Content type · 474 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€30,000 Telefónica SA: Non-compliance with general data processing principles Telefónica had charged the complainant various fees in connection with the operation of a telephone line which the complainant had never owned. The reason for this was that the… SPAIN · ·Art. 5 Nov 14, 2019
€60,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Vodafone has sent the customer's invoice data to unauthorised third parties following a customer invoice complaint. Originally, a fine of EUR 75,000 was threatened, but was… SPAIN · ·Art. 6 Nov 6, 2019
€36,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The claimant, whose data had been provided to the company by his daughter, as authorised by him, received a call from the company offering its services, which he refused. However,… SPAIN · ·Art. 5, 6 Oct 25, 2019
€60,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles Vodafone sent an invoice history to the subscriber as part of the invoice complaint by the subscriber. The history also contained invoice data of an unknown third party. SPAIN · ·Art. 5 Oct 23, 2019
€20,000 Wind Hellas Telecommunications: Insufficient fulfilment of data subjects rights Among other things, the company has ignored objections raised by affected parties against advertising calls. GREECE · ·Art. 21 Oct 18, 2019
€60,000 Xfera Moviles S.A.: Insufficient legal basis for data processing Xfera Movile has used personal data without a legal basis for the conclusion of a telephone contract and has continued to process personal data even when the data subject… SPAIN · ·Art. 5, 6 Oct 16, 2019
€200,000 Telecommunication Service Provider: Non-compliance with general data processing principles Inappropriate technical measures resulted in the data of 8,000 customers not being deleted upon request. GREECE · ·Art. 21, 25 Oct 7, 2019
€200,000 Telecommunication Service Provider: Non-compliance with general data processing principles A large number of customers were subject to telemarketing calls, although they had declared an opt-out for this. This was ignored due to technical errors. GREECE · ·Art. 5, 25 Oct 7, 2019
€9,000 Inteligo Media SA: Insufficient legal basis for data processing As part of the registration process on the webseite avocatnet.ro, the operator used an unfilled checkbox, by means of which users could declare that they did not wish to receive… ROMANIA · ·Art. 5, 6 Sep 26, 2019
€1,022 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… BULGARIA · ·Art. 6, 25 Sep 3, 2019
€11,760 Commercial representative of telecommunication service provider: Insufficient legal basis for data processing The pecuniary sanction of EUR 11, 760 was imposed on the commercial representative of telecommunications service provider for unlawful processing of the personal data of a data… BULGARIA · ·Art. 6 Sep 3, 2019
€5,113 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… BULGARIA · ·Art. 6, 25 Sep 3, 2019
€92,146 Organizer of SZIGET festival and VOLT festival: Insufficient legal basis for data processing The NAIH found that there were inappropriate legal bases is use and that the controller did not comply with the principle of purpose limitation. Also, information on the data… HUNGARY · ·Art. 5, 6, 13 May 23, 2019
€27,100 Telecommunication service provider: Insufficient legal basis for data processing Repeated registration of prepaid services without the knowledge and consent of the data subject Employees of the telecommunications provider have used personal data and registered… BULGARIA · ·Art. 5, 6 Feb 26, 2019
€50M Google LLC: Insufficient legal basis for data processing The fine was imposed on the basis of complaints from the Austrian organisation 'None Of Your Business' and the French NGO 'La Quadrature du Net'. The complaints were filed on 25th… FRANCE · ·Art. 5, 6, 13 +1 Jan 21, 2019
€48,000 VODAFONE ONO, S.A.U.: Insufficient technical and organisational measures to ensure information security Customers could access personal data of other customers in the customer area. The initial fine of EUR 60.000 was reduced to EUR 48.000. SPAIN · ·Art. 32 Jan 1, 2019
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The company had charged a Netflix service that had not been solicited by the claimant. The claimant could prove that the service had been used by another household which allegedly… SPAIN · ·Art. 6 Jan 1, 2019
€51,000 Facebook Germany GmbH: Insufficient involvement of data protection officer Whereas Facebook Ireland had appointed a data proteciton officer for all group companies located in the EU, this appontment was not notfied to the DPA Hamburg, competent for… Art. 37 ·Insufficient involvement of data protection officer Jan 1, 2019
€48,000 TELEFONICA MOVILES ESPAÑA, S.A.U.: Non-compliance with general data processing principles The claimant's bank account was charged by the company with two invoices for the services he had contracted, however, displaying personal data of another customer. The initial… SPAIN · ·Art. 5 Jan 1, 2019
€30,000 Vodafone España, S.A.U.: Insufficient technical and organisational measures to ensure information security Disclosure of customer personal data (i.a. purchase history) via an SMS to another customer. The initial fine of EUR 50.000 was reduced to EUR 30.000. SPAIN · ·Art. 5, 32 Jan 1, 2019
€21,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Vodafone had processed personal data of the claimant (bank details, name, surname and national identification number) years after the contractual relationsid had ended. The fine… SPAIN · ·Art. 6 Jan 1, 2019
€10,000 Newspaper: Insufficient legal basis for data processing The publication of the newspaper, both in hard copy and in electronic form, allegedly involved inconvenience, unnecessary and unlawful detention of a citizen, and revealed the… CYPRUS ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2019
€36,000 VODAFONE ONO, S.A.U.: Non-compliance with general data processing principles The company sent a marketing email to a large number of recipients (clients) without using the blind copy feature. The initial fine of EUR 60.000 was reduced to EUR 36.000. SPAIN · ·Art. 5 Jan 1, 2019
€20,000 Knuddels.de: Insufficient technical and organisational measures to ensure information security After a hacker attack in July personal data of approx. 330.000 users, including passwords and email addresses had been revealed. GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 21, 2018