Content type · 2,565 documents in this view · 3,651 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
451–500 of 2,565 sort newestlargest fineoldest
€550,000 Vodafone – PANAFON A.E.E.T.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 550.000 euro - Hellenic Data Protection Authority (HDPA). GREECE ·HDPA ·Art. 5, 28 Security Data Processor Processors NL Jun 25, 2025
€550,000 Vodafone – PANAFON A.E.E.T.: Insufficient technical and organisational measures to ensure information security The Greek DPA has imposed a fine of EUR 550,000 on Vodafone – PANAFON A.E.E.T. The controller failed to implement sufficient technical and organisational measures to ensure data… GREECE ·HDPA ·Art. 5, 28 Controllers Telecommunications Security Jun 25, 2025
€40,000 KARAMBELAS KONSTANTINOS & CO. E.E.: Insufficient technical and organisational measures to ensure information security The Greek DPA has imposed a fine of EUR 40,000 on KARAMBELAS KONSTANTINOS & CO. E.E. The processor, which was processing data for a telecommunications provider (ETid: 2878),… GREECE ·HDPA ·Art. 29, 32 Security Telecommunications Processors Jun 25, 2025
€10,000 Shield of David - K.I.D.A.F.: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on Shield of David - K.I.D.A.F. The controller, a day care centre for people with autism, has legally installed video… GREECE ·HDPA ·Art. 5, 12, 13 +3 Video Surveillance Controllers Healthcare Jun 24, 2025
€10,000 Shield of David - K.I.D.A.F.: Niet-naleving van algemene principes voor gegevensverwerking. Boete van €10.000 - Griekse Autoriteit voor Gegevensbescherming (HDPA). GREECE ·HDPA ·Art. 5, 12, 13 +3 Personal Data Health Data Video Surveillance NL Jun 24, 2025
€7,000 Algemeen Ziekenhuis van de Universiteit van Larissa: Onvoldoende naleving van de rechten van betrokkenen. Een boete van €7.000 - Hellenic Data Protection Authority (HDPA). GREECE ·HDPA ·Art. 5, 14, 15 Health Data Healthcare Personal Data NL Jun 24, 2025
€4,000 Vodafone Romania S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 4,000 on Vodafone Romania S.A. The controller failed to implement sufficient technical and organisational measures to ensure data… ANSPDCP ·Art. 25 ·Insufficient technical and organisational measures to ensure information security Data Breaches Security Telecommunications Jun 23, 2025
€4,000 Vodafone Romania S.A.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 4.000 euro boete - Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ANSPDCP ·Art. 25 ·Insufficient technical and organisational measures to ensure information security Security Data Breaches Telecommunications NL Jun 23, 2025
€50,000 Piraeus Bank S.A.: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 50.000 euro - Hellenic Data Protection Authority (HDPA). GREECE ·HDPA ·Art. 5, 6 Personal Data Processing Controllers NL Jun 23, 2025
€50,000 Piraeus Bank S.A.: Insufficient legal basis for data processing The Hellenic DPA has imposed a fine of EUR 50,000 on Piraeus Bank S.A.The controller has processed personal data even though the data subject rightfully opposed the the data… GREECE ·HDPA ·Art. 5, 6 Personal Data Controllers Insurance Jun 23, 2025
€24,000 COLEGIO VIRGEN DE EUROPA, S.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van 24.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5, 6, 13 Education Personal Data Processing NL Jun 20, 2025
€42,000 IBERCAJA BANCO, S.A.: Non-compliance with general data processing principles The Spanish DPA imposed a fine of EUR 42,000 on IBERCAJA BANCO, S.A. During a bank transfer, the controller transmitted more data then necessary to the recipient of the payment.… SPAIN ·aepd ·Art. 5 Recipient Processing Agreement IP Address Jun 20, 2025
€42,000 IBERCAJA BANCO, S.A.: Overtreding van de algemene principes voor gegevensverwerking. Een boete van 42.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Recipient Processing Controllers NL Jun 20, 2025
€24,000 COLEGIO VIRGEN DE EUROPA, S.L.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 24,000 on COLEGIO VIRGEN DE EUROPA, S.L. An employee of the controller, a school, took pictures of minor pupils without a sufficient legal… SPAIN ·aepd ·Art. 5, 6, 13 Education Controllers Personal Data Jun 20, 2025
€1,000 SC Diamir SRL: Overtreding van de algemene principes voor gegevensverwerking. Een boete van €1.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 6, 58 Controllers Processing Personal Data NL Jun 19, 2025
€1,000 SC Diamir SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 1,000 on SC Diamir SRL. The controller failed to properly cooperate with the supervisory authority and also disclosed personal data to… ROMANIA ·ANSPDCP ·Art. 6, 58 Controllers Processing Agreement Supervisory Authorities Jun 19, 2025
€200 Dincă Viorel George: Insufficient cooperation with supervisory authority The Romanian DPA has imposed a fine of EUR 200 on a private individual. The controller failed to react to communication from the supervisory authority. ROMANIA ·ANSPDCP ·Art. 58 Supervisory Authorities Supervision Controllers Jun 18, 2025
€6,800 AB Storstockholms Lokaltrafik: Insufficient legal basis for data processing The Swedish DPA has imposed a fine of EUR 6,800 on AB Storstockholms Lokaltrafik. The controller, a public transportation company, requires employees operating a ferry to take a… SWEDEN ·Art. 6, 9 ·Insufficient legal basis for data processing Controllers Processing Agreement Processing Jun 18, 2025
€6,800 Waxholms Ångfartygs AB: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. 6.800 euro boete - De Zweedse Autoriteit voor Gegevensbescherming (Integritetsskyddsmyndigheten). SWEDEN ·Art. 6, 9 ·Insufficient legal basis for data processing Processing Personal Data Data Controller NL Jun 18, 2025
€6,800 Waxholms Ångfartygs AB: Insufficient legal basis for data processing The Swedish DPA has imposed a fine of EUR 6,800 on Waxholms Ångfartygs AB. The controller, a public transportation company, requires employees operating a ferry to take a… SWEDEN ·Art. 6, 9 ·Insufficient legal basis for data processing Controllers Processing Processing Agreement Jun 18, 2025
€6,800 AB Storstockholms Lokaltrafik: Onvoldoende juridische basis voor de verwerking van gegevens. 6.800 euro boete - De Zweedse Autoriteit voor Gegevensbescherming (Integritetsskyddsmyndigheten). SWEDEN ·Art. 6, 9 ·Insufficient legal basis for data processing Processing Special Categories of Data Supervisory Authorities NL Jun 18, 2025
€200 Dincă Viorel George: Onvoldoende samenwerking met de toezichthoudende instantie. Een boete van 200 euro - De Roemeense nationale toezichthouder op de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 58 Supervisory Authorities Supervision Controllers NL Jun 18, 2025
€3,000 SILVANERGIA 2022, S.L.: Onvoldoende juridische basis voor de verwerking van gegevens. Boete van 3.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Controllers Processing Data Controller NL Jun 16, 2025
€12,000 ALBOR ENERGÍA S.L.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 12,000 on ALBOR ENERGÍA S.L. The controller used third parties acting as data processors for direct marketing purposes. The organisation of… SPAIN ·aepd ·Art. 28 Controllers Processing Agreement Processors Jun 16, 2025
€12,000 ALBOR ENERGÍA S.L.: Onvoldoende juridische basis voor de verwerking van gegevens. 12.000 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 28 Processors Data Processor Processing NL Jun 16, 2025
€3,000 SILVANERGIA 2022, S.L.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 3,000 on SILVANERGIA 2022, S.L.The controller, a company providing direct marketing services, processed data of potential customers without a… SPAIN ·aepd ·Art. 6 Direct Marketing Controllers Marketing Jun 16, 2025
€10,000 Accounting Audit SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA imposed a fine of EUR 10,000 on Accounting Audit SRL. The company failed to implement sufficient technical and organizational measures, resulting in a data breach… ROMANIA ·ANSPDCP ·Art. 32 Data Breaches Security Processing Agreement Jun 12, 2025
€10,000 Accounting Audit SRL: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van €10.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Data Breaches Processing NL Jun 12, 2025
€550,000 Departement of Social Security: Insufficient legal basis for data processing The Irish DPA imposed a fine of EUR 550,000 on the Departement of Social Security. The controller uses the so called SAFE 2 registration process for anyone applying for a Public… IRELAND ·Art. 5, 6, 9 +2 ·Insufficient legal basis for data processing DPIA Privacy Impact Assessment Special Categories of Data Jun 12, 2025
€550,000 Ministerie van Sociale Zekerheid: Onvoldoende wettelijke basis voor gegevensverwerking. 550.000 euro boete - Ierse Autoriteit voor Gegevensbescherming. IRELAND ·Art. 5, 6, 9 +2 ·Insufficient legal basis for data processing Education Special Categories of Data Types of Special Categories of Personal Data NL Jun 12, 2025
€22,000 Gemeente Kristiansand: Onvoldoende juridische basis voor gegevensverwerking. 22.000 euro boete - Noorse Toezichtsautoriteit (Datatilsynet). NORWAY ·Datatilsynet ·Art. 6, 12, 13 Education Public Authority Processing NL Jun 10, 2025
€22,000 Kristiansand municipality: Insufficient legal basis for data processing The Norwegian DPA imposed a fine of EUR 22,000 on Kristiansand municipality. The controller offers a helpline for childreen, which had become victims of violence, abuse or… NORWAY ·Datatilsynet ·Art. 6, 12, 13 Public Authority Education Personal Data Jun 10, 2025
€21,000 ALVEA SOLUCIONES TECNOLÓGICAS, S.L.: Overtreding van de algemene principes voor gegevensverwerking. Een boete van 21.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Processing Controllers Data Controller NL Jun 4, 2025
€45,000 Noi Compriamo Auto.it S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 45,000 on Noi Compriamo Auto.it S.r.l. The controller contacted the data subject multiple times for direct marketing purposes via… ITALY ·Garante ·Art. 5, 6, 12 +2 Direct Marketing IP Address Marketing Jun 4, 2025
€21,000 ALVEA SOLUCIONES TECNOLÓGICAS, S.L.: Non-compliance with general data processing principles The Spanish DPA imposed a fine of EUR 21,000 on ALVEA SOLUCIONES TECNOLÓGICAS, S.L. The controller processed job applicants' data using publicly accessible Google Forms. The… SPAIN ·aepd ·Art. 5 Controllers IP Address Processing Agreement Jun 4, 2025
€45,000 Noi Compriamo Auto.it S.r.l.: Niet-naleving van de algemene principes voor gegevensverwerking. Een boete van 45.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 12 +2 Processing Marketing Personal Data NL Jun 4, 2025
€5,000 AG-BROKER ASIGURARE S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on AG-BROKER ASIGURARE S.R.L. The controller did not implement sufficient technical and organisational measures to ensure… ROMANIA ·ANSPDCP ·Art. 32 Data Breaches Security Insurance May 30, 2025
€42,000 LVMH IBERIA, S.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van 42.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Processing Personal Data Data Controller NL May 30, 2025
€42,000 LVMH IBERIA, S.L.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 42,000 on LVMH IBERIA, S.L. The controller added the private phone number of an employee to an workrelated WhatApp group without a legal… SPAIN ·aepd ·Art. 6 Controllers Employees Processing Agreement May 30, 2025
€5,000 AG-BROKER ASIGURARE S.R.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van €5.000 - De Roemeense nationale toezichthouder op de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Data Breaches Controllers NL May 30, 2025
€1.1M Universiteitsapotheek: Niet-naleving van algemene principes voor gegevensverwerking. 1.100.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 32 Health Data Processing Controllers NL May 27, 2025
€1.1M Yliopiston Apteekin: Non-compliance with general data processing principles The Finish DPA has imposed a fine of EUR 1,100,000 on Yliopiston Apteekin. The controller, who runs an online pharmacy, used various web analytics and monitoring tools. These… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 32 Audit Logs Controllers IP Address May 27, 2025
€1,000 MP Dumitru Viorel Focșa: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on the MP Dumitru Viorel Focșa. The controller published a post on social media containing personal data of a third person. The… ROMANIA ·ANSPDCP ·Art. 5, 6 Social Media Controllers Personal Data May 22, 2025
€1,200 Advocaat: Er is onvoldoende juridische basis voor de verwerking van gegevens. 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Data Controller Controllers Processing NL May 22, 2025
€1,000 MP Dumitru Viorel Focșa: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van €1.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 5, 6 Education Data Controller Personal Data NL May 22, 2025
€1,200 Attorney: Insufficient legal basis for data processing The Spanish DPA imposed a fine on an attorney. The controller processed data of a data subject without sufficient legal basis. The original fine of EUR 2,000 was reduced to EUR… SPAIN ·aepd ·Art. 6 Controllers Insurance Personal Data May 22, 2025
€420,000 Autostrade per l’Italia S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 420,000 on Autostrade per l’Italia S.p.A. The controller used data from a worker's social media profiles obtained by other workers and a… ITALY ·Garante ·Art. 5, 6, 88 Social Media Controllers IP Address May 21, 2025
€12,000 Data Diggers Market Research SRL: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van €12.000 - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 6, 12, 14 +1 Personal Data Data Controller Processing NL May 21, 2025
€21,000 Menarini Silicon Biosystems SpA: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 21,000 on Menarini Silicon Biosystems SpA. The controller is conducting oncological research and has developed a software that is able to… ITALY ·Garante ·Art. 5, 13 Healthcare Health Data Retention Period May 21, 2025
€21,000 Menarini Silicon Biosystems SpA: Niet-naleving van de algemene principes voor gegevensverwerking. 21.000 euro boete - Italiaanse Autoriteit voor de bescherming van persoonlijke gegevens (Garante). ITALY ·Garante ·Art. 5, 13 Health Data Healthcare Healthcare NL May 21, 2025