Article 9 GDPR — enforcement

Cited in 277 decisions · €80.3M total fines · median €12,000 · top authority: 🇪🇺Italian Data Protection Authority (Garante) (121)

Read Article 9 GDPR →

Date ↓	Company / party	Authority	Articles	Fine
2022-11-24	Private individual Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€1,000
2022-11-10	Azienda Usl Valle d'Aosta Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€40,000
2022-11-10	Sportitalia Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 13 Art. 30	€20,000
2022-11-02	Portuguese National Statistical Institute Non-compliance with general data processing principles	🇪🇺 Portuguese Data Protection Authority (CNPD)	Art. 5 Art. 9 Art. 12 Art. 13	€4,300,000
2022-10-28	Danish DPA fines Sirius Lawyers DKK 500,000 for inadequate security after hacker attack	🇩🇰 Datatilsynet (Denmark)	Art. 51 Art. 5 Art. 9 Art. 24	€500,000
2022-10-20	Azienda Ospedaliero-Universitaria Careggi di Firenze Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 32	€9,000
2022-10-20	I.S.P.R.O. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€7,000
2022-10-04	Easylife Ltd. Insufficient legal basis for data processing	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 9 Art. 13	€1,547,000
2022-09-15	Lazio Region Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 12	€100,000
2022-09-01	Liceo Statale 'Edoardo Amaldi” Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 2	€4,000
2022-08-01	LAST LAP, S.L. Insufficient legal basis for data processing	🇪🇺 Spanish Data Protection Authority (aepd)	Art. 6 Art. 9	€9,600
2022-07-19	Belgian DPA: Employer unlawfully disclosed employee health data to colleagues (115/2022)	🇧🇪 APD/GBA (Belgium)	Art. 51 Art. 5 Art. 61 Art. 6	—
2022-07-07	Senseonics Inc. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 7 Art. 9	€45,000
2022-05-26	Azienda sanitaria universitaria Friuli Centrale Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€70,000
2022-05-26	Azienda sanitaria universitaria Friuli Occidentale Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 25 Art. 32	€50,000
2022-05-26	Azienda Sanitaria Locale Roma Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 2	€46,000
2022-05-22	Azienda Socio Sanitaria Territoriale Dei Sette Laghi Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 32	€7,000
2022-05-18	Clearview Al Inc. Non-compliance with general data processing principles	🇪🇺 Information Commissioner (ICO)	Art. 5 Art. 6 Art. 9 Art. 14	€9,000,000
2022-05-18	Kredyt Inkaso Investments RO S.A Insufficient legal basis for data processing	🇪🇺 Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)	Art. 5 Art. 6 Art. 9 Art. 33	€5,000
2022-05-03	HEI – Medical Travel Insufficient fulfilment of data subjects rights	🇪🇺 Icelandic data protection authority ('Persónuvernd')	Art. 15 Art. 9 Art. 17	€10,600
2022-04-28	Ospedale San Raffaele s.r.l. Non-compliance with general data processing principles	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9	€70,000
2022-04-28	Istituto Nazionale Assicurazione Infortuni sul Lavoro Insufficient technical and organisational measures to ensure information security	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 32	€50,000
2022-04-28	Il Sole 24 Ore S.p.a. Insufficient fulfilment of data subjects rights	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 9 Art. 12	€40,000
2022-04-28	Italian Ministry of Defense Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 10	€10,000
2022-04-28	'Isabella Gonzaga' high school Insufficient legal basis for data processing	🇪🇺 Italian Data Protection Authority (Garante)	Art. 5 Art. 6 Art. 9 Art. 2	€2,500

← previous 176–200 of 277 next →