Article 9 GDPR — enforcement

Cited in 233 decisions · €44.1M total fines · median €15,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Date ↓	Company / party	Authority	Articles	Fine
2020-03-06	Liceo Artistico Statale di Napoli Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€4,000
2020-03-04	School in Gdansk (Danzig) (fine imposed against town of Gdansk) Insufficient legal basis for data processing	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 9	€0
2019-12-13	Entirely Shipping & Trading S.R.L. Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7 Art. 9	€5,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€70,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€10,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€2,000
2019-08-20	School in Skellefteå Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sweden	Art. 5 Art. 9 Art. 35 Art. 36	€18,630
2019-04-08	Medical centers Insufficient legal basis for data processing	🇪🇺 Data Protection Commision of Bulgaria (KZLD)	Art. 5 Art. 9 Art. 6	€510

← previous 226–233 of 233