Content type · 224 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Germany (50) Clear filter
Filter by Topic Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
Police officer: Insufficient legal basis for data processing A police officer had accessed data in a police database for private research purposes. The police officer had queried the new partner of a friend's ex-wife because he feared that… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Job center employee: Insufficient legal basis for data processing A job center employee had accessed data in social database systems and in the civil register for private research purposes. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Medical clinic: Insufficient legal basis for data processing The DPA from Berlin has imposed a fine on a medical clinic. The clinic had installed 21 cameras in its premises for the purpose of protection against crime and property damage.… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Attorney: Insufficient legal basis for data processing The DPA from Berlin has imposed a fine on an attorney. The attorney had been in dispute with a client for several years over a monetary claim. For two years, he published the… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Clinic: Insufficient involvement of data protection officer The DPA from Berlin has imposed a fine on a clinic. The clinic had appointed the clinic manager, who was also a shareholder of the clinic, as the data protection officer. A data… GERMANY ·Insufficient involvement of data protection officer Jan 1, 2021
Company: Data Protection Authority of Brandenburg The DPA of Brandenburg has imposed a fine on a company. An individual had filed a complaint with the DPA based on the fact that the company produced a video recording in which the… GERMANY ·Unknown Jan 1, 2021
Real estate agent: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a fine on a real estate agent. The real estate agent had contacted an individual and offered him to sell a property he owned. Since the… GERMANY ·Art. 6, 12 ·Insufficient legal basis for data processing Jan 1, 2021
Private individual: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a three-digit fine on a company employee. The employee had forwarded application documents received by his employer from his work e-mail address… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2021
Police department: Insufficient legal basis for data processing A police officer had accessed data in a police database for private research purposes. The police officer queried the investigation process of a friend against the background of a… GERMANY ·Insufficient legal basis for data processing Jan 1, 2021
Police department: Insufficient legal basis for data processing A police officer had unlawfully disclosed personal data of a drunk driving incident to the offender's mother during a chance encounter. He thought that the mother, as his… GERMANY ·Insufficient legal basis for data processing Jan 1, 2021
Car trading group: Insufficient legal basis for data processing The DPA of Hamburg has imposed a fine of EUR 10,110 on a car trading group. The company had informed the customer base that the reasons for the restructuring there was the absence… GERMANY · ·Insufficient legal basis for data processing Jan 1, 2021
Company: Insufficient technical and organisational measures to ensure information security A company had stored telecommunications hardware, a server and backup technology in a guest bathroom. The server cabinet, which did not have an intact lock, also served as a… GERMANY ·Art. 25, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2021
Private individual: Non-compliance with general data processing principles A private individual had installed video surveillance cameras which, among other things, also covered the public space GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2021
Bank employee: Insufficient legal basis for data processing An employee of a bank had regularly accessed the bank account data of a bank customer for private purposes over a period of about a year. GERMANY ·Insufficient legal basis for data processing Jan 1, 2021
Political organization: Data Protection Authority of Saarland An employee of a political organization had sent an e-mail to 400 people in an open distribution list. This not only made the e-mail addresses of all recipients visible to the… GERMANY ·Unknown Jan 1, 2021
Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes in order to obtain information about a colleague. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine in the six-digit range on a Hamburg-based company operating in the healthcare sector. The company had failed to take appropriate technical… GERMANY · ·Art. 32 Jan 1, 2021
Private individual: Insufficient legal basis for data processing Nineteen fines between EUR 100 and EUR 1,000 for unlawful use of a dashcam. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2021
Physician: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a four-digit fine on a doctor of child and adolescent psychotherapy. The doctor had set up a Whatsgroup with 230 participants to communicate… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2021
GERMANY DPA: Insufficient technical and organisational measures to ensure information security The camera images of a store were distributed without the knowledge and intention of the controller due to a faulty configuration. The distribution involved recordings of… Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2021
Physician: Insufficient technical and organisational measures to ensure information security A physician had stored patient records in an open carport and not in a locked room. GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2021
Telecoms provider (1&1 Telecom GmbH): Insufficient technical and organisational measures to ensure information security Original Fine Summary: The Controller is a company offering telecommunication services. A caller could obtain extensive information on personal customer data from the company's… GERMANY · ·Art. 32 Nov 11, 2020
Private Individual: Non-compliance with general data processing principles Original summary: The DPA of Saxony-Anhalt imposed a fine of EUR 200 on a private individual. The controller had taken photos of vehicles and, in some cases, their drivers and… GERMANY ·Art. 5, 32 ·Non-compliance with general data processing principles Oct 24, 2020
H&M Hennes & Mauritz Online Shop A.B. & Co. KG: Insufficient legal basis for data processing The fashion company with seat in Hamburg operates a service center in Nuremberg. Here, according to the findings of the Hamburg data protection officer, since at least 2014… GERMANY · ·Art. 5, 6 Oct 1, 2020
Allgemeine Ortskrankenkasse ('AOK') (health insurance company): Insufficient technical and organisational measures to ensure information security From 2015 to 2019, AOK Baden-Württemberg (insurance organization) organized competitions on various occasions and collected personal data of the participants, including their… GERMANY ·Art. 5, 6, 32 ·Insufficient technical and organisational measures to ensure information security Jun 30, 2020
Police officer: Insufficient legal basis for data processing A police officer has accessed data in a police database for private research purposes. GERMANY · ·Art. 5, 6 Jan 1, 2020
Restaurant: Insufficient technical and organisational measures to ensure information security In order to combat the Covid 19 pandemic, a restaurant had put out an open list in which visitors had to enter their contact data. The fact that the list was openly displayed… GERMANY · ·Art. 32 Jan 1, 2020
Police officer: Insufficient legal basis for data processing A police officer has accessed data in a police database for private research purposes. GERMANY · ·Art. 5, 6 Jan 1, 2020
Restaurant: Non-compliance with general data processing principles Excessive use of video surveillance in violation of the principle of data minimization. GERMANY · ·Art. 5 Jan 1, 2020
Employee at a Covid 19 testing center: Non-compliance with general data processing principles An employee at a Covid 19 testing center used the data of a tested person to contact them via WhatsApp for private purposes. GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2020
Operator of a ballet school: Insufficient legal basis for data processing The operator of a ballet school had published photos of underage students on their website and Facebook page without the consent of the legal guardians. GERMANY ·Art. 5, 6, 7 ·Insufficient legal basis for data processing Jan 1, 2020
Police officer: Insufficient legal basis for data processing A police officer has accessed data in a police database for private research purposes. GERMANY · ·Art. 5, 6 Jan 1, 2020
Police officer: Insufficient legal basis for data processing A police officer took photos of an official presentation that contained personal data and shared them in a Whats App group. GERMANY · ·Art. 5, 6 Jan 1, 2020
Company: Insufficient technical and organisational measures to ensure information security The DPA of Lower Saxony has imposed a fine of EUR 65,000 on a company. The reason for the proceedings was a report by the company to the authority regarding a data breach pursuant… GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2020
GERMANY DPA: Insufficient cooperation with supervisory authority The Bavarian DPA has imposed a fine on a company. The controller had refused access to the business premises and data processing equipment during an on-site inspection carried out… Art. 58 ·Insufficient cooperation with supervisory authority Jan 1, 2020
Police officer: Insufficient legal basis for data processing Several cases in which police officers have accessed data in a police database for private research purposes. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2020
Restaurant: Non-compliance with general data processing principles Excessive use of video surveillance in violation of the principle of data minimization. GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2020
Medical assistant: Insufficient legal basis for data processing A medical assistant at a doctor's office stored a patient's telephone number in her mobile phone and then contacted him for private purposes. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2020
Corporation: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. GERMANY ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Jan 1, 2020
Clearview AI Inc.: Insufficient cooperation with supervisory authority The DPA from Hamburg has fined Clearview AI Inc. EUR 10,000 for failing to provide information requested by the DPA during an investigation. GERMANY · ·Art. 58 Jan 1, 2020
Police officer: Insufficient legal basis for data processing A police officer has accessed data in a police database for private research purposes. GERMANY · ·Art. 5, 6 Jan 1, 2020
Police officer: Insufficient legal basis for data processing A police officer has accessed data in a police database for private research purposes. GERMANY · ·Art. 5, 6 Jan 1, 2020
Police officer: Insufficient legal basis for data processing A police officer took photos of an official presentation that contained personal data and shared them in a Whats App group. GERMANY · ·Art. 5, 6 Jan 1, 2020
Police officer: Insufficient legal basis for data processing A police officer took photos of an official presentation that contained personal data and shared them in a Whats App group. GERMANY · ·Art. 5, 6 Jan 1, 2020
Company: Insufficient technical and organisational measures to ensure information security The DPA from Hamburg has issued a fine against a company that operates an online marketplace, especially for worn underwear. The company advertises that it guarantees one hundred… GERMANY · ·Art. 6, 32 Jan 1, 2020
Restaurant: Insufficient technical and organisational measures to ensure information security In order to combat the Covid 19 pandemic, a restaurant had put out an open list in which visitors had to enter their contact data. The fact that the list was openly displayed… GERMANY · ·Art. 32 Jan 1, 2020
Restaurant: Insufficient technical and organisational measures to ensure information security In order to combat the Covid 19 pandemic, a restaurant had put out an open list in which visitors had to enter their contact data. The fact that the list was openly displayed… GERMANY · ·Art. 32 Jan 1, 2020
Company: Insufficient data processing agreement The DPA from Hamburg as imposed a fine of EUR 13,000 on a company. An individual had booked and attended a course with a company, but had not paid the course fees incurred. Some… GERMANY · ·Art. 26 Jan 1, 2020
Rapidata GmbH: Insufficient involvement of data protection officer Despite repeated requests of the BfDI the company (an internet provider) did not comply with its legal obligation under Article 37 GDPR to appoint a data protection officer. GERMANY · ·Art. 37 Dec 9, 2019
Hospital: Insufficient technical and organisational measures to ensure information security The fine is based on several breaches of the GDPR in connection with a patient mix-up at the admission of the patient. This resulted in incorrect invoicing and revealed structural… GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Dec 3, 2019