Content type · 2,273 documents in this view · 3,651 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
701–750 of 2,273 sort newestlargest fineoldest
€18,000 Toyota Bank Polska S.A.: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined Toyota Bank Polska S.A. EUR 18,000 for failing to report a data breach to the DPA in a timely manner. POLAND ·UODO ·Art. 33 Notification Obligation Data Breaches Notified Body Reporting and Notification Obligations Mar 12, 2024
€326,000 Santander Bank Polska S.A.: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined Santander Bank Polska S.A. EUR 326,000 for failing to report a data breach to the DPA and data subjects in a timely manner. POLAND ·UODO ·Art. 33, 34 Notification Obligation Data Breaches Notified Body Reporting and Notification Obligations Mar 12, 2024
EDPS finds Commission infringed purpose limitation and data transfer rules in Microsoft Following an investigation in 2019-2020, the EDPS issued recommendations and the Commission modified the ILA. The EDPS investigated whether these modifications were sufficient to… 2021-0518 ·European Union ·Art. 5, 6, 28 +1 Privacy Shield Controllers International Transfer Mar 8, 2024
€20,000 Centro Riparazioni Piacentino S.p.A.: Non-compliance with general data processing principles The Italian DPA (Garante) imposed a fine of EUR 20,000 on Centro Riparazioni Piacentino S.p.A.. The controller had kept a former employee's email account active despite the… ITALY ·Garante ·Art. 5, 13 Controllers Personal Data IP Address Mar 7, 2024
€2,000 Bar: Non-compliance with general data processing principles The Italian DPA has fined the owner of a bar EUR 2,000. The controller had operated video surveillance cameras in one of their premises without the required authorization.… ITALY ·Garante ·Art. 5, 13, 114 Video Surveillance Controllers IP Address Mar 7, 2024
€20,000 Banca di Credito Cooperativo Appulo Lucana soc. cooperativa: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 20,000 on Banca di Credito Cooperativo Appulo Lucana soc. cooperativa. A former employee had requested access to the personal data in… ITALY ·Garante ·Art. 12, 15 Personal Data Human Resources Controllers Mar 7, 2024
€5,000 EURO MINI STORAGE ROMANIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of 5,000 euros on EURO MINI STORAGE ROMANIA SRL. The controller had suffered a data breach in which customer data was accessed without… ANSPDCP ·Art. 24, 32 ·Insufficient technical and organisational measures to ensure information security Data Breaches Security Controllers Mar 5, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN ·aepd ·Art. 6 Personal Data Processing Agreement Telecommunications Mar 1, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN ·aepd ·Art. 6 Personal Data Consent Processing Agreement Feb 29, 2024
€3M Hellenic Post (ΕΛΛΗΝΙΚΑ ΤΑΧΥΔΡΟΜΕΙΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ): Insufficient technical and organisational measures to ensure information security The Hellenic DPA has imposed a fine of EUR 2,995,140 on the Hellenic Post (ΕΛΛΗΝΙΚΑ ΤΑΧΥΔΡΟΜΕΙΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ). The controller had suffered a data breach which resulted in… GREECE ·HDPA ·Art. 5, 32 Data Breaches Security Privacy by Design & Default Feb 28, 2024
€3,000 VESTA CEU ROMÂNIA SRL.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on VESTA CEU ROMÂNIA SRL. The controller had reported a data breach to the DPA pursuant to Art. 33 GDPR. The controller had… ROMANIA ·ANSPDCP ·Art. 32 Data Breaches Security Controllers Feb 26, 2024
€2,000 Camera di Commercio Industria Artigianato e Agricoltura: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Camera di Commercio Industria Artigianato e Agricoltura. An individual had filed a complaint against the controller with the DPA… ITALY ·Garante ·Art. 2, 5, 6 Personal Data Controllers Education Feb 22, 2024
€4,000 ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.. A data subject had filed a complaint against the controller with the… SPAIN ·aepd ·Art. 15 Personal Data Controllers Insurance Feb 13, 2024
€100,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 100,000 on VODAFONE ESPAÑA, S.A.U. for insufficient legal basis for data processing. The data subject had filed a complaint against the… SPAIN ·aepd ·Art. 6 Controllers Processing Agreement Personal Data Feb 13, 2024
€40,000 IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA. A data subject had filed a complaint against the controller with the DPA due to the… SPAIN ·aepd ·Art. 15 Personal Data Controllers Processing Agreement Feb 13, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN ·aepd ·Art. 6 Personal Data Consent Processing Agreement Feb 8, 2024
€2.8M UniCredit S.p.a.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 2.8 million on UniCredit S.p.a.. The bank had suffered a cyberattack on its mobile banking portal, during which the attackers gained… ITALY ·Garante ·Art. 5, 32 Security Insurance Controllers Feb 8, 2024
€2,000 Brivio Limited: Insufficient fulfilment of data subjects rights The Cypriot DPA has imposed a fine of EUR 2,000 on Brivio Limited for failing to respond to a request for information in a timely manner. CYPRUS ·Art. 12 ·Insufficient fulfilment of data subjects rights Personal Data Supervisory Authorities Processing Agreement Feb 8, 2024
€18,000 Azienda socio-sanitaria locale n. 1 di Sassari: Insufficient technical and organisational measures to ensure information security Ist das gut: The Italian DPA has imposed a fine of EUR 18,000 on Azienda socio-sanitaria locale n. 1 di Sassari. The controller had mistakenly sent an e-mail containing health… ITALY ·Garante ·Art. 5, 9, 32 Healthcare Health Data Recipient Feb 8, 2024
€1,500 Aylo Social LTD: Insufficient fulfilment of data subjects rights The Cypriot DPA has imposed a fine of EUR 1,500 on Aylo Social LTD for failing to comply with a deletion request. CYPRUS ·Art. 17 ·Insufficient fulfilment of data subjects rights Personal Data Processing Agreement Supervisory Authorities Feb 8, 2024
€300,000 Medtronic Italia: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 300,000 on Medtronic Italia. The controller had sent emails in an open distribution list to hundreds of individuals using the… ITALY ·Garante ·Art. 5, 9, 12 +2 Healthcare IP Address Personal Data Feb 8, 2024
€2,000 Account Exchange SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 2,000 on Account Exchange SRL for using personal data without the consent of the data subjects. ROMANIA ·ANSPDCP ·Art. 5, 6 Personal Data Insurance Processing Agreement Feb 7, 2024
€5,000 Wi-Planet sas di Torri Carlo Alberto e c.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 5,000 on Wi-Planet sas di Torri Carlo Alberto e c.. A data subject had filed a complaint with the DPA due to the controller's failure to… ITALY ·Garante ·Art. 12, 15 Personal Data Controllers Telecommunications Feb 7, 2024
€5M ENERGYA VM GESTIÓN DE ENERGÍA, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined ENERGYA VM GESTIÓN DE ENERGÍA, S.L. EUR 5 million following an investigation into unlawful personal data processing by Nivalco, a company… SPAIN ·aepd ·Art. 5 Controllers IP Address Processing Feb 6, 2024
€3.5M I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3.5 million on I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U. The controller had suffered a cyber attack on its GEA web application resulting… SPAIN ·aepd ·Art. 5, 32 Security IP Address Controllers Feb 5, 2024
€500 Owners' association: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 500 on an owners' association for publishing personal data of an individual in a WhatsApp group without a valid legal basis and for… ROMANIA ·ANSPDCP ·Art. 5, 6, 12 Personal Data Data Subject Rights Exercise Modalities and Procedures IP Address Feb 5, 2024
€5,000 Dentist: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5,000 on a dentist due to a lack of data security and a failure to respect the right of access of a data subject. FRANCE ·CNIL ·Insufficient fulfilment of data subjects rights Right of Access Procedures Right of Access Healthcare Jan 31, 2024
€2,000 Sectorul 1 al Municipiului București: Insufficient cooperation with supervisory authority The Romanian DPA has fined Sectorul 1 al Municipiului București EUR 2,000 for failing to provide information requested by the DPA during an investigation. ROMANIA ·ANSPDCP ·Art. 58 Supervisory Authorities Supervision Public Sector Jan 30, 2024
€2,000 Istituto Comprensivo Statale “F.S. Cabrini: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Istituto Comprensivo Statale “F.S. Cabrini. The controller had published a document, which contained personal data of school… ITALY ·Garante ·Art. 2, 5, 6 Education Personal Data Controllers Jan 24, 2024
€7,500 ROUNDED TECHNOLOGIES, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 7,500 on ROUNDED TECHNOLOGIES, S.L. The company continued to send a customer a newsletter by e-mail, although they had previously… SPAIN ·aepd ·Art. 21 Personal Data Processing Agreement Supervisory Authorities Jan 23, 2024
€200,000 ORANGE ESPAGNE S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Orange Espagne S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card… SPAIN ·aepd ·Art. 6 Personal Data Processing Agreement Telecommunications Jan 23, 2024
€2,300 POLAND DPA: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined a data controller EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. UODO ·Art. 33, 34 ·Insufficient fulfilment of data breach notification obligations Notification Obligation Data Breaches Article 19 GDPR - Notification of Rectification, Erasure or Restriction Jan 18, 2024
€273,000 Centrum Medyczne Ujastek Sp. z o.o.: Non-compliance with general data processing principles The Polish DPA has imposed two fines on the medical facility “Centrum Medyczne Ujastek” totaling approximately EUR 273,000. The first fine of approximately EUR 163,000 was imposed… POLAND ·UODO ·Art. 5, 6, 9 +3 Encryption Healthcare Healthcare Jan 17, 2024
€174,640 Black Tiger Belgium: Insufficient fulfilment of information obligations The Belgian DPA has imposed a fine of EUR 174,640 on Black Tiger Belgium. An individual had filed a complaint with the DPA due to the controller's failure to properly comply with… APD ·Art. 5, 6, 12 +5 ·Insufficient fulfilment of information obligations Storage Limitation Right of Access Right of Access Procedures Jan 16, 2024
€150,000 International Card Services B.V.: Insufficient technical and organisational measures to ensure information security The Dutch DPA has imposed a fine of EUR 150,000 on International Card Services B.V. (ICS). ICS failed to carry out a data protection impact assessment before starting the digital… THE NETHERLANDS ·AP ·Art. 35 DPIA Privacy Impact Assessment Security Jan 15, 2024
€3,000 TECHNINK LEB SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on TECHNINK LEB SRL. The controller had suffered a data breach in which personal customer data had been unlawfully disclosed.… ROMANIA ·ANSPDCP ·Art. 32 Data Breaches Security Privacy by Design & Default Jan 15, 2024
€5,000 Attorney: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5000 on an attorney. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of a request of erasure of… FRANCE ·CNIL ·Insufficient fulfilment of data subjects rights Right to be Forgotten Personal Data Supervisory Authorities Jan 15, 2024
€17,000 Alior Bank SA: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 17,000 on Alior Bank SA. The investigation was initiated following complaints that the bank continued to send unsolicited electronic… ROMANIA ·ANSPDCP ·Art. 5, 6 IP Address Processing Agreement Personal Data Jan 12, 2024
€1,500 Website operator: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 1,500 on a website operator. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of data subject… FRANCE ·CNIL ·Insufficient fulfilment of data subjects rights Personal Data Data Subject Rights Exercise Modalities and Procedures Supervisory Authorities Jan 9, 2024
€10,000 Website operator: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine in the amount of EUR 11,000 on a website operator. An individual had filed a complaint with the DPA because the controller had failed to comply… AUSTRIA ·dsb ·Art. 17, 25, 58 Personal Data Controllers Processing Agreement Jan 4, 2024
€12,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has imposed a fine of EUR 12,000 on a company providing vehicle history check services. The controller refused a data subject's request to rectify personal data… LITHUANIA ·VDAI ·Art. 5, 15, 16 Accuracy Personal Data Controllers Jan 1, 2024
€41 GERMANY DPA: €41 fine The DPA of Hessen has imposed fines totaling EUR 13,486 on 41 data controllers. In its 2024 activity report, the DPA of Hesse reported a total of 47 fines that year. Six of these… Unknown Fines Supervisory Authorities Processing Agreement Jan 1, 2024
€6.5M THE PHONE HOUSE SPAIN, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 6.5 million on THE PHONE HOUSE SPAIN, S.L. The controller had suffered a ransomware attack affecting personal data of 13 million… aepd ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Security Telecommunications Controllers Dec 27, 2023
Candidate for parliamentary elections: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine on a candidate for parliamentary elections. The candidate had sent the data subject election advertising by email despite the data subject's… FRANCE ·CNIL ·Art. 21 Right to Object Direct Marketing Personal Data Dec 22, 2023
€4,300 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,400 for failing to provide information requested by the DPA during an investigation. UODO ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Supervisory Authorities Supervision Controllers Dec 21, 2023
€2,000 Company: Insufficient fulfilment of information obligations The Italian DPA has fined a company s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… ITALY ·Garante ·Art. 5, 13 Video Surveillance Monitoring Controllers Dec 21, 2023
€23,000 Polish Minister of Health: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 23,000 on the Polish Minister of Health. The controller had accessed information via a database relating to a physician who had prescribed… POLAND ·UODO ·Art. 25, 32, 34 Healthcare Security Controllers Dec 20, 2023
€2,300 District Court Krakow: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined the District Court in Krakow EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. POLAND ·UODO ·Art. 33, 34 Notification Obligation Data Breaches Notified Body Reporting and Notification Obligations Dec 19, 2023
€200 Private individual: Insufficient cooperation with supervisory authority The Romanian DPA has fined a private individual EUR 200 for failing to provide information requested by the DPA during an investigation. ROMANIA ·ANSPDCP ·Art. 58 Supervisory Authorities Supervision Personal Data Dec 15, 2023
€400,000 UK Ministry of Defense: Insufficient technical and organisational measures to ensure information security The UK DPA has fined the Ministry of Defense EUR 400,000 for disclosing personal data of individuals who were to be relocated to the UK after the Taliban took control of… UNITED KINGDOM ·ICO ·Insufficient technical and organisational measures to ensure information security Personal Data Security IP Address Dec 13, 2023