6M total fines · median €55,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (31)

Read Article 35 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2024-11-13	Foodinho Srl Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€5,000,000
2024-04-02	Greek Ministry of Immigration and Asylum Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 25 Art. 31 Art. 35	€175,000
2024-02-12	CTC EXTERNALIZACIÓN, S.L Insufficient fulfilment of information obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 13 Art. 32 Art. 35	€365,000
2024-01-15	International Card Services B.V. Insufficient technical and organisational measures to ensure information security	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 35	€150,000
2023-11-28	Östersund Municipality's Department for Children and Education Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Authority of Sweden	Art. 35	€26,500
2023-11-16	Comune di Castel Goffredo Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 12 Art. 13	€50,000
2023-09-25	Athens Urban Transport Organization Non-compliance with general data processing principles	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 25 Art. 35	€50,000
2023-08-22	DPC (Ireland) - 06/SIU/2018	🇮🇪 DPC (Ireland)	Art. 51 Art. 5 Art. 24 Art. 351	—
2023-06-08	Rinascente S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 32 Art. 35	€300,000
2023-05-03	GSMA LTD. Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€200,000
2023-04-28	ALBERO FORTE COMPOSITE, S.L. Insufficient technical and organisational measures to ensure information security	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€12,000
2023-01-09	Praktiškas UAB Insufficient legal basis for data processing	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 9 Art. 13 Art. 30	€6,000
2022-12-15	Azienda Universitaria Friuli Occidentale Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 14 Art. 35	€55,000
2022-12-15	Azienda Universitaria Giuliano Isontina Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 14 Art. 35	€55,000
2022-12-15	Azienda Universitaria Friuli Centrale Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 14 Art. 35	€55,000
2022-11-10	DISCORD INC. Non-compliance with general data processing principles	🇪🇺 French Data Protection Authority (CNIL)	Art. 5 Art. 13 Art. 25 Art. 32	€800,000
2022-11-02	Portuguese National Statistical Institute Non-compliance with general data processing principles	🇪🇺 Portuguese Data Protection Authority (CNPD)	Art. 5 Art. 9 Art. 12 Art. 13	€4,300,000
2022-10-06	Alpha Exploration Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€2,000,000
2022-09-05	Meta Platforms, Inc. Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Ireland	Art. 5 Art. 6 Art. 12 Art. 24	€405,000,000
2022-08-19	Medical laboratory Insufficient technical and organisational measures to ensure information security	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 12 Art. 13 Art. 14	€20,000
2022-07-26	Volkswagen Insufficient fulfilment of information obligations	🇪🇺 Data Protection Authority of Niedersachsen	Art. 13 Art. 28 Art. 30 Art. 35	€1,100,000
2022-05-18	Clearview Al Inc. Non-compliance with general data processing principles	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 9 Art. 14	€9,000,000
2022-04-28	Tarento municipality Insufficient fulfilment of information obligations	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 14	€150,000
2022-04-07	Dutch Tax and Customs Administration Non-compliance with general data processing principles	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 6 Art. 32 Art. 35	€3,700,000
2022-04-07	Azienda ospedaliera di Perugia Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 14 Art. 25	€40,000

← previous 51–75 of 102 next →