Content type · 3,831 documents in this view · 3,836 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities 3611 Processing 2650 Personal Data 2423 Controllers 2035 Processing Agreement 1116 Security 1022 Supervision 865 Healthcare 622 Public Authority 573 Law Enforcement 572 Monitoring 551 Consent 509
Private individual: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine on a private individual. The individual, who was employed in a store, had contacted a customer, who had provided their contact details for… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Physician: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine in the four figure range on a physician. The physician had responded to an online review regarding their practice, disclosing personal health… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Fishing club: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a three-figure fine on a fishing club due to the fact that lists of members' personal data such as first and last names, full addresses with… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
€3,600 Physician: Insufficient technical and organisational measures to ensure information security A physician's office had disposed of records containing patient data in a public waste disposal site. GERMANY ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2023
€25,000 Company: Insufficient fulfilment of data subjects rights The DPA of Hessen has fined a company EUR 25,000. A person had filed a complaint for receiving advertising messages, although they had objected to receiving advertising messages GERMANY ·Art. 21 ·Insufficient fulfilment of data subjects rights Jan 1, 2023
€215,000 Humboldt Forum Service GmbH: Insufficient legal basis for data processing The DPA of Berlin has imposed fines totaling EUR 215,000 on Humboldt Forum Service GmbH. Humboldt Forum had improperly documented sensitive information about individual employees… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Daycare center: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a four-figure fine on a daycare center that had disposed of documents containing personal data of children and their parents in a publicly… GERMANY · ·Art. 32 Jan 1, 2023
€16,600 Niedersachsen DPA fines real estate company €16,600 for missing joint controllership The DPA of Niedersachsen has imposed a fine of EUR 16,600 on a company in the real estate industry for failing to conclude a joint controllership agreement. In addition, the… GERMANY ·Art. 6, 12, 26 ·Unknown Jan 1, 2023
€15,000 A&G Couriers Limited T/A Fastway Couriers (Ireland): Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) has fined A&G Couriers Limited T/A Fastway Couriers (Ireland) EUR 15,000. During a changeover of its IT systems, the controller had suffered a cyberattack in… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Dec 30, 2022
€6,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a company EUR 6,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 58 Dec 30, 2022
€3,000 ADENET SYSTEMS, S.L.: Insufficient cooperation with supervisory authority Failure to provide requested information to the Spanish DPA (AEPD) within the required timeframe in violation of Art. 58 GDPR. SPAIN · ·Art. 58 Dec 29, 2022
€24,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller carried out a… SPAIN · ·Art. 6 Dec 29, 2022
€3M VOODOO ('provider') was a mobile game developer The investigation service of the French DPA (the investigation service) carried out several checks on voodoo.io and on several of the provider's mobile applications on iOS, in… SAN-2022-026 ·France · Dec 29, 2022
€300 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a store owner EUR 300 for failing to provide information signs about CCTV surveillance in their premises. SPAIN · ·Art. 13 Dec 28, 2022
€300 Homeowners Association: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 300 on a homeowners' association for failing to provide sufficient information about video surveillance in the residential area. SPAIN · ·Art. 13 Dec 28, 2022
€400 MAE WEST SYSTEMS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined MAE WEST SYSTEMS, S.L. EUR 400. The controller had installed video surveillance in a bar it operated without providing sufficient information… SPAIN · ·Art. 13 Dec 28, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Dec 28, 2022
€600 Homeowners Association: Insufficient legal basis for data processing The Spanish DPA has fined a homeowners association EUR 600. The controller had installed an unauthorized CCTV system in the residential area. In addition, the DPA found that the… SPAIN · ·Art. 6, 13 Dec 28, 2022
€100,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine of EUR 100,00 on Vodafone España, S.A.U. due data processing without a sufficient legal basis. A data subject stated that a prepaid line of… SPAIN · ·Art. 6 Dec 28, 2022
€2,000 Homeowners Association: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA… SPAIN · ·Art. 6, 15 Dec 28, 2022
€3,000 Kaufland Romania SCS: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Kaufland Romania SCS. The controller had reported a data breach to the DPA according to Art. 33 GDPR. An employee had taken… ·Art. 29, 32 ·Insufficient technical and organisational measures to ensure information security Dec 27, 2022
€122,000 Company: Insufficient legal basis for data processing The Finnish DPA has imposed a fine of EUR 122,000 on a company with products that process health data, such as heart rate, etc. The DPA had received several complaints regarding… FINLAND · ·Art. 9 Dec 27, 2022
€100,000 VIEC Limited: Non-compliance with general data processing principles The Irish DPA has imposed a fine of EUR 100,000 on the nursing home operator VIEC Limited. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. The… IRELAND · ·Art. 5, 32 Dec 22, 2022
€10,000 SUDREZIDENȚIAL Broker S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on SUDREZIDENȚIAL Broker S.R.L.. An employee of the controller had unauthorizedly published an Excel spreadsheet containing… ROMANIA · ·Art. 32 Dec 22, 2022
€8,000 Hotel: Insufficient legal basis for data processing The Hungarian DPA has imposed a fine of EUR 8,000 on a hotel. The controller had installed video surveillance cameras that covered the dining room and a whirlpool area permanently… HUNGARY · ·Art. 5, 6, 12 +2 Dec 21, 2022
€2,000 Property owner administrative board: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on a Property Owners Association. Two property owners had filed a complaint with the DPA. The individuals had submitted a request… SPAIN · ·Art. 5 Dec 20, 2022
€1,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on a private individual. A person had filed a complaint with the DPA because the controller had published their personal data such… SPAIN · ·Art. 5 Dec 20, 2022
€3,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 3,000 on a private individual. An individual had posted videos of teachers and underage students during physical education classes on the… SPAIN · ·Art. 6 Dec 20, 2022
€7,000 ΜΑΡΙΑ ΠΕΔΙΩΤΗ ΚΑΙ ΣΙΑ Ο.Ε.: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 7,000 on the company ΜΑΡΙΑ ΠΕΔΙΩΤΗ ΚΑΙ ΣΙΑ Ο.Ε. The company had not sufficiently complied with the request for information from a… GREECE · ·Art. 12, 15, 31 Dec 19, 2022
€55,000 Azienda Universitaria Giuliano Isontina: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Giuliano Isontina . The health authority has created patient profiles using algorithms and personal… ITALY · ·Art. 2, 5, 9 +2 Dec 15, 2022
€4.9M Edison Energia S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Edison Energia S.p.A. EUR 4.9 million. Several person had filed complaints with the DPA regarding unlawful marketing activities of the company. During… ITALY · ·Art. 5, 6, 7 +4 Dec 15, 2022
€5,000 Comune di Borgia: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 5,000 on Comune di Borgia. The municipality processed biometric data of employees for the purpose of registering their attendance.… ITALY · ·Art. 5, 6, 9 +1 Dec 15, 2022
€8,000 Comune di Vicchio: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 8,000 on Comune di Vicchio. The municipality processed biometric data of employees for the purpose of registering their attendance.… ITALY · ·Art. 5, 6, 9 Dec 15, 2022
€5,000 Societatea Energetică Electrica S.A.: Insufficient data processing agreement The Romanian DPA has fined Societatea Energetică Electrica S.A. EUR 5,000 for a violation of Art. 28 (3) a) GDPR. ROMANIA · ·Art. 28 Dec 15, 2022
€55,000 Azienda Universitaria Friuli Centrale: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Friuli Centrale. The health authority has created patient profiles using algorithms and personal patient… ITALY · ·Art. 2, 5, 9 +2 Dec 15, 2022
€16,000 HOSPITAL RECOLETAS PONFERRADA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on the healthcare facility HOSPITAL RECOLETAS PONFERRADA, S.L.. A patient had filed a complaint with the DPA. The patient had filled out a… SPAIN · ·Art. 6, 15 Dec 15, 2022
€30,000 ORANGE ESPAGNE, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine ORANGE ESPAGNE, S.A.U. due to insufficient legal basis for data processing. The data subject had filed a complaint against the data… SPAIN · ·Art. 6 Dec 15, 2022
€55,000 Azienda Universitaria Friuli Occidentale: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Friuli Occidentale. The health authority has created patient profiles using algorithms and personal… ITALY · ·Art. 2, 5, 9 +2 Dec 15, 2022
€3,000 Scuola Statale Secondaria di I^ grado 'Bianco-Pascol': Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on the school 'Scuola Statale Secondaria di I^ grado 'Bianco-Pascoli', di Fasano (BR)'. The educational institution had published a… ITALY · ·Art. 2, 5, 6 +2 Dec 15, 2022
€6,000 Comune di Bracciano: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on Comune di Bracciano. A former employee had filed a complaint with the DPA due to the fact, that the municipality had published a… ITALY · ·Art. 2, 5, 6 +1 Dec 15, 2022
€30,000 Verizon Connect Italy S.p.A.: Insufficient legal basis for data processing The Italian DPA has fined Verizon Connect Italy S.p.A. EUR 30,000. An individual who worked for a Verizon customer had filed a complaint with the DPA. Verizon had installed GPS… ·Art. 5, 6, 28 ·Insufficient legal basis for data processing Dec 15, 2022
€120,000 Eurosanità S.P.A.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 120,000 on Eurosanità S.P.A.. The controller operates various healthcare facilities. An individual had filed a complaint with the DPA for… ITALY · ·Art. 5, 9, 32 Dec 15, 2022
€700 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 700 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12, 13 Dec 13, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Dec 13, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Dec 13, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Dec 13, 2022
€750,000 Alektum Oy: Insufficient fulfilment of data subjects rights The Finnish DPA has fined the debt collection company Alektum Oy EUR 750 000. The DPA opened an investigation against the controller after three people filed complaints against… FINLAND · ·Art. 12, 15 Dec 13, 2022
€1,500 Manager of a real estate co-ownership: Insufficient legal basis for data processing The DPA of Luxembourg has imposed a fine of EUR 1,500 on a manager of a real estate co-ownership. The controller had disclosed personal data to unauthorized third parties without… LUXEMBOURG · ·Art. 5, 6, 12 +1 Dec 13, 2022
€1,000 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 1,000 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12 Dec 13, 2022
€2,500 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 2,500 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12 Dec 13, 2022