Content type · 490 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€48,000 HM Hospitales: Insufficient legal basis for data processing The data subject stated that at the time of his admission to hospital he had to fill in a form containing a checkbox indicating that, if he did not tick it, he agreed to the… SPAIN · ·Art. 5, 6 Feb 25, 2020
€2,560 L.E. EOOD: Insufficient technical and organisational measures to ensure information security The fine of ca EUR 2,557 was imposed on L.E. EOOD for unlawful processing of personal data of data subject I.S. without the knowing and the consent of the data subject and also… BULGARIA · ·Art. 6, 25, 32 Feb 20, 2020
€80,000 Iberdrola Clientes: Insufficient legal basis for data processing Iberdola Clientes, an electricity company, terminated the data subject's contract without its consent, concluded three new contracts with the data subject, processed his personal… SPAIN · ·Art. 6 Feb 14, 2020
€5,000 Queseria Artesenal Ameco S.L.: Insufficient legal basis for data processing The company processed personal data of customers without required consent. SPAIN · ·Art. 5, 6 Feb 3, 2020
€20,000 Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal: Insufficient legal basis for data processing Iberia continued to send e-mails to the data subject, despite the data subject had requested the withdrawal of his consent and the erasure of his personal data and that the… SPAIN · ·Art. 5, 6, 21 Feb 3, 2020
€75,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The fine preceded the complaint by the data subject, who argued that Vodafone España had signed a contract for the transfer of a telephone subscription with a third party without… SPAIN · ·Art. 5, 6 Feb 3, 2020
€60,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The fine was preceded by a complaint from the data subject, who argued that he had received an e-mail from Vodafone España, which contained the billing of a telephone line that… SPAIN · ·Art. 5, 6 Feb 3, 2020
€28M TIM (telecommunications operator): Insufficient legal basis for data processing Between January 2017 and 2019, the data protection authority received hundreds of notifications, in particular concerning the receipt of unsolicited commercial communications made… ITALY · ·Art. 5, 6, 17 +2 Jan 15, 2020
€1,000 eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD): Insufficient legal basis for data processing Sending SMS marketing messages without consent. In particular, no appropriate measures were taken, such as the possibility for telephone users to block marketing messages from the… CYPRUS ·Art. 6 ·Insufficient legal basis for data processing Jan 13, 2020
€75,000 EDP Comercializadora, S.A.U.: Insufficient legal basis for data processing The company processed personal data in connection with a gas contract without the consent of the applicant. The decision finds that the applicant received an invoice for a gas… SPAIN · ·Art. 6 Jan 7, 2020
€10,000 Asociación de Médicos Demócratas: Insufficient legal basis for data processing The Asociación de Médicos Demócratas has processed personal data of its members, despite having been warned by the AEPD that it carried out the processing without the consent of… SPAIN · ·Art. 6 Jan 7, 2020
€75,000 EDP España S.A.U.: Insufficient legal basis for data processing The company processed personal data such as first and last name, tax number, address and mobile phone number without the consent of the data subject SPAIN · ·Art. 6 Jan 7, 2020
Ski rental company: Non-compliance with general data processing principles Czech Data Protection Auhtority (UOOU) CZECH REPUBLIC · ·Art. 5, 6, 7 +9 Jan 1, 2020
Operator of a ballet school: Insufficient legal basis for data processing The operator of a ballet school had published photos of underage students on their website and Facebook page without the consent of the legal guardians. GERMANY ·Art. 5, 6, 7 ·Insufficient legal basis for data processing Jan 1, 2020
DSB (Austria) - D123.768/0004-DSB/2019 The complainant belongs to a political party and is a member of the city council of an Austrian municipality. In November, the municipality held a meeting on the "parking space… DSB-D123.768/0004-DSB/201 ·Art. 4, 85 Dec 18, 2019
€15,000 Website providing legal information: Insufficient fulfilment of information obligations An operator of a website for legal news had the privacy statement only available in English, although it was also addressed to a Dutch and French speaking audience. In addition,… BELGIUM · ·Art. 6, 12, 13 Dec 17, 2019
€6,000 SC Enel Energie S.A. (Electricity Distributor): Insufficient legal basis for data processing The sanctions were imposed following a complaint alleging that Enel Energie had unlawfully processed an individual's personal data and was unable to prove that it had obtained the… ROMANIA · ·Art. 5, 6, 7 +1 Dec 16, 2019
€8.5M Eni Gas e Luce: Insufficient legal basis for data processing The Italian supervisory authority imposed two fines totalling EUR 11,5 million on Eni Gas and Luce (Egl) for unlawful processing of personal data in the context of advertising… ITALY · ·Art. 5, 6, 17 +1 Dec 11, 2019
€5,000 Linea Directa Aseguradora: Insufficient legal basis for data processing The insurance company has sent advertising e-mails for the 'Reto Nuez' platform without the required consent. SPAIN · ·Art. 6 Dec 3, 2019
€2,500 Royal President S.R.L.: Insufficient fulfilment of data subjects rights Royal President refused a request for access to personal data pursuant to Article 15 of the GDPR and disclosed personal data without the consent of the data subjects. In addition,… ROMANIA · ·Art. 6, 15, 32 Nov 29, 2019
€60,000 Viaqua Xestión Integral Augas de Galicia: Insufficient legal basis for data processing Processing (modification) of the personal data of a customer included in a contract by a third party without the consent of the customer. SPAIN · ·Art. 6 Nov 21, 2019
€3,000 General Confederation of Labour ('CGT'): Insufficient legal basis for data processing The CGT, with the aim of convening a meeting, e-mailed personal data of the complainant, including her home address, family relationship, pregnancy status and the date of an… SPAIN · ·Art. 6 Nov 13, 2019
€36,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The claimant, whose data had been provided to the company by his daughter, as authorised by him, received a call from the company offering its services, which he refused. However,… SPAIN · ·Art. 5, 6 Oct 25, 2019
€47,000 ClickQuickNow: Non-compliance with general data processing principles The UODO imposed a fine of EUR 47000 for obstructing the exercise of the right of withdrawal for the processing of personal data. The company has not taken appropriate technical… POLAND · ·Art. 5 Oct 16, 2019
€9,000 Inteligo Media SA: Insufficient legal basis for data processing As part of the registration process on the webseite avocatnet.ro, the operator used an unfilled checkbox, by means of which users could declare that they did not wish to receive… ROMANIA · ·Art. 5, 6 Sep 26, 2019
€5,113 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… BULGARIA · ·Art. 6, 25 Sep 3, 2019
CNPD (Portugal) - Deliberação 2019/494 In its Opinion 20/2018 concerning the draft of Law 58/2019 which ensures the implementation of the GDPR in the portuguese national legal framework, the DPA drew the attention of… Deliberação 2019/494 ·Art. 2, 3, 5 +8 Sep 3, 2019
€1,022 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… BULGARIA · ·Art. 6, 25 Sep 3, 2019
€18,630 School in Skellefteå: Insufficient legal basis for data processing A school in Skellefteå made a trial to use facial recognition technology. The fine was imposed against the school which had used facial recognition technology to monitor the… SWEDEN ·Art. 5, 9, 35 +1 ·Insufficient legal basis for data processing Aug 20, 2019
€150,000 PWC Business Solutions: Insufficient legal basis for data processing The processing of employee personal data was based on consent. The HDPA found that consent as legal basis was inappropriate, as the processing of personal data was intended to… GREECE · ·Art. 5, 6, 13 +1 Jul 30, 2019
€250,000 Professional Football League (LaLiga): Insufficient fulfilment of information obligations The national Football League (LaLiga) was fined for offering an app which once per minute accessed the microphone of users' mobile phones in order to detect pubs screening… SPAIN · ·Art. 5, 7 Jun 11, 2019
€2,850 Claim management company: Insufficient legal basis for data processing The complainants stated during the case that they concluded a credit agreement with the bank, which sold its claim against the complainants and transferred their respective data… HUNGARY · ·Art. 5, 6 Jun 3, 2019
€1,400 Police Officer: Insufficient legal basis for data processing The police officer, using his official user ID but without reference to official duties, queried the owner data concerning the license plate of a person who he did not know well… GERMANY ·Art. 6 ·Insufficient legal basis for data processing May 9, 2019
€27,100 Telecommunication service provider: Insufficient legal basis for data processing Repeated registration of prepaid services without the knowledge and consent of the data subject Employees of the telecommunications provider have used personal data and registered… BULGARIA · ·Art. 5, 6 Feb 26, 2019
€50M Google LLC: Insufficient legal basis for data processing The fine was imposed on the basis of complaints from the Austrian organisation 'None Of Your Business' and the French NGO 'La Quadrature du Net'. The complaints were filed on 25th… FRANCE · ·Art. 5, 6, 13 +1 Jan 21, 2019
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The company had charged a Netflix service that had not been solicited by the claimant. The claimant could prove that the service had been used by another household which allegedly… SPAIN · ·Art. 6 Jan 1, 2019
€160,000 Taxa 4x35: Non-compliance with general data processing principles The Danish DPA reported the taxi company to the police and recommended a fine (of 1.2M DKK) for non-adherence to the data-minimization principle. While the company deleted the… DENMARK · ·Art. 5 Jan 1, 2019
€2,200 Private person: Insufficient legal basis for data processing The fine was imposed against a private person who was using CCTV at his home. The video surveillance covered areas which are intended for the general use of the residents of the… AUSTRIA · ·Art. 5, 6, 13 Dec 20, 2018
€500 Bank: Insufficient legal basis for data processing A fine of 1000 BGN (or roughly 500 EUR) was imposed on a bank for calling a client for the unresolved bills of his neighbor. This provoked the client to evoke his right to be… BULGARIA · ·Art. 5, 6 Dec 4, 2018
Datatilsynet (Norway) - 15/01355 Legelisten.no AS is a Norwegian limited liability company running a website where people anonymously can post reviews about dentists, doctors, psychologists and other healthcare… 15/01355 ·Art. 4, 5, 6 +3 Nov 8, 2017