Article 9 GDPR — enforcement

Cited in 251 decisions · €79.9M total fines · median €14,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2022-04-26	ASST di Lodi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 32	€1,000
2022-04-04	Brussels Airport Zaventem Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€200,000
2022-04-04	Brussels Airport Charleroi Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€100,000
2022-04-04	Ambuce Rescue Team Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9	€20,000
2022-03-10	Azienda USL Toscana Centro Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 32	€10,000
2022-03-03	BREBAU GmbH Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Bremen	Art. 5 Art. 6 Art. 9	€1,900,000
2022-02-10	Azienda socio sanitaria territoriale Melegnano e della Martesana Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€3,500
2022-02-02	IAB Europe Insufficient legal basis for data processing	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€0
2022-02-01	SC Grupex 2000 SRL Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 6 Art. 9	€1,000
2022-01-27	EU DisinfoLab Non-compliance with general data processing principles	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€2,800
2022-01-27	Researcher Non-compliance with general data processing principles	🇪🇺 Belgian Data Protection Authority (APD)	Art. 5 Art. 6 Art. 9 Art. 12	€1,200
2022-01-17	C-Planet (IT Solutions) Limited Insufficient technical and organisational measures to ensure information security	🇪🇺 Data Protection Commissioner of Malta	Art. 5 Art. 6 Art. 9 Art. 14	€65,000
2022-01-01	MALTA DPA: Non-compliance with general data processing principles Non-compliance with general data processing principles	🇪🇺 Data Protection Commissioner of Malta	Art. 5 Art. 6 Art. 9 Art. 32	€65,000
2022-01-01	Physician Insufficient legal basis for data processing	🇪🇺 Data Protection Authority of Nordrhein-Westfalen	Art. 5 Art. 6 Art. 9	—
2021-12-21	Lisbon City Council Insufficient legal basis for data processing	🇪🇺 Portuguese Data Protection Authority (CNPD)	Art. 5 Art. 6 Art. 9 Art. 13	€1,250,000
2021-12-17	ASL Latina Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9	€10,000
2021-12-13	Grindr LLC Insufficient legal basis for data processing	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 6 Art. 9	€6,300,000
2021-12-03	Lawyer Insufficient legal basis for data processing	🇪🇺 Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)	Art. 5 Art. 6 Art. 9	€843
2021-12-02	Azienda USL di Parma Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€5,000
2021-11-25	Società H San Raffaele Resnati s.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€6,000
2021-11-24	Norwegian State Pension Fund (SPK) Insufficient legal basis for data processing	🇪🇺 Norwegian Supervisory Authority (Datatilsynet)	Art. 5 Art. 6 Art. 9	€98,000
2021-10-14	Health Protection Agency of Sardinia (ATS) Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€8,000
2021-09-29	Physician Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€2,000
2021-09-21	Istituto Comprensivo - IC Cosenza III “V. Negroni” Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 2	€2,000
2021-09-16	Bocconi University Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 13	€200,000

← previous 176–200 of 251 next →