Content type · 3,651 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
701–750 of 3,651 sort newestlargest fineoldest
€540 CUBILLO GALLEGO, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA imposed a fine of EUR 540 on CUBILLO GALLEGO, S.L. The controller failed to comply with an order issued by the DPA, as well as failing to react adequately to… SPAIN ·aepd ·Art. 58 Supervisory Authorities Supervision Law Enforcement Jun 13, 2025
€540 CUBILLO GALLEGO, S.L.: Onvoldoende samenwerking met de toezichthoudende instantie. Een boete van 540 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 58 Controllers Supervisory Authorities Data Controller NL Jun 13, 2025
€18,000 OCI CINE, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA imposed a fine of EUR 18,000 on OCI CINE, S.L. The controller had implemented insufficient technical and organisational measures to ensure data security, resulting… SPAIN ·aepd ·Art. 5, 32 Security Controllers Processing Agreement Jun 13, 2025
€550,000 Departement of Social Security: Insufficient legal basis for data processing The Irish DPA imposed a fine of EUR 550,000 on the Departement of Social Security. The controller uses the so called SAFE 2 registration process for anyone applying for a Public… IRELAND ·Art. 5, 6, 9 +2 ·Insufficient legal basis for data processing DPIA Privacy Impact Assessment Biometric Data Jun 12, 2025
€10,000 Accounting Audit SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA imposed a fine of EUR 10,000 on Accounting Audit SRL. The company failed to implement sufficient technical and organizational measures, resulting in a data breach… ROMANIA ·ANSPDCP ·Art. 32 Data Breaches Security Processing Agreement Jun 12, 2025
€550,000 Ministerie van Sociale Zekerheid: Onvoldoende wettelijke basis voor gegevensverwerking. 550.000 euro boete - Ierse Autoriteit voor Gegevensbescherming. IRELAND ·Art. 5, 6, 9 +2 ·Insufficient legal basis for data processing Special Categories of Data Education Types of Special Categories of Personal Data NL Jun 12, 2025
€10,000 Accounting Audit SRL: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van €10.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Data Breaches Processing NL Jun 12, 2025
€22,000 Gemeente Kristiansand: Onvoldoende juridische basis voor gegevensverwerking. 22.000 euro boete - Noorse Toezichtsautoriteit (Datatilsynet). NORWAY ·Datatilsynet ·Art. 6, 12, 13 Education Processing Public Authority NL Jun 10, 2025
€22,000 Kristiansand municipality: Insufficient legal basis for data processing The Norwegian DPA imposed a fine of EUR 22,000 on Kristiansand municipality. The controller offers a helpline for childreen, which had become victims of violence, abuse or… NORWAY ·Datatilsynet ·Art. 6, 12, 13 Public Authority IP Address Personal Data Jun 10, 2025
€2.7M 23andMe, Inc.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 2.700.000 euro - Informatiecommissaris (ICO). UNITED KINGDOM ·ICO ·Art. 5, 32 Security Data Breaches Health Data NL Jun 5, 2025
€2.7M 23andMe, Inc.: Insufficient technical and organisational measures to ensure information security The UK DPA imposed a fine of £ 2,310,000 (EUR 2,700,000) on 23andMe, Inc. The controller, a company offering DNA testing to private individuals, failed to implement sufficient… UNITED KINGDOM ·ICO ·Art. 5, 32 Data Breaches Security Genetic Data Jun 5, 2025
€21,000 ALVEA SOLUCIONES TECNOLÓGICAS, S.L.: Non-compliance with general data processing principles The Spanish DPA imposed a fine of EUR 21,000 on ALVEA SOLUCIONES TECNOLÓGICAS, S.L. The controller processed job applicants' data using publicly accessible Google Forms. The… SPAIN ·aepd ·Art. 5 Controllers IP Address Processing Agreement Jun 4, 2025
€45,000 Noi Compriamo Auto.it S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 45,000 on Noi Compriamo Auto.it S.r.l. The controller contacted the data subject multiple times for direct marketing purposes via… ITALY ·Garante ·Art. 5, 6, 12 +2 Direct Marketing IP Address Marketing Jun 4, 2025
€21,000 ALVEA SOLUCIONES TECNOLÓGICAS, S.L.: Overtreding van de algemene principes voor gegevensverwerking. Een boete van 21.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Processing Data Controller Controllers NL Jun 4, 2025
€45,000 Noi Compriamo Auto.it S.r.l.: Niet-naleving van de algemene principes voor gegevensverwerking. Een boete van 45.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 12 +2 Personal Data Data Controller Processing NL Jun 4, 2025
€16,000 Parkeerbeheerbedrijf: Onvoldoende samenwerking met de toezichthoudende instantie. 16.000 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA ·dsb ·Art. 31 Supervision Supervisory Authorities NL Jun 3, 2025
€16,000 Car Park Management Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine in the amount of EUR 16,000 on a car park management company. The controller failed to react to communication from the supervisory authority. AUSTRIA ·dsb ·Art. 31 Supervisory Authorities Supervision Law Enforcement Jun 3, 2025
€42,000 LVMH IBERIA, S.L.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 42,000 on LVMH IBERIA, S.L. The controller added the private phone number of an employee to an workrelated WhatApp group without a legal… SPAIN ·aepd ·Art. 6 Controllers Employees Processing Agreement May 30, 2025
€5,000 AG-BROKER ASIGURARE S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on AG-BROKER ASIGURARE S.R.L. The controller did not implement sufficient technical and organisational measures to ensure… ROMANIA ·ANSPDCP ·Art. 32 Data Breaches Security Insurance May 30, 2025
€42,000 LVMH IBERIA, S.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. Een boete van 42.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Personal Data Processing Data Controller NL May 30, 2025
€5,000 AG-BROKER ASIGURARE S.R.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van €5.000 - De Roemeense nationale toezichthouder op de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Data Breaches Controllers NL May 30, 2025
€1.1M Yliopiston Apteekin: Non-compliance with general data processing principles The Finish DPA has imposed a fine of EUR 1,100,000 on Yliopiston Apteekin. The controller, who runs an online pharmacy, used various web analytics and monitoring tools. These… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 32 Audit Logs IP Address Controllers May 27, 2025
€1.1M Universiteitsapotheek: Niet-naleving van algemene principes voor gegevensverwerking. 1.100.000 euro boete - Waarnemend ombudsman gegevensbescherming. FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 32 Health Data Processing Audit Logs NL May 27, 2025
€1.4M REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA imposed a fine of EUR 1,380,000 on REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L. The controller used outdated technical and organisational measures to manage… SPAIN ·aepd ·Art. 5, 32 Controllers Processing Agreement Security May 26, 2025
€1.4M REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. 1.380.000 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5, 32 Security Controllers Data Controller NL May 26, 2025
€60,000 AIRE NETWORKS DEL MEDITERRÁNEO, S.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 60.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Security Telecommunications Data Breaches NL May 23, 2025
€60,000 AIRE NETWORKS DEL MEDITERRÃNEO, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA imposed a fine of EUR 60,000 on AIRE NETWORKS DEL MEDITERRÃNEO, S.L. The controller did not implement sufficient technical and organisational measures to ensure… SPAIN ·aepd ·Art. 5 Data Breaches Security Telecommunications May 23, 2025
€1,200 Attorney: Insufficient legal basis for data processing The Spanish DPA imposed a fine on an attorney. The controller processed data of a data subject without sufficient legal basis. The original fine of EUR 2,000 was reduced to EUR… SPAIN ·aepd ·Art. 6 Controllers Insurance Personal Data May 22, 2025
€1,000 MP Dumitru Viorel Focșa: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on the MP Dumitru Viorel Focșa. The controller published a post on social media containing personal data of a third person. The… ROMANIA ·ANSPDCP ·Art. 5, 6 Social Media Personal Data Controllers May 22, 2025
€1,000 MP Dumitru Viorel Focșa: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van €1.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 5, 6 Education Data Controller Processing NL May 22, 2025
€1,200 Advocaat: Er is onvoldoende juridische basis voor de verwerking van gegevens. 1.200 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Processing Controllers Data Controller NL May 22, 2025
€7,000 Health Protection Agency of the Metropolitan City of Milan, Workplace Prevention and Safety Service, Milan North: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 7,000 on Health Protection Agency of the Metropolitan City of Milan, Workplace Prevention and Safety Service, Milan North. The controller… ITALY ·Garante ·Art. 5, 9 Health Data Healthcare Personal Data May 21, 2025
€200,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 200,000 on TELEFÓNICA MÓVILES ESPAÑA, S.A. The controller forwarded personal data to a third party without a sufficient legal basis. SPAIN ·aepd ·Art. 6 Processing Agreement Controllers Personal Data May 21, 2025
€420,000 Autostrade per l'Italia S.p.A.: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 420.000 euro - opgelegd door de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 6, 88 Processing Data Controller Controllers NL May 21, 2025
€420,000 Autostrade per l’Italia S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 420,000 on Autostrade per l’Italia S.p.A. The controller used data from a worker's social media profiles obtained by other workers and a… ITALY ·Garante ·Art. 5, 6, 88 Social Media Controllers IP Address May 21, 2025
€21,000 Menarini Silicon Biosystems SpA: Niet-naleving van de algemene principes voor gegevensverwerking. 21.000 euro boete - Italiaanse Autoriteit voor de bescherming van persoonlijke gegevens (Garante). ITALY ·Garante ·Art. 5, 13 Health Data Healthcare Healthcare NL May 21, 2025
€12,000 Data Diggers Market Research SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 12,000 on Data Diggers Market Research SRL. The controller processed personal data without sufficient legal basis. The controller also… ROMANIA ·ANSPDCP ·Art. 6, 12, 14 +1 Controllers Personal Data IP Address May 21, 2025
€7,000 Gezondheidsbeschermingsagentschap van de Metropool van Milaan, Dienst Preventie en Veiligheid op de Werkplek, Noord-Milaan: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 7.000 euro - van de Italiaanse Autoriteit voor Gegevensbescherming (Garante). ITALY ·Garante ·Art. 5, 9 Health Data Healthcare Education NL May 21, 2025
€200,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.: Onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 200.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6 Processing Data Controller Personal Data NL May 21, 2025
€21,000 Menarini Silicon Biosystems SpA: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 21,000 on Menarini Silicon Biosystems SpA. The controller is conducting oncological research and has developed a software that is able to… ITALY ·Garante ·Art. 5, 13 Health Data Retention Period Healthcare May 21, 2025
€12,000 Data Diggers Market Research SRL: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van €12.000 - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 6, 12, 14 +1 Data Controller Processing Personal Data NL May 21, 2025
€360 SPANSE REGISTERSYSTEEM VOOR HUISDIEREN: Onvoldoende samenwerking met de toezichthoudende instantie. Een boete van 360 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 58 Supervisory Authorities Controllers Data Controller NL May 20, 2025
€360 RED ESPAÑOLA DE IDENTIFICACIÓN DE ANIMALES DE COMPAÑÍA: Insufficient cooperation with supervisory authority The Spanish DPA imposed a fine of EUR 360 on RED ESPAÑOLA DE IDENTIFICACIÓN DE ANIMALES DE COMPAÑÍA. The controller failed to react to communication from the supervisory authority. SPAIN ·aepd ·Art. 58 Supervisory Authorities Supervision Law Enforcement May 20, 2025
€5,000 Maravet S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Maravet S.R.L. The controller did not implement sufficient technical and organisational measures to ensure information… ROMANIA ·ANSPDCP ·Art. 32 Data Breaches Security Healthcare May 19, 2025
€1,000 Home Owner Association: Non-compliance with general data processing principles The Spanish DPA imposed a fine of EUR 1,000 on a home owner association. The HOA displayed the personal data of debtors in the entrance hall of a building, which infringed on the… SPAIN ·aepd ·Art. 5 Professional Secrecy Integrity and Confidentiality Principle Personal Data May 19, 2025
€1,000 Vereniging van Eigenaren: Niet-naleving van de algemene principes voor gegevensverwerking. Boete van €1.000 - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Professional Secrecy Processing Supervisory Authorities NL May 19, 2025
€200,000 ASNEF-EQUifax, een bedrijf dat informatie verstrekt over kredietwaardigheid, heeft onvoldoende juridische basis voor de verwerking van gegevens. Een boete van 200.000 euro - opgelegd door de Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 6, 17 Personal Data Data Controller Processing NL May 19, 2025
€200,000 ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 200,000 on ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L. The controller obtained personal data from a third party… SPAIN ·aepd ·Art. 6, 17 Controllers Insurance Personal Data May 19, 2025
€5,000 Maravet S.R.L.: Onvoldoende technische en organisatorische maatregelen om de informatiebeveiliging te waarborgen. Een boete van 5.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP). ROMANIA ·ANSPDCP ·Art. 32 Security Data Breaches Health Data NL May 19, 2025
€30,000 ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.: Niet-naleving van de algemene principes voor gegevensverwerking. Boete van 30.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD). SPAIN ·aepd ·Art. 5 Processing Controllers Data Controller NL May 16, 2025