Article 8 GDPR — enforcement

Cited in 9 decisions · €20.2M total fines · median €51,000 · top authority: 🇪🇺Icelandic data protection authority ('Persónuvernd') (3)

Read Article 8 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-02-26	Flamel S.r.l. Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 8 Art. 11 Art. 25 Art. 39	€15,000
2026-02-23	Reddit, Inc. Non-compliance with general data processing principles	🇬🇧 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 8 Art. 35	€16,610,000
2023-06-27	Creditinfo Lánstraust hf. Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 8 Art. 9	€257,000
2023-06-27	eCommerce 2020 ApS Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 8 Art. 9	€51,000
2023-06-27	Almennri innheimtu ehf Insufficient legal basis for data processing	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 5 Art. 6 Art. 8 Art. 9	€24,000
2022-10-31	TECHPUMP SOLUTIONS S.L. Non-compliance with general data processing principles	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 5 Art. 6 Art. 8 Art. 12	€525,000
2021-11-25	Dutch Minister of Finance Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 6 Art. 8	€2,750,000
2021-03-15	School Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 8	€1,000
2020-12-15	Online Services Insufficient fulfilment of information obligations	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 13 Art. 8 Art. 6	€10,000