Article 9 GDPR — enforcement

Cited in 251 decisions · €79.9M total fines · median €14,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2020-12-17	Miropass S.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 28	€40,000
2020-12-16	HUNGARY DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 12	€97,150
2020-12-10	Budapesti Műszaki és Gazdaságtudományi Egyetem (Budapest University of Technology and Economics) Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 12	€22,200
2020-12-07	CNIL fines Amazon Europe Core €35M for placing cookies without consent	🇫🇷 CNIL (France)	Art. 6 Art. 9 Art. 83 Art. 94	€35,000,000
2020-11-26	Concentrix Cvg Italy s.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€20,000
2020-11-19	DSB (Austria) - 2020-0.743.659	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 51 Art. 5	—
2020-11-17	Provincial Health Authority of Cosenza Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 9	€30,000
2020-11-05	DSB (Austria) - DSB-D124.1749	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 91 Art. 9	—
2020-10-26	Università Campus Bio-medico di Roma (Polyclinic) Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€20,000
2020-10-19	Private Individual Insufficient legal basis for data processing	🇪🇺 Austrian Data Protection Authority (dsb)	Art. 5 Art. 9	€600
2020-09-30	Scanshare s.r.l. Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€60,000
2020-09-07	HDPA (Greece) 32/2020: School unlawfully rejected religion-exemption request	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 9	—
2020-04-30	Unknown Organisation Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 9	€725,000
2020-04-23	Estee Lauder Romania Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 7 Art. 9	€3,000
2020-03-24	CP&A Insufficient technical and organisational measures to ensure information security	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 9 Art. 32	€15,000
2020-03-06	Liceo Scientifico Nobel di Torre del Greco Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€4,000
2020-03-06	Liceo Artistico Statale di Napoli Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€4,000
2020-03-04	School in Gdansk (Danzig) (fine imposed against town of Gdansk) Insufficient legal basis for data processing	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 9	€0
2019-12-13	Entirely Shipping & Trading S.R.L. Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7 Art. 9	€5,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€70,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€10,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€2,000
2019-09-03	CNPD (Portugal) - Deliberação 2019/494	🇵🇹 CNPD (Portugal)	Art. 288 Art. 2 Art. 3 Art. 56	—
2019-08-20	School in Skellefteå Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Sweden	Art. 5 Art. 9 Art. 35 Art. 36	€18,630
2019-04-08	Medical centers Insufficient legal basis for data processing	🇪🇺 Data Protection Commision of Bulgaria (KZLD)	Art. 5 Art. 9 Art. 6	€510

← previous 226–250 of 251 next →