Article 9 GDPR — enforcement
Cited in 275 decisions · €80.3M total fines · median €12,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2026-05-14 | Monaldi-Cotugno-CTO Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 13Art. 25 | €15,000 |
| 2026-05-14 | Municipality of Ventasso Non-compliance with general data processing principles | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €8,000 |
| 2026-04-29 | Ministry of Justice Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €12,000 |
| 2026-04-29 | Dr. Guzzo Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 9 | €5,000 |
| 2026-04-29 | Montelibretti State Comprehensive School Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €4,000 |
| 2026-04-16 | AKI (Estonia) - No. 2.1-1/24/397-890-38 | 🇪🇪 AKI (Estonia) | Art. 47Art. 4Art. 411Art. 51 | — |
| 2026-03-26 | Municipality Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €5,000 |
| 2026-03-26 | Municipality Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €3,000 |
| 2026-03-12 | INPS – Istituto nazionale previdenza sociale Insufficient technical and organisational measures to ensure information security | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 10 | €40,000 |
| 2026-03-12 | Liceo Scientifico Morgagni di Roma Insufficient technical and organisational measures to ensure information security | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 32 | €2,000 |
| 2026-02-26 | Depac Società Cooperativa Sociale a r.l. Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 13Art. 30 | €15,000 |
| 2026-02-26 | Ministero delle Imprese e del Made in Italy Insufficient legal basis for data processing | 🇮🇹 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 12 | €15,000 |
| 2026-02-20 | University of Szeged Insufficient legal basis for data processing | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 9Art. 13 | €5,570 |
| 2026-02-05 | Obuda University Insufficient legal basis for data processing | 🇭🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 9 | €4,200 |
| 2026-02-03 | Municipality of Gooise Meren Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Eindhoven Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Ede Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Delft Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Huizen Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Hilversum Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Haarlemmermeer Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Zoetermeer Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Tilburg Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-02-03 | Municipality of Veenendaal Insufficient legal basis for data processing | 🇪🇺 Dutch Supervisory Authority for Data Protection (AP) | Art. 6Art. 9 | €25,000 |
| 2026-01-30 | Natural Person Non-compliance with general data processing principles | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 5Art. 6Art. 9Art. 10 | €10,000 |