Content type · 1,535 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€10,000 Website operator: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine in the amount of EUR 11,000 on a website operator. An individual had filed a complaint with the DPA because the controller had failed to comply… AUSTRIA · ·Art. 17, 25, 58 Jan 4, 2024
€15,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 15,200 on a media company. The company failed to react to requests by the DPA. AUSTRIA · ·Art. 58 Jan 2, 2024
€3,300 Doctor´s Office: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 3,300 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2024
€3,700 Doctor´s Office: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 3,700 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2024
€12,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has imposed a fine of EUR 12,000 on a company providing vehicle history check services. The controller refused a data subject's request to rectify personal data… LITHUANIA · ·Art. 5, 15, 16 Jan 1, 2024
Police employees: Insufficient legal basis for data processing The DPA of Hamburg has imposed two fines on members of the police for accessing police databases for private research purposes. GERMANY ·Insufficient legal basis for data processing Jan 1, 2024
Multiple Police Officers: Data Protection Authority of Berlin The DPA of Berlin imposed fined 23 police officers. The police officers misused their access to the police information system for private purposes. GERMANY ·Unknown Jan 1, 2024
€6.5M THE PHONE HOUSE SPAIN, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 6.5 million on THE PHONE HOUSE SPAIN, S.L. The controller had suffered a ransomware attack affecting personal data of 13 million… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Dec 27, 2023
€3,500 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. The private individual had installed a camera in their apartment, where they also rented out a room,… SPAIN · ·Art. 6, 13 Dec 23, 2023
€2,000 Company: Insufficient fulfilment of information obligations The Italian DPA has fined a company s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… ITALY · ·Art. 5, 13 Dec 21, 2023
€600 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed a video surveillance camera in a residential building which recorded a communal… SPAIN · ·Art. 6, 13 Dec 17, 2023
€400 TITAN STRONG, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on TITAN STRONG, S.L.. The controller had installed video surveillance cameras which, among other things, also covered the public space… SPAIN · ·Art. 5 Dec 17, 2023
€400,000 UK Ministry of Defense: Insufficient technical and organisational measures to ensure information security The UK DPA has fined the Ministry of Defense EUR 400,000 for disclosing personal data of individuals who were to be relocated to the UK after the Taliban took control of… UNITED KINGDOM · ·Insufficient technical and organisational measures to ensure information security Dec 13, 2023
€10,000 VACACIONES EDREAMS, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 10,000 on VACACIONES EDREAMS, S.L.. A data subject had filed a complaint against the controller with the DPA due to the controller's… SPAIN · ·Art. 15 Dec 12, 2023
€24,000 Hora Credit IFN SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA imposed a fine of EUR 24,000 on Hora Credit IFN SA. The controller had accidentally sent documents containing the personal data of another person to a customer by… ROMANIA · ·Art. 12, 15, 32 +1 Dec 7, 2023
€1,500 Physician: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 1,500 on a physician. An individual had filed a complaint with the DPA because the physician had accessed their personal data in a… CYPRUS ·Art. 5 ·Non-compliance with general data processing principles Dec 7, 2023
€1,000 Sirio S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,000 on Sirio S.p.A.. An employee filed a complaint with the DPA because the controller had passed on their personal data to a bank… ITALY · ·Art. 5, 6, 13 Dec 7, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5, 13 Nov 30, 2023
€60,000 Limit Call S.r.l.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 60,000 on Limit Call S.r.l.s. for unauthorized telemarketing. The controller had acquired lists of personal data without checking the… ITALY · ·Art. 5, 6, 7 +6 Nov 30, 2023
€1,000 Techno Security s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,000 on Techno Security s.r.l.. A data subject had filed a complaint with the DPA due to the controller's failure to respond to a… ITALY · ·Art. 12, 15 Nov 30, 2023
€3,000 A R.L Spartan Gym: Non-compliance with general data processing principles The Italian DPA has fined A R.L Spartan Gym EUR 3,000. The controller had operated video surveillance cameras in one of their premises without the required authorization.… ITALY · ·Art. 5, 13, 114 Nov 30, 2023
€26,500 Östersund Municipality's Department for Children and Education: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 26,500 on the Östersund Municipality's Department for Children and Education. The authority had failed to carry out a data protection… SWEDEN ·Art. 35 ·Insufficient technical and organisational measures to ensure information security Nov 28, 2023
€1.7M Norwegian Labor and Welfare Administration: Insufficient technical and organisational measures to ensure information security The Norwegian DPA has imposed a fine of EUR 1.7 million on Arbeids- og velferdsetaten, the Norwegian Labor and Welfare Administration (NAV). During its investigation, the DPA… NORWAY · ·Art. 5, 24, 25 +1 Nov 27, 2023
€50,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller had… SPAIN · ·Art. 6 Nov 27, 2023
Belgian DPA settles with Mediafin: De Tijd cookie banner must add equal "refuse all" On 19 July 2023, a data subject, represented by noyb (European Centre for Digital Rights), filed a complaint against Mediafin, a Belgian media group, with the Belgian DPA. The… 159/2023 ·Belgium · Nov 24, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered a neighbour… SPAIN · ·Art. 5 Nov 24, 2023
€10,000 Alpha Bank: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 10,000 on Alpha Bank. A data subject had filed a complaint with the DPA due to the controller's failure to respond to a request of… GREECE · ·Art. 12, 15 Nov 23, 2023
€56,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish data protection authority has imposed a fine of EUR 50,000 on VODAFONE ESPAÑA, S.A.U.. A customer had filed a complaint with the DPA regarding the fact that due to a… SPAIN · ·Art. 6 Nov 22, 2023
€45,000 Open University of Cyprus: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 45,000 on Open University of Cyprus. The university had suffered a data breach involving hackers publishing personal data of students,… Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Nov 22, 2023
€400 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5 Nov 22, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered a neighbouring… SPAIN · ·Art. 5 Nov 21, 2023
€8,000 EASYJET AIRLINE COMPANY LIMITED: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on EASYJET AIRLINE COMPANY LIMITED. A data subject had filed a complaint against the controller with the DPA due to the controller's failure to… SPAIN · ·Art. 15 Nov 21, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Nov 20, 2023
€72,000 Eurocollege Oxford English Institute S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 72,000 on Eurocollege Oxford English Institute S.L. The data subject stated that they had signed a training contract with the affiliated… SPAIN · ·Art. 5, 6, 9 Nov 17, 2023
€500 Private individual: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 500 on a private individual. The individual had installed a video surveillance system in a laundromat operated by them without… SPAIN · ·Art. 13 Nov 16, 2023
€20,000 FORO ASTURIAS: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 20,000 on FORO ASTURIAS. An individual had filed a complaint with the DPA due to the fact that personal data stored by the controller had… SPAIN · ·Art. 5, 32 Nov 16, 2023
€20,000 Piraeus Leasing S.M.S.A.: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 20,000 on Piraeus Leasing S.M.S.A.. An individual had filed a complaint with the DPA because the controller processed an image on which… GREECE · ·Art. 5, 15 Nov 10, 2023
€43,000 Indcap AB: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 43,000 on Indecap AB. The controller had accidentally sent an email to a large number of its customers containing an Excel document… SWEDEN ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 7, 2023
€1,000 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on a homeowners' association. A property owner had filed a complaint with the DPA. The controller had published an enforcement… SPAIN · ·Art. 5, 32 Nov 7, 2023
€600 Store owner: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a store owner. The controller had installed video surveillance cameras which, among other things, also covered a neighbour… SPAIN · ·Art. 5 Nov 7, 2023
€5,000 Municipality: Insufficient legal basis for data processing The Hellenic DPA has imposed a fine of EUR 5,000 on a municipality. The municipality had published a person's personal data on the municipality's website and failed to comply with… GREECE · ·Art. 6, 17 Nov 7, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN · ·Art. 5 Nov 6, 2023
€240 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 240 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects. SPAIN · ·Art. 13 Nov 6, 2023
€200,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Nov 6, 2023
€600 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a Homeowners Association. The association had installed several video surveillance cameras which, among other things, also… SPAIN · ·Art. 5 Nov 3, 2023
€600 Hotel: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a hotel. The controller had installed video surveillance cameras which, among other things, also covered the public space and… SPAIN · ·Art. 5, 13 Nov 3, 2023
€2,000 SINDICATO LIBRE DE TRANSPORTES: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on SINDICATO LIBRE DE TRANSPORTES. A member of the union had shared the data subject's payslip in a WhatsApp group without the data subject's… SPAIN · ·Art. 5, 32 Nov 3, 2023
€3,000 OTP BANK ROMANIA SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on OTP BANK ROMANIA SA. The controller had accidentally transmitted personal data of an individual to an unauthorized third party.… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 3, 2023
€30,000 APOLLONIA TOPCO, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on APOLLONIA TOPCO, S.L.. An individual had filed a complaint with the DPA due to the fact that, in order to receive a refund,… SPAIN · ·Art. 5, 38 Nov 2, 2023
€48,000 INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P.: Non-compliance with general data processing principles The Spanish DPA has imposed a finea INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P. The controller had suffered a data breach in which personal patient and employee data had… SPAIN · ·Art. 5, 32, 34 Nov 2, 2023