Content type · 3,833 documents in this view · 3,838 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities 3612 Processing 2650 Personal Data 2423 Controllers 2035 Processing Agreement 1116 Security 1021 Supervision 865 Healthcare 623 Public Authority 573 Law Enforcement 572 Monitoring 550 Consent 509
€38,600 Coop Finnmark SA: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) fined Coop Finnmark SA NOK 400,000 (EUR 38,600). The manager of the store in question recorded CCTV footage with a mobile phone and shared the… NORWAY · ·Art. 5, 6 Jan 14, 2021
€75,000 Regione Lazio: Insufficient data processing agreement The Italian DPA (Garante) has fined Regione Lazio (Lazio Region) EUR 75,000 for failing to designate Capodarco, the company it entrusted with the management of reservations for… ITALY · ·Art. 5, 28 Jan 14, 2021
€18,000 Azienda Usl di Bologna: Non-compliance with general data processing principles The Italian DPA (Garante) fined Azienda Usl di Bologna EUR 18,000. In a hospital operated by the controller, 49 patients in the oncology ward received discharge letters with… ITALY · ·Art. 5, 9 Jan 14, 2021
€30,000 Azienda sanitaria provinciale di Enna: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 30,000 on Azienda sanitaria provinciale di Enna. The controller processed biometric data of employees for the purpose of… ITALY · ·Art. 5, 6, 9 Jan 14, 2021
€2,000 Poliambulatorio Talenti S.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA (Garante) fined Poliambulatorio Talenti S.r.l. EUR 2,000 for failing to respond to the data subject's request for access to his and his daughters' data in a timely… ITALY · ·Art. 12, 15 Jan 14, 2021
€2M Caixabank S.A.: Insufficient legal basis for data processing The Spanish DPA (AEPD) fined Caixabank S.A. EUR 6,000,000 for violations of Art. 6 GDPR, Art. 13 GDPR and Art. 14 GDPR. Customers of the bank were supposed to accept new privacy… SPAIN · ·Art. 6, 13, 14 Jan 13, 2021
€10,000 BELGIUM DPA: Insufficient legal basis for data processing Managing a fan page on Facebook without the data subject's permission and failing to comply with the data subject's request after exercising his or her right to object. ·Art. 6, 12, 21 ·Insufficient legal basis for data processing Jan 12, 2021
€38,600 NORWAY DPA: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) fined a company NOK 400,000 (EUR 38,600) for the illegal automatic forwarding of an employee's email inbox. The automatic forwarding was activated… ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 12, 2021
€30,000 Enea S.A.: Insufficient fulfilment of data breach notification obligations The Polish DPA (UODO) fined Enea S.A. EUR 30,000 for the controller's failure to report a personal data breach, in violation of Art. 33 (1) GDPR. The DPA received information… POLAND · ·Art. 33 Jan 11, 2021
€10M notebooksbilliger.de: Insufficient legal basis for data processing The DPA of Lower Saxony (LfD Niedersachsen) imposed a fine of EUR 10,4 million on the electronics retailer notebooksbilliger.de.The company had video-monitored its employees for… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 8, 2021
€7,250 Gveik AS: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) fined Gveik AS EUR 7,250. The controller had carried out a credit check on an individual, although there was no legal basis for doing so. NORWAY · ·Art. 5, 6 Jan 7, 2021
€9,700 Lindstrand Trading AS: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) has fined Lindstrand Trading AS EUR 9,700. The controller had carried out four credit checks on individuals and individual companies, although… NORWAY · ·Art. 5, 6 Jan 6, 2021
€19,000 POLAND DPA: Insufficient fulfilment of data breach notification obligations The Polish DPA (UODO) imposed a fine of EUR 19,000 on a hospital operator. A former employee had unlawfully copied the personal data of 100 patients from the hospital's computer… ·Art. 34, 58 ·Insufficient fulfilment of data breach notification obligations Jan 5, 2021
€5,500 Śląski Uniwersytet Medyczny (Medical University of Silesia): Insufficient fulfilment of data breach notification obligations The Polish DPA (UODO) imposed a fine of PLN 25,000 (EUR 5,500) on the Medical University of Silesia. In the course of exams held in the form of videoconferences at the end of May… POLAND · ·Art. 33, 34 Jan 5, 2021
€20,000 Nestor SAS: Insufficient fulfilment of information obligations The French DPA (CNIL) fined the company Nestor EUR 20,000. The CNIL notes that the privacy policy provided during the registration process on the company´s website did not contain… FRANCE · ·Art. 12, 13 Jan 5, 2021
€54,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles The data subject had concluded a contract with the controller (Vodafone España, S.A.U.). However, the products provided under this contract were not delivered in the name of the… SPAIN · ·Art. 5 Jan 4, 2021
€95,500 Innovasjon Norge: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) fined the national development bank Innovasjon Norge NOK 1,000,000 (EUR 95,500). The controller had carried out four credit checks on the data… NORWAY · ·Art. 5, 6 Jan 4, 2021
€118,500 CZECH REPUBLIC DPA: Insufficient legal basis for data processing The Czech DPA (UOOU) fined 11 companies a total of EUR 118,500 for sending unrequested postal advertising messages to the mailboxes of various citizens. Based on a decision by the… ·Art. 6, 14 ·Insufficient legal basis for data processing Jan 4, 2021
€5,000 Private individual: Insufficient legal basis for data processing The DPA of Hamburg imposed a fine of EUR 5,000 on a private individual. The individual had filmed numerous young women in public. Some of the recorded female persons were… GERMANY · ·Art. 5, 6 Jan 1, 2021
€700,000 Customer loyalty program: €700,000 fine According to the newspaper 'Der Standard', the Austrian DPA has imposed a fine of EUR 1.2 million on a customer loyalty program in 2021. Further information has not yet been… AUSTRIA · ·Unknown Jan 1, 2021
€600 Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes in order to obtain information about his ex-wife's new address. He discovered where his… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Political organization: Data Protection Authority of Saarland An employee of a political organization had sent an e-mail to 400 people in an open distribution list. This not only made the e-mail addresses of all recipients visible to the… GERMANY ·Unknown Jan 1, 2021
Private individual: Insufficient legal basis for data processing The DPA from Brandenburg imposed a three-digit fine on a company employee. The individual had sent an Excel spreadsheet with employee data of 56 employees to her private e-mail… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2021
GERMANY DPA: Insufficient technical and organisational measures to ensure information security Live video surveillance which was accessible via the Internet and, due to a lack of sufficient pixelation or redaction, allowed persons to be recognized. Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2021
Job center employee: Insufficient legal basis for data processing A job center employee had accessed data in social database systems and in the civil register for private research purposes. The employee wanted to prove that two of her colleagues… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Beverage retailer: Data Protection Authority of Berlin The DPA from Berlin imposed a fine against a beverage retailer. The retailer operated a video surveillance system in which the observation angle of the cameras extended into the… GERMANY ·Unknown Jan 1, 2021
Gym owner: Data Protection Authority of Saxony The owner of a gym had apologized for the late opening of the gym, but at the same time shifted the responsibility to an employee who was named. As a result, their personal data… GERMANY ·Unknown Jan 1, 2021
Private individual: Data Protection Authority of Saxony A private individual had taken secret video recordings during a court hearing with their mobile phone. GERMANY ·Unknown Jan 1, 2021
Police officer: Insufficient legal basis for data processing A police officer had accessed data in a police database for private research purposes. The police officer queried his stepson's investigative process in order to prepare him for… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Private individual: Data Protection Authority of Saxony A resident of a residential building had unlawfully made video recordings which, among other things, covered parts of the jointly used inner courtyard. GERMANY ·Unknown Jan 1, 2021
€12,500 Energy supplier: €12,500 fine The DPA of Hamburg has imposed a fine of EUR 12,5000 on an energy supplier. The company had outsourced and sold its heating energy division. Customers affected by the transfer… GERMANY · ·Unknown Jan 1, 2021
€600 Private individual: Non-compliance with general data processing principles The Austrian DPA imposed a fine of EUR 600 on a private individual. The individual had contacted a public institution to draw their attention to the fact that the statement of a… AUSTRIA · ·Art. 5, 9 Jan 1, 2021
Police officer: Insufficient legal basis for data processing A police officer had accessed data in a police database for private research purposes. The police officer accused in a criminal case intended to use the information from the… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Police officer: Insufficient legal basis for data processing A police officer repeatedly had accessed data in a police database for private research purposes. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
GERMANY DPA: Data Protection Authority of Berlin In order to combat the Covid 19 pandemic, a cemetery had put out an open list in which visitors had to enter their contact data. A cemetery employee obtained first names, last… Unknown Jan 1, 2021
Police department: Insufficient legal basis for data processing A police officer had unlawfully accessed data in a police database. For this reason, the DPA of Brandenburg imposed a fine for a violation of § 32 (1) BbgDSG. The Brandenburg Data… GERMANY ·Insufficient legal basis for data processing Jan 1, 2021
Physician: Insufficient technical and organisational measures to ensure information security A physician's office had disposed of patient records in a waste paper container used by several offices. GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2021
GERMANY DPA: Data Protection Authority of Schleswig-Holstein An employee at a Covid testing center had used a test subject's phone number to contact them privately. Unknown Jan 1, 2021
Restaurant: Insufficient technical and organisational measures to ensure information security A restaurant had disposed of 120 completed guest registration forms for contact tracing purposes during the Covid-19 pandemic in a publicly-accessible dumpster. During its… GERMANY ·Art. 24, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2021
€16,000 Electronics store: Non-compliance with general data processing principles The DPA from Lower Saxony has imposed a fine of EUR 16,000 on an electronics store. The company had installed a video surveillance system which permanently recorded employees,… GERMANY ·Art. 5, 17, 35 ·Non-compliance with general data processing principles Jan 1, 2021
Physician: Insufficient legal basis for data processing The DPA of Brandenburg imposed a fine on a physician. The father of a minor patient had filed a complaint with the DPA because the physician had transmitted numerous data on his… GERMANY ·Art. 6, 9 ·Insufficient legal basis for data processing Jan 1, 2021
€12,500 Energy supplier: €12,500 fine The DPA of Hamburg has imposed a fine of EUR 12,5000 on an energy supplier. The company had outsourced and sold its heating energy division. Customers affected by the transfer… GERMANY · ·Unknown Jan 1, 2021
€1,800 Police officer: Insufficient legal basis for data processing A police officer repeatedly had accessed data in a police database for private research purposes. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
€400 Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes. The officer had purchased a notebook for private use on an Internet platform. Since the… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
€170 Restaurant: Non-compliance with general data processing principles In order to identify a guest who had not paid, several visitors were contacted by employees of a restaurant. For this purpose, the telephone numbers provided by the guests as part… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2021
GERMANY DPA: Data Protection Authority of Berlin In order to combat the Covid 19 pandemic, a restaurant had put out an open list in which visitors had to enter their contact data. A restaurant employee obtained first names, last… Unknown Jan 1, 2021
Police officer: Insufficient legal basis for data processing A police officer used a witness's personal data to contact her personally. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Police officer: Insufficient legal basis for data processing A police officer had accessed data in a police database for private research purposes. The police officer had queried the new partner of a friend's ex-wife because he feared that… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Job center employee: Insufficient legal basis for data processing A job center employee had accessed data in social database systems and in the civil register for private research purposes. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Medical clinic: Insufficient legal basis for data processing The DPA from Berlin has imposed a fine on a medical clinic. The clinic had installed 21 cameras in its premises for the purpose of protection against crime and property damage.… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021