Article 9 GDPR — enforcement

Cited in 249 decisions · €79.6M total fines · median €13,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-07-20	Italian DPA: Justice Ministry unlawful disclosure of employee health data in service order	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 49 Art. 4 Art. 410 Art. 415	€12,000
2026-07-16	AEPD investigates University of Navarra over student COVID-19 vaccination status requests	🇪🇸 AEPD (Spain)	Art. 415 Art. 4 Art. 51 Art. 5	—
2026-06-05	Reda Naujokaitienė Insufficient legal basis for data processing	🇱🇹 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 6 Art. 9	€1,153
2026-05-29	Blikk Kft. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,300
2026-05-28	Italian Garante: Red Cross violated Art. 9 GDPR by disclosing HIV status on meal tray	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 9	€700
2026-05-26	Mediaworks Hungary Zrt. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9	€140,500
2026-05-20	Elektronikus Egészségügyi Szolgáltatási Tér Insufficient technical and organisational measures to ensure information security	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€1,400
2026-04-16	AKI (Estonia) - No. 2.1-1/24/397-890-38	🇪🇪 AKI (Estonia)	Art. 47 Art. 4 Art. 411 Art. 51	—
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€5,000
2026-03-26	Municipality Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€3,000
2026-03-12	INPS – Istituto nazionale previdenza sociale Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 10	€40,000
2026-03-12	Liceo Scientifico Morgagni di Roma Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€2,000
2026-02-26	Ministero delle Imprese e del Made in Italy Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€15,000
2026-02-26	Depac Società Cooperativa Sociale a r.l. Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 13 Art. 30	€15,000
2026-02-20	University of Szeged Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 13	€5,570
2026-02-05	Obuda University Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€4,200
2026-02-03	Municipality of Huizen Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Tilburg Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Hilversum Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Veenendaal Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Ede Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Eindhoven Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Haarlemmermeer Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Zoetermeer Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000
2026-02-03	Municipality of Delft Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 6 Art. 9	€25,000

1–25 of 249 next →