Content type · 1,282 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€1,000 Cez Vânzare S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Cez Vânzare S.A.. The controller had accidentally sent emails containing personal customer data to the wrong recipients. The… ROMANIA · ·Art. 32 Oct 2, 2023
€50,000 Azienda Usl Toscana centro: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 50,000 on Azienda Usl Toscana centro. A person had reported that medical records containing sensitive patient data were still being… ITALY · ·Art. 5, 32 Sep 28, 2023
€5,000 Physician: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on a physician for unlawfully disclosing patient data. ITALY · ·Art. 5, 9 Sep 28, 2023
€5,000 Ministero dell'Ambiente e della Sicurezza Energetica: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Ministero dell'Ambiente e della Sicurezza Energetica. The controller had published a document on its website that contained… ITALY · ·Art. 2, 5, 6 +1 Sep 28, 2023
€60,000 Salvator Mundi International Hospital s.r.l: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on Salvator Mundi International Hospital s.r.l. The hospital had restricted access to its services to people with a Covid-19 Green… ITALY · ·Art. 5, 9 Sep 28, 2023
€10M Axpo Italia Spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10 million on electricity and gas supplier Axpo Italia Spa. The DPA had received numerous complaints from data subjects who complained… ITALY · ·Art. 5, 24 Sep 28, 2023
€15,000 Hotel: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed of fine of EUR 15,000 to a hotel. The hotel was collecting personal data from guests in excess of what would have been necessary for the… CROATIA · ·Art. 6, 13, 32 +1 Sep 26, 2023
€30,000 EUROPA PRESS DE CATALUNYA, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on EUROPA PRESS DE CATALUNYA, S.A.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Sep 26, 2023
€10,000 Phyisician: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 10,000 on a physician. The physician had responded to an online review regarding their practice, disclosing personal health data of a… AUSTRIA · ·Art. 5, 9 Sep 26, 2023
€50,000 Athens Urban Transport Organization: Non-compliance with general data processing principles The Hellenic DPA imposed a fine of EUR 50,000 on the Athens Urban Transport Organization. As part of its investigation, the DPA found that the controller had failed to comply with… GREECE · ·Art. 5, 25, 35 Sep 25, 2023
€17,000 FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with… SPAIN · ·Art. 9, 13 Sep 25, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 25, 2023
€12,000 CHATWITH.IO WORLDWIDE, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 12,000 on the website operator CHATWITH.IO WORLDWIDE, S.L. During its investigation, the DPA found that the controller had failed to… SPAIN · ·Art. 5, 13, 22 Sep 23, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered neighbour… SPAIN · ·Art. 5 Sep 21, 2023
€2,500 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA of Luxembourg has imposed a fine of EUR 2,500 on a controller. The controller had used location systems on his service vehicles and construction machinery. During its… ·Art. 5, 13 ·Non-compliance with general data processing principles Sep 21, 2023
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 19, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered… SPAIN · ·Art. 5 Sep 19, 2023
€200,000 SAF LOGISTICS: Non-compliance with general data processing principles The French DPA has fined SAF LOGISTICS EUR 200,000. An employee reported to the DPA that the controller had collected data on the private lives of its employees. During its… FRANCE · ·Art. 5, 9, 10 +1 Sep 18, 2023
€5,000 Nimbus s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Nimbus s.r.l.. The controller had introduced a biometric attendance system at the workplace without adequately informing the… ITALY · ·Art. 5, 9, 13 Sep 14, 2023
€10,000 San Severo municipality: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 10,000 on San Severo municipality. The municipality had published a document containing personal data of employees on its website without a… ITALY · ·Art. 2, 5, 6 Sep 14, 2023
€345M TikTok Limited: Non-compliance with general data processing principles The Irish DPA (DPC), has imposed a fine of EUR 345 million on TikTok Limited. The DPC conducted an investigation primarily focused on the processing of personal data between July… IRELAND ·Art. 5, 12, 13 +2 ·Non-compliance with general data processing principles Sep 1, 2023
€10,000 RCS Mediagroup Spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10,000 on RCS Mediagroup Spa. A data subject had filed a complaint with the DPA due to the fact that their personal data had been… ITALY · ·Art. 2, 5, 137 +1 Aug 31, 2023
€25,000 Robin Srl: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 25,000 on Robin Srl. The controller had unlawfully published images of minors that were not sufficiently blurred in the context of… ITALY · ·Art. 5, 6, 7 +2 Aug 31, 2023
€10,000 Mednow Medical Center di Giugni Marco: Non-compliance with general data processing principles The Italian DPA has fined Mednow Medical Center di Giugni Marco EUR 10,000. An individual had filed a complaint with the DPA because the controller had inadvertently sent the… ITALY · ·Art. 5, 9, 12 +5 Aug 31, 2023
€20,000 Bar association: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on a bar association. Two individuals had filed a complaint with the DPA against the controller because documents relating to a… ITALY · ·Art. 2, 5 Aug 31, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The… SPAIN · ·Art. 5 Aug 30, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 300 euros on a private individual. The controller had installed video surveillance cameras that recorded a neighbor's property, among other… SPAIN · ·Art. 5 Aug 30, 2023
€1,500 ALBEN AIRPORT FACILITIES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on ALBEN AIRPORT FACILITIES S.L.. The controller had sent an email with certificates of participation in a training course to all participants,… SPAIN · ·Art. 5, 32 Aug 29, 2023
€4,800 WALL BOX CHARGERS S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on WALL BOX CHARGERS S.L.. The controller had inadvertently placed a person on CC on emails to other customers, giving them access to data from… SPAIN · ·Art. 5, 32 Aug 28, 2023
€3M Trygg-Hansa: Non-compliance with general data processing principles The Swedish DPA has fined Trygg-Hansa EUR 3 million for serious data security breaches. The security breach was discovered when a recipient of an email from Trygg-Hansa realized… SWEDEN ·Art. 5, 32 ·Non-compliance with general data processing principles Aug 28, 2023
€1,500 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on a homeowners' association. A property owner had filed a complaint with the DPA. The controller had published an enforcement… SPAIN · ·Art. 5, 32 Aug 25, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Aug 23, 2023
€70,000 Uipath SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 70,000 on Uipath SRL. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. During its investigation, the DPA… ROMANIA · ·Art. 25, 32 Aug 21, 2023
€600 MÁRMOLES Y GRANITOS MEJIAS, S. L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on MÁRMOLES Y GRANITOS MEJIAS, S. L.. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5, 13 Aug 16, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 11, 2023
€6,000 ODRIA COSTAS INTERNACIONAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on ODRIA COSTAS INTERNACIONAL, S.L. A data subject had filed a complaint with the DPA because the controller had published a picture of their… SPAIN · ·Art. 5 Aug 8, 2023
€10,000 GYMOOGIMNASIOS S.L.: Non-compliance with general data processing principles The Spanish DPA has fined GYMOOGIMNASIOS S.L. EUR 10,000. The controller had installed a reservation system where data subjects had to consent to the processing of health-related… SPAIN · ·Art. 5, 7 Aug 2, 2023
Multiple website operators: Czech Data Protection Auhtority (UOOU) In the period from January 2023 to July 2023, the Czech DPA imposed fines totaling EUR 178,000, with the highest fine being EUR 36,000. These fines were imposed due to unlawful… CZECH REPUBLIC ·Unknown Aug 2, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded common areas of a… SPAIN · ·Art. 5 Aug 1, 2023
€5,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on a private individual. The controller was both employer and landlord of the data subject. The controller had used the bank… SPAIN · ·Art. 5 Jul 27, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 300 euros on a private individual. The controller had installed video surveillance cameras that recorded a neighbor's property, among other… SPAIN · ·Art. 5 Jul 25, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public space.… SPAIN · ·Art. 5 Jul 24, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 300 euros on a private individual. The controller had installed video surveillance cameras that recorded a neighbor's property, among other… SPAIN · ·Art. 5 Jul 20, 2023
€1,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jul 20, 2023
€40,000 Compara Facile S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on Compara Facile S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were registered in… ITALY · ·Art. 5, 6, 7 +8 Jul 18, 2023
€400 Private individual: Non-compliance with general data processing principles The Italian DPA has fined a private individual EUR 400 for unlawfully operating video surveillance cameras on their property. ITALY · ·Art. 5, 6 Jul 18, 2023
€75,000 Università Telematica E-Campus: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 75,000 on Università Telematica E-Campus. The controller had sent advertising messages and made advertising calls without the consent of… ITALY · ·Art. 5, 6, 7 +6 Jul 18, 2023
€12,000 Azienda Socio Sanitaria Territoriale Ovest Milanese: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on Azienda Socio Sanitaria Territoriale Ovest Milanese. The controller had suffered data breaches that affected the privacy of… ITALY · ·Art. 5, 9, 32 Jul 18, 2023
€100,000 Tiscali Italia SpA: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Tiscali Italia SpA. The controller had sent advertising messages to more than 160,000 customers within four months, even… ITALY · ·Art. 5, 12, 13 +2 Jul 18, 2023
€1,000 Prodav srl: Non-compliance with general data processing principles The Italian DPA has fined Prodav srl EUR 1,000. The controller had operated video surveillance cameras in one of their shops without the required authorization. Furthermore, the… ITALY · ·Art. 5, 13, 114 Jul 18, 2023