Article 9 GDPR — enforcement

Cited in 275 decisions · €80.3M total fines · median €12,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2026-09-29	Garante: Bologna University Hospital rightly refused erasure of recruitment ranking data	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€30,000
2026-09-17	Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service	🇮🇸 Persónuvernd (Iceland)	Art. 51 Art. 5 Art. 61 Art. 6	—
2026-09-16	Italian DPA probes University Health Agency Friuli over EHR access and missing logs	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 51	€24,000
2026-09-08	Garante per la protezione dei dati personali (Italy) - 551/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 5 Art. 6 Art. 9	€10,000
2026-09-03	Friuli Centrale University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€24,000
2026-09-02	Datatilsynet authorises AC Horsens facial recognition at matches under conditions	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-09-02	Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub)	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-09-01	Datatilsynet (Denmark) - 09-07-2026 (Lyngby Boldklub)	🇩🇰 Datatilsynet (Denmark)	Art. 91 Art. 9 Art. 92 Art. 35	—
2026-08-18	ANSPDCP (Romania) - AMATO BESTSELLER S.R.L.	🇷🇴 ANSPDCP (Romania)	Art. 51 Art. 5 Art. 9 Art. 324	€285,395
2026-08-06	AMATO BESTSELLER S.R.L Non-compliance with general data processing principles	🇷🇴 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 32 Art. 14 Art. 5 Art. 9	€45,000
2026-07-23	Emiglia-Romagna Regional Employment Agency Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€30,000
2026-07-23	Bologna University Hospital IRCCS Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€10,000
2026-07-23	Ancel Keys Comprehensive School Castelnuovo Cilento Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€2,000
2026-07-20	Garante per la protezione dei dati personali (Italy) - 10254256	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 49 Art. 4 Art. 410 Art. 415	€12,000
2026-07-16	AEPD (Spain) - EXP202102529	🇪🇸 AEPD (Spain)	Art. 415 Art. 4 Art. 51 Art. 5	—
2026-07-03	Giuliano Isontina University Health Authority Insufficient technical and organisational measures to ensure information security	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€10,000
2026-07-03	Municipality of San Genesio and Uniti Insufficient legal basis for data processing	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€2,000
2026-06-05	Reda Naujokaitienė Insufficient legal basis for data processing	🇱🇹 Lithuanian Data Protection Authority (VDAI)	Art. 5 Art. 6 Art. 9	€1,153
2026-05-29	IndaNext Hungary Kft. (legal successor of Blikk Kft.) Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,518
2026-05-29	Blikk Kft. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9 Art. 12	€70,300
2026-05-28	Garante per la protezione dei dati personali (Italy) - 385/2026	🇮🇹 Garante per la protezione dei dati personali (Italy)	Art. 51 Art. 5 Art. 51 Art. 9	€700
2026-05-28	Italian Red Cross Non-compliance with general data processing principles	🇮🇹 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€700
2026-05-26	Mediaworks Hungary Zrt. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9	€140,500
2026-05-26	Mediaworks Hungary Zrt. Insufficient legal basis for data processing	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 6 Art. 9	€140,127
2026-05-20	Elektronikus Egészségügyi Szolgáltatási Tér Insufficient technical and organisational measures to ensure information security	🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€1,400

1–25 of 275 next →