Article 7 GDPR — enforcement

Cited in 123 decisions · €2.2B total fines · median €30,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (55)

Read Article 7 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2021-05-13	Iren Mercato S.p.A. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7	€2,856,169
2021-05-03	EDPS: CJEU violated Regulation 2018/1725 over cookies and consent on its website	🇪🇺 EDPS	Art. 7	—
2021-04-30	CNIL closes Google cookies case after accepting compliance adjustments	🇫🇷 CNIL (France)	Art. 7	€100,000,000
2021-04-15	S.C. Tip Top Food Industry S.R.L Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7	€5,000
2021-03-25	Fastweb S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 12	€4,500,000
2021-03-25	OneDirect Srl Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 6 Art. 7 Art. 30 Art. 31	€30,000
2021-01-27	Family Service / N.D.P.K. nv. Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 7 Art. 13	€50,000
2020-12-10	Borjamotor, S.A. Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 7	€4,000
2020-11-12	Vodafone Italia S.p.A. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 15	€12,251,601
2020-09-22	Iweb Internet Learning, S.L. Insufficient fulfilment of information obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 7 Art. 12 Art. 13	€7,800
2020-08-10	Cavauto S.R.L. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7	€10,000
2020-07-23	El Real Sporting de Gijón S.A.D. Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 6 Art. 7	€5,000
2020-07-14	Operator of CCTV of a residential building Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 6 Art. 7	€5,000
2020-07-14	Legal Person Insufficient legal basis for data processing	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 7 Art. 13	€400
2020-07-13	Merlini s.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 28	€200,000
2020-04-23	Estee Lauder Romania Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 7 Art. 9	€3,000
2020-01-01	Operator of a ballet school Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Brandenburg	Art. 5 Art. 6 Art. 7	—
2020-01-01	Ski rental company Non-compliance with general data processing principles	🇪🇺 Czech Data Protection Auhtority (UOOU)	Art. 5 Art. 6 Art. 7 Art. 12	—
2019-12-16	SC Enel Energie S.A. (Electricity Distributor) Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7 Art. 21	€6,000
2019-12-13	Entirely Shipping & Trading S.R.L. Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7 Art. 9	€5,000
2019-12-13	Entirely Shipping & Trading S.R.L. Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7	€5,000
2019-06-11	Professional Football League (LaLiga) Insufficient fulfilment of information obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 7	€250,000
2017-11-08	Norwegian DPA: Legelisten.no may process healthcare reviews without prior consent	🇳🇴 Datatilsynet (Norway)	Art. 411 Art. 4 Art. 51 Art. 5	—

← previous 101–123 of 123