Article 9 GDPR — enforcement
Cited in 249 decisions · €79.6M total fines · median €13,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)
| Date ↓ | Company / party | Authority | Articles | Fine |
|---|---|---|---|---|
| 2023-02-06 | I&S Limited Kft Non-compliance with general data processing principles | 🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH) | Art. 5Art. 6Art. 9Art. 13 | €80,500 |
| 2023-01-31 | Dentist Insufficient legal basis for data processing | 🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) | Art. 6Art. 9 | €1,000 |
| 2023-01-26 | Azienda ULSS n.5 Polesana Insufficient technical and organisational measures to ensure information security | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 32 | €5,000 |
| 2023-01-16 | Thomas International Systems, S.A. Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 9 | €40,000 |
| 2023-01-11 | Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 2 | €6,000 |
| 2023-01-11 | Azienda Ospedale-Università Padova Non-compliance with general data processing principles | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9 | €5,000 |
| 2023-01-09 | Praktiškas UAB Insufficient legal basis for data processing | 🇪🇺 Lithuanian Data Protection Authority (VDAI) | Art. 5Art. 9Art. 13Art. 30 | €6,000 |
| 2023-01-01 | Company Insufficient technical and organisational measures to ensure information security | 🇪🇺 Data Protection Authority of Hamburg | Art. 9Art. 32 | €75,000 |
| 2023-01-01 | Private individual Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Baden-Wuerttemberg | Art. 6Art. 9 | €2,000 |
| 2023-01-01 | Supermarket Insufficient legal basis for data processing | 🇪🇺 Data Protection Authority of Brandenburg | Art. 6Art. 9 | — |
| 2022-12-27 | Company Insufficient legal basis for data processing | 🇪🇺 Deputy Data Protection Ombudsman | Art. 9 | €122,000 |
| 2022-12-15 | Eurosanità S.P.A. Insufficient technical and organisational measures to ensure information security | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 32 | €120,000 |
| 2022-12-15 | Azienda Universitaria Giuliano Isontina Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 14Art. 35 | €55,000 |
| 2022-12-15 | Azienda Universitaria Friuli Centrale Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 14Art. 35 | €55,000 |
| 2022-12-15 | Azienda Universitaria Friuli Occidentale Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 14Art. 35 | €55,000 |
| 2022-12-15 | Comune di Vicchio Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9 | €8,000 |
| 2022-12-15 | Comune di Bracciano Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 2 | €6,000 |
| 2022-12-15 | Comune di Borgia Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 37 | €5,000 |
| 2022-12-15 | Scuola Statale Secondaria di I^ grado 'Bianco-Pascol' Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 12 | €3,000 |
| 2022-12-02 | Federation of Sports for People with Intellectual Disabilities of Castilla la Mancha-FECAM Insufficient legal basis for data processing | 🇪🇺 Spanish Data Protection Authority (aepd) | Art. 9Art. 13 | €3,600 |
| 2022-12-01 | A.R.N.A.S. Civico Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 2 | €6,000 |
| 2022-11-30 | PIONIER (law firm) Insufficient legal basis for data processing | 🇪🇺 Polish National Personal Data Protection Office (UODO) | Art. 5Art. 6Art. 9 | €9,600 |
| 2022-11-24 | Società Lombarda Sport s.r.l. Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9 | €4,000 |
| 2022-11-24 | Private individual Insufficient legal basis for data processing | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 6Art. 9Art. 32 | €1,000 |
| 2022-11-10 | Azienda Usl Valle d'Aosta Insufficient technical and organisational measures to ensure information security | 🇪🇺 Italian Data Protection Authority (Garante) | Art. 5Art. 9Art. 25Art. 32 | €40,000 |