Article 4 GDPR — enforcement

Cited in 22 decisions · €3.1M total fines · median €8,300 · top authority: 🇧🇪APD/GBA (Belgium) (4)

Date ↓	Company / party	Authority	Articles	Fine
2026-08-12	AEPD (Spain) - PS/00249/2025	🇪🇸 AEPD (Spain)	Art. 411 Art. 4 Art. 52 Art. 5	€10,000
2026-07-24	HDPA (Greece) 33/2020 — Employee's access and erasure claims against the American College	🇬🇷 HDPA (Greece)	Art. 47 Art. 4 Art. 5 Art. 12	€2,000
2026-07-24	ANSPDCP (Romania) - Fine against There's an AI for that S.R.L	🇷🇴 ANSPDCP (Romania)	Art. 4	€30
2026-07-20	Italian DPA: Justice Ministry unlawful disclosure of employee health data in service order	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 49 Art. 4 Art. 410 Art. 415	€12,000
2026-07-16	AEPD investigates University of Navarra over student COVID-19 vaccination status requests	🇪🇸 AEPD (Spain)	Art. 415 Art. 4 Art. 51 Art. 5	—
2026-07-09	ANSPDCP (Romania) - Fine against Ascendex Technology SRL	🇷🇴 ANSPDCP (Romania)	Art. 423 Art. 4 Art. 121 Art. 12	€57,839
2026-06-18	Italian Garante: Employer's recording of locker opening and destruction of contents	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 21 Art. 2 Art. 41 Art. 4	€6,600
2026-05-28	EDPB - Binding Decision 1/2026	🇪🇺 EDPB	Art. 424 Art. 4 Art. 571 Art. 57	—
2026-04-16	AKI (Estonia) - No. 2.1-1/24/397-890-38	🇪🇪 AKI (Estonia)	Art. 47 Art. 4 Art. 411 Art. 51	—
2026-02-26	S.M. Trattamento Acqua di XX Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€30,000
2026-02-12	Depurazione Acqua S.r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 4 Art. 5 Art. 6 Art. 7	€15,000
2026-01-12	DSB: Medical student fined for recording dementia patient video without Art 9 GDPR basis	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 51 Art. 5	€200
2024-10-11	Belgian DPA finds cookie banner without reject-all button and unequal withdrawal violates	🇧🇪 APD/GBA (Belgium)	Art. 411 Art. 4 Art. 51 Art. 5	—
2023-11-24	Belgian DPA settles with Mediafin: De Tijd cookie banner must add equal "refuse all"	🇧🇪 APD/GBA (Belgium)	Art. 411 Art. 4 Art. 61 Art. 6	—
2022-12-29	CNIL fines VOODOO for cookie and tracker consent failures in mobile games	🇫🇷 CNIL (France)	Art. 82 Art. 5 Art. 4	€3,000,000
2022-05-25	APD/GBA (Belgium) - 85/2022	🇧🇪 APD/GBA (Belgium)	Art. 411 Art. 4 Art. 51 Art. 5	€50
2022-01-21	Belgian DPA rules on competence in cross-border cookie consent complaint involving	🇧🇪 APD/GBA (Belgium)	Art. 41 Art. 4 Art. 411 Art. 51	—
2021-08-05	DSB Austria: sharing medical assessment with municipality lacked Art. 9(2) legal basis	🇦🇹 DSB (Austria)	Art. 42 Art. 4 Art. 47 Art. 410	€600
2020-11-19	DSB (Austria) - 2020-0.743.659	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 51 Art. 5	—
2020-07-30	HDPA (Greece) - 23/2020	🇬🇷 HDPA (Greece)	Art. 41 Art. 4 Art. 47 Art. 5	—
2019-12-18	DSB (Austria) - D123.768/0004-DSB/2019	🇦🇹 DSB (Austria)	Art. 44 Art. 4 Art. 47 Art. 851	—
2017-11-08	Datatilsynet (Norway) - 15/01355	🇳🇴 Datatilsynet (Norway)	Art. 411 Art. 4 Art. 51 Art. 5	—