Content type · 3,826 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€3M Hellenic Post (ΕΛΛΗΝΙΚΑ ΤΑΧΥΔΡΟΜΕΙΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ): Insufficient technical and organisational measures to ensure information security The Hellenic DPA has imposed a fine of EUR 2,995,140 on the Hellenic Post (ΕΛΛΗΝΙΚΑ ΤΑΧΥΔΡΟΜΕΙΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ). The controller had suffered a data breach which resulted in… GREECE · ·Art. 5, 32 Feb 28, 2024
€3,000 VESTA CEU ROMÂNIA SRL.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on VESTA CEU ROMÂNIA SRL. The controller had reported a data breach to the DPA pursuant to Art. 33 GDPR. The controller had… ROMANIA · ·Art. 32 Feb 26, 2024
€20,000 Company: Insufficient legal basis for data processing Croatian Data Protection Authority (azop) fined Company €20,000 on 2024-02-26 for: Insufficient legal basis for data processing. Croatia · ·Art. 6, 7, 13 Feb 26, 2024
€90,000 TELEFÓNICA DE ESPAÑA, S.A.U.: Insufficient cooperation with supervisory authority The Spanish DPA has fined TELEFÓNICA DE ESPAÑA, S.A.U. EUR 90,000 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Feb 23, 2024
€50,000 Azienda Trasporto Passeggeri Emilia-Romagna S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 50,000 on the transport company azienda Trasporto Passeggeri Emilia-Romagna S.p.A.. The controller provided insufficient information on… ITALY · ·Art. 5, 6, 7 +4 Feb 22, 2024
€2,000 Camera di Commercio Industria Artigianato e Agricoltura: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Camera di Commercio Industria Artigianato e Agricoltura. An individual had filed a complaint against the controller with the DPA… ITALY · ·Art. 2, 5, 6 Feb 22, 2024
€400 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 400 on a private individual for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Feb 19, 2024
€400 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 400 on a private individual for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Feb 19, 2024
€100,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 100,000 on VODAFONE ESPAÑA, S.A.U. for insufficient legal basis for data processing. The data subject had filed a complaint against the… SPAIN · ·Art. 6 Feb 13, 2024
€4,000 ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.. A data subject had filed a complaint against the controller with the… SPAIN · ·Art. 15 Feb 13, 2024
€40,000 IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA. A data subject had filed a complaint against the controller with the DPA due to the… SPAIN · ·Art. 15 Feb 13, 2024
€365,000 CTC EXTERNALIZACIÓN, S.L: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 365,000 on CTC EXTERNALIZACIÓN, S.L.. An employee had filed a complaint with the DPA due to the fact that the controller had requested… SPAIN · ·Art. 13, 32, 35 Feb 12, 2024
€800,000 NTT Data Italia S.P.A: Insufficient fulfilment of data breach notification obligations The Italian DPA has imposed a fine of EUR 800,000 on NTT Data Italia S.P.A. The fine is related to the fine imposed on UniCredit (ETid-2227). UniCredit had contracted NTT to carry… ITALY · ·Art. 28, 33 Feb 8, 2024
€18,000 Azienda socio-sanitaria locale n. 1 di Sassari: Insufficient technical and organisational measures to ensure information security Ist das gut: The Italian DPA has imposed a fine of EUR 18,000 on Azienda socio-sanitaria locale n. 1 di Sassari. The controller had mistakenly sent an e-mail containing health… ITALY · ·Art. 5, 9, 32 Feb 8, 2024
€2.8M UniCredit S.p.a.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 2.8 million on UniCredit S.p.a.. The bank had suffered a cyberattack on its mobile banking portal, during which the attackers gained… ITALY · ·Art. 5, 32 Feb 8, 2024
€1,500 Aylo Social LTD: Insufficient fulfilment of data subjects rights The Cypriot DPA has imposed a fine of EUR 1,500 on Aylo Social LTD for failing to comply with a deletion request. CYPRUS · ·Art. 17 Feb 8, 2024
€30,000 CENTRO MÉDICO SALUS BALEARES, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on CENTRO MÉDICO SALUS BALEARES, S.L.. An individual had filed a complaint with the DPA due to the clinic's use of an electronic… SPAIN · ·Art. 5, 32 Feb 8, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN · ·Art. 6 Feb 8, 2024
€79M Enel Energia SpA: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Enel Energia SpA EUR 79.1 million due to its lack of compliance with technical and organisational measures aimed at limiting the potential abuses by… Feb 8, 2024
€2,000 Brivio Limited: Insufficient fulfilment of data subjects rights The Cypriot DPA has imposed a fine of EUR 2,000 on Brivio Limited for failing to respond to a request for information in a timely manner. CYPRUS · ·Art. 12 Feb 8, 2024
€300,000 Medtronic Italia: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 300,000 on Medtronic Italia. The controller had sent emails in an open distribution list to hundreds of individuals using the… ITALY · ·Art. 5, 9, 12 +2 Feb 8, 2024
€3M IBERDROLA, S.A.: Non-compliance with general data processing principles The Spanish DPA has fined IBERDROLA, S.A. EUR 3 million following a cyberattack on I-DE Redes, which led to the compromise of customer data from millions of individuals. Although… SPAIN · ·Art. 5, 32 Feb 7, 2024
€5,000 Wi-Planet sas di Torri Carlo Alberto e c.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 5,000 on Wi-Planet sas di Torri Carlo Alberto e c.. A data subject had filed a complaint with the DPA due to the controller's failure to… ITALY · ·Art. 12, 15 Feb 7, 2024
€2,000 Account Exchange SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 2,000 on Account Exchange SRL for using personal data without the consent of the data subjects. ROMANIA · ·Art. 5, 6 Feb 7, 2024
€5M ENERGYA VM GESTIÓN DE ENERGÍA, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined ENERGYA VM GESTIÓN DE ENERGÍA, S.L. EUR 5 million following an investigation into unlawful personal data processing by Nivalco, a company… SPAIN · ·Art. 5 Feb 6, 2024
€160,000 SANITAS, S.A. DE SEGUROS: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on SANITAS, S.A. DE SEGUROS. A customer had filed a complaint with the DPA due to the fact that the controller had concluded a contract without… SPAIN · ·Art. 6, 9 Feb 6, 2024
€3.5M I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3.5 million on I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U. The controller had suffered a cyber attack on its GEA web application resulting… SPAIN · ·Art. 5, 32 Feb 5, 2024
€500 Owners' association: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 500 on an owners' association for publishing personal data of an individual in a WhatsApp group without a valid legal basis and for… ROMANIA · ·Art. 5, 6, 12 Feb 5, 2024
€36,000 HISPAPOST, S.A.: Insufficient fulfilment of data breach notification obligations The Spanish DPA has imposed a fine on HISPAPOST, S.A.. The police had found over a thousand abandoned letters containing the Hispapost logo. Hispapost had been contracted by… SPAIN · ·Art. 28 Feb 1, 2024
€5,000 Dentist: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5,000 on a dentist due to a lack of data security and a failure to respect the right of access of a data subject. FRANCE · ·Insufficient fulfilment of data subjects rights Jan 31, 2024
€10,000 FRANCE DPA: €10,000 fine The French DPA has imposed a fine of EUR 10,000 on a data controller due to data security vulnerabilities. ·Unknown Jan 31, 2024
€2,000 Provincia di Sassari: Insufficient involvement of data protection officer The Italian DPA has imposed a fine of EUR 2,000 on Provincia di Sassari for failing to provide the DPA with the contact details of their data protection officer in good time. ITALY · ·Art. 37 Jan 31, 2024
€2,000 Provincia di Catanzaro: Insufficient involvement of data protection officer The Italian DPA has imposed a fine of EUR 2,000 on Provincia di Catanzaro for failing to provide the DPA with the contact details of their data protection officer in good time. ITALY · ·Art. 37 Jan 31, 2024
€2,000 Libero Consorzio comunale di Caltanissetta: Insufficient involvement of data protection officer The Italian DPA has imposed a fine of EUR 2,000 on Libero Consorzio comunale di Caltanissetta for failing to provide the DPA with the contact details of their data protection… ITALY · ·Art. 37 Jan 31, 2024
€5,000 Municipality of Siracusa: Insufficient involvement of data protection officer The Italian DPA has imposed a fine of EUR 5,000 on the municipality of Siracusa for failing to provide the DPA with the contact details of their data protection officer in good… ITALY · ·Art. 37 Jan 31, 2024
€20,000 Website editor: €20,000 fine The French DPA has imposed a fine of EUR 20,000 on a website editor for data security vulnerabilities. FRANCE · ·Unknown Jan 31, 2024
€2,000 Sectorul 1 al Municipiului București: Insufficient cooperation with supervisory authority The Romanian DPA has fined Sectorul 1 al Municipiului București EUR 2,000 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Jan 30, 2024
€25,000 Ministry of Rural Development and Food: Insufficient involvement of data protection officer The Hellenic DPA has imposed a fine of EUR 25,000 on the Ministry of Rural Development and Food for failing to appoint a data protection officer and not sufficiently cooperating… GREECE · ·Art. 31, 37 Jan 29, 2024
€5,000 Municipality of Athens: Insufficient cooperation with supervisory authority The Hellenic DPA has imposed a fine of EUR 5,000 on the municipality of Athens for failing to sufficiently cooperate with the DPA. GREECE · ·Art. 31 Jan 29, 2024
€2,000 Istituto Comprensivo Statale “F.S. Cabrini: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Istituto Comprensivo Statale “F.S. Cabrini. The controller had published a document, which contained personal data of school… ITALY · ·Art. 2, 5, 6 Jan 24, 2024
€1,200 VUKMAL TRADE, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a VUKMAL TRADE, S.L.. A former employee had filed a complaint against the controller due to unlawful disclosure of their private mobile… SPAIN · ·Art. 6 Jan 24, 2024
€8,000 Municipality of Salento: Insufficient cooperation with supervisory authority The Italian DPA has imposed a fine of EUR 8,000 on the municipality of Salento for failing to respond to an information request from the DPA in a timely manner. ITALY · ·Art. 58, 157 Jan 24, 2024
€20,000 Pharmaceutical wholesaler: €20,000 fine The French DPA has imposed a fine of EUR 20,000 on a pharmaceutical wholesaler due to violations of several regulations, including a lack of data security and insufficient… FRANCE · ·Unknown Jan 24, 2024
€6,000 Municipality: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on a municipality. The municipality had unlawfully published information on citizens' Covid cases on its Facebook page. The… ITALY · ·Art. 2, 5, 6 +3 Jan 24, 2024
€7,500 ROUNDED TECHNOLOGIES, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 7,500 on ROUNDED TECHNOLOGIES, S.L. The company continued to send a customer a newsletter by e-mail, although they had previously… SPAIN · ·Art. 21 Jan 23, 2024
€200,000 ORANGE ESPAGNE S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Orange Espagne S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card… SPAIN · ·Art. 6 Jan 23, 2024
€32M AMAZON FRANCE LOGISTIQUE: Non-compliance with general data processing principles The French DPA (CNIL) has imposed a fine of EUR 32 million on AMAZON FRANCE LOGISTIQUE for unlawful surveillance of employees. CNIL found that Amazon France equips its warehouse… ·Art. 5, 6, 12 +2 ·Non-compliance with general data processing principles Jan 23, 2024
€500 Attorney: Insufficient cooperation with supervisory authority The French DPA has imposed a fine of EUR 500 on an attorney. The fine was imposed due to a lack of cooperation with the DPA. FRANCE · ·Insufficient cooperation with supervisory authority Jan 22, 2024
€2,300 POLAND DPA: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined a data controller EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. ·Art. 33, 34 ·Insufficient fulfilment of data breach notification obligations Jan 18, 2024
€273,000 Centrum Medyczne Ujastek Sp. z o.o.: Non-compliance with general data processing principles The Polish DPA has imposed two fines on the medical facility “Centrum Medyczne Ujastek” totaling approximately EUR 273,000. The first fine of approximately EUR 163,000 was imposed… POLAND · ·Art. 5, 6, 9 +3 Jan 17, 2024