Article 9 GDPR — enforcement

Cited in 279 decisions · €82.9M total fines · median €12,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2021-01-14	Azienda Usl di Bologna Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€18,000
2021-01-01	Private individual Non-compliance with general data processing principles	🇪🇺 Austrian Data Protection Authority (dsb)	Art. 5 Art. 9	€600
2021-01-01	Physician Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Brandenburg	Art. 6 Art. 9	—
2020-12-17	Miropass S.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 28	€40,000
2020-12-16	HUNGARY DPA: Insufficient legal basis for data processing Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 12	€97,150
2020-12-10	Budapesti Műszaki és Gazdaságtudományi Egyetem (Budapest University of Technology and Economics) Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9 Art. 12	€22,200
2020-12-07	CNIL (France) - SAN-2020-013	🇫🇷 CNIL (France)	Art. 6 Art. 9 Art. 83 Art. 94	€35,000,000
2020-11-26	Concentrix Cvg Italy s.r.l. Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€20,000
2020-11-19	DSB Austria: Restaurant contact-tracing data collected for COVID-19 qualifies as health	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 51 Art. 5	—
2020-11-17	Provincial Health Authority of Cosenza Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 9	€30,000
2020-11-05	Austrian DSB: Controller's use of social security number for statutory financial aid was	🇦🇹 DSB (Austria)	Art. 415 Art. 4 Art. 91 Art. 9	—
2020-10-26	Università Campus Bio-medico di Roma (Polyclinic) Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€20,000
2020-10-19	Private Individual Insufficient legal basis for data processing	🇪🇺 Austrian Data Protection Authority (dsb)	Art. 5 Art. 9	€600
2020-09-30	Scanshare s.r.l. Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€60,000
2020-09-07	HDPA (Greece) - 32/2020	🇬🇷 HDPA (Greece)	Art. 51 Art. 5 Art. 9	—
2020-04-30	Unknown Organisation Insufficient legal basis for data processing	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 5 Art. 9	€725,000
2020-04-23	Estee Lauder Romania Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 7 Art. 9	€3,000
2020-03-24	CP&A Insufficient technical and organisational measures to ensure information security	🇪🇺 Dutch Supervisory Authority for Data Protection (AP)	Art. 9 Art. 32	€15,000
2020-03-06	Liceo Artistico Statale di Napoli Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€4,000
2020-03-06	Liceo Scientifico Nobel di Torre del Greco Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€4,000
2020-03-04	School in Gdansk (Danzig) (fine imposed against town of Gdansk) Insufficient legal basis for data processing	🇪🇺 Polish National Personal Data Protection Office (UODO)	Art. 5 Art. 9	€0
2019-12-13	Entirely Shipping & Trading S.R.L. Non-compliance with general data processing principles	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 7 Art. 9	€5,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€70,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€10,000
2019-10-25	LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Insufficient legal basis for data processing	🇪🇺 Cypriot Data Protection Commissioner	Art. 6 Art. 9	€2,000

← previous 251–275 of 279 next →