Article 35 GDPR — enforcement

Cited in 102 decisions · €509.6M total fines · median €55,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (31)

Read Article 35 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2022-04-04	Brussels Airport Zaventem Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€200,000
2022-04-04	Brussels Airport Charleroi Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€100,000
2022-01-27	Cosmote Mobile Telecommunications S.A. Insufficient technical and organisational measures to ensure information security	🇪🇺 Hellenic Data Protection Authority (HDPA)	Art. 5 Art. 13 Art. 14 Art. 25	€6,000,000
2022-01-27	EU DisinfoLab Non-compliance with general data processing principles	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€2,800
2022-01-13	Azienda sanitaria unica regionale Marche Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 32 Art. 35	€14,000
2021-12-21	Lisbon City Council Insufficient legal basis for data processing	🇪🇺 Portuguese Data Protection Authority (CNPD)	Art. 5 Art. 6 Art. 9 Art. 13	€1,250,000
2021-10-26	SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 35	€16,000
2021-09-16	Bocconi University Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€200,000
2021-09-16	Ciechi Ardizzone Gioeni di Catania Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 12 Art. 13 Art. 35	€5,000
2021-07-26	Mercadona S.A. Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 9 Art. 12	€2,520,000
2021-07-22	Deliveroo Italy s.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 22 Art. 25	€2,500,000
2021-06-21	UAB VS FITNESS Non-compliance with general data processing principles	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 9 Art. 13 Art. 30	€20,000
2021-06-10	Foodinho s.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 22 Art. 25	€2,600,000
2021-05-13	Comune di Bolzano Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€84,000
2021-03-15	Ålesund Municipality Insufficient technical and organisational measures to ensure information security	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 32 Art. 24 Art. 35	€4,900
2021-02-26	Nacionaliniam visuomenės sveikatos centrui (NVSC) Non-compliance with general data processing principles	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 13 Art. 24 Art. 32	€12,000
2021-02-26	IT sprendimai sėkmei Non-compliance with general data processing principles	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 13 Art. 24 Art. 32	€3,000
2021-02-25	Istituto Nazionale Previdenza Sociale (INPS) Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 25 Art. 35	€300,000
2021-01-01	Electronics store Non-compliance with general data processing principles	🇪🇺 Data Protection Authority of Niedersachsen	Art. 5 Art. 17 Art. 35	€16,000
2020-12-17	Azienda Unità Sanitaria Locale Toscana Sud Est Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 13 Art. 14 Art. 28	€100,000
2020-11-25	Gnosjö Municipality Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)	Art. 5 Art. 6 Art. 13 Art. 35	€19,500
2020-07-10	Municipality of Rælingen Insufficient technical and organisational measures to ensure information security	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 32 Art. 35	€46,660
2020-05-29	Taksi Helsinki Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 5 Art. 6 Art. 35	€72,000
2020-05-22	Kymen Vesi Oy Non-compliance with general data processing principles	🇪🇺 Deputy Data Protection Ombudsman	Art. 35	€16,000
2020-01-01	LITHUANIA DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles	🇪🇺 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 13 Art. 24 Art. 35	€8,000

← previous 76–100 of 102 next →