Content type · 1,282 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 22, 2022
€900 UNONO NET 3.0, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on UNONO NET 3.0, S.L.. The company had forwarded an email to numerous recipients without using the blind copy function, making it possible for… SPAIN · ·Art. 5, 32 Aug 22, 2022
€600,000 ACCOR SA: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has imposed a fine of EUR 600,000 on ACCOR SA. Both CNIL and other European DPAS had received complaints against ACCOR from several individuals. In the… FRANCE · ·Art. 12, 13, 15 +2 Aug 19, 2022
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 180 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Aug 12, 2022
€6,700 Lolland municipiality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 6,700 on Lolland municipiality. The municipality had reported a data breach to the DPA in accordance with Art. 33 GDPR. One of the… DENMARK · ·Art. 32 Aug 11, 2022
€197,000 AMPLIFON Hungary Trade and Service Provider LLC: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 197,000 on AMPLIFON Hungary Trade and Service Provider LLC. The DPA had received complaints from several data subjects for having… ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Aug 11, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 8, 2022
€600 Restaurant owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a restaurant owner. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 8, 2022
€5,000 IDIKA SA: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on IDIKA SA. IDIKA was operating in the context of providing free COVID-19 tests. The DPA found that IDIKA, in the course of its… GREECE · ·Art. 5, 25 Aug 8, 2022
€735 Company: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 735 on a company. An individual had filed a complaint against the company with the DPA. An employee of the company had made sound… HUNGARY · ·Art. 5, 6, 13 Aug 8, 2022
€20,000 Cosmopol Security S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Cosmopol Security S.p.A. EUR 20,000. An individual had filed a complaint with the DPA against the controller. The individual had received invoices… ITALY · ·Art. 12, 15 Aug 5, 2022
€2,000 JAÉN SENTIDO Y COMÚN: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 2,000 on JAÉN SENTIDO Y COMÚN. The controller had sent an e-mail to 241 people in an open distribution list, making the email addresses… SPAIN · ·Art. 5, 32 Aug 4, 2022
€30,000 Private Polyclinic and Diagnostic Centre of Pyle Axiou: Non-compliance with general data processing principles The Hellenic DPA has fined Private Polyclinic and Diagnostic Centre of Pyle Axiou EUR 30,000. A patient had requested access to data from an imaging examination. Due to lack of… GREECE · ·Art. 5 Aug 3, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 3, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 1, 2022
€9,600 LAST LAP, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on LAST LAP, S.L.. Last Lap organizes the San Silvestre road running race. Race participants were required to show their vaccination certificate… SPAIN · ·Art. 6, 9 Aug 1, 2022
€26,000 Policoro municipality: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 26,000 on Policoro municipality. The municipality had installed a video surveillance system without, however, providing sufficient… ITALY · ·Art. 5, 12, 13 +2 Aug 1, 2022
€2,000 Auto Hi-Fi System S.n.c: Non-compliance with general data processing principles The Italian DPA has fined Auto Hi-Fi System S.n.c in the amount of EUR 2,000. The controller had installed a video surveillance system that covered not only the public road but… ITALY · ·Art. 5, 13 Jul 28, 2022
€300 Private Person: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour and the public space. SPAIN · ·Art. 5 Jul 27, 2022
APD/GBA (Belgium) - 117/2022 The data subject was a former customer of the controller (which remained unknown). The data subject received direct marketing from the controller. The data subject objected to the… 117/2022 ·Art. 6, 12, 15 +1 Jul 26, 2022
€800 EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L. EUR 800. A trade union had filed a complaint with the DPA because the company had unauthorizedly shared… SPAIN · ·Art. 5 Jul 26, 2022
€2,500 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA has fined a homeowners association EUR 2,500 for publishing information (name, surname, apartments) regarding several owners on their website. SPAIN · ·Art. 5 Jul 26, 2022
€10,000 Company: Non-compliance with general data processing principles The DPA of Luxembourg (CNPD) has imposed a fine of EUR 10,000 on a company. The company had installed a video surveillance system for the purpose of protecting company property… LUXEMBOURG · ·Art. 5, 13 Jul 22, 2022
€4,000 Car dealership: Insufficient fulfilment of information obligations The Croatian DPA has fined a car dealership EUR 4,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… CROATIA · ·Art. 27 Jul 21, 2022
€20,000 Acqua Novara.VCO S.p.a.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 20,000 on Acqua Novara.VCO S.p.a.. The fine is related to the fine against Clio S.r.l.. Clio provides and manages a whistleblowing… ITALY · ·Art. 2, 5, 6 +1 Jul 21, 2022
€5,000 Ginosa municipality: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Ginosa municipality. The fine is related to the fine against Clio S.r.l.. Clio provides and manages a whistleblowing reporting… ITALY · ·Art. 2, 5, 6 +1 Jul 21, 2022
€10,000 Clio S.r.l.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 10,000 on Clio S.r.l.. Clio provides and manages a whistleblowing reporting application for various private and public entities. As part… ITALY · ·Art. 2, 5, 6 +1 Jul 21, 2022
€10,000 Stay over s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Stay Over s.r.l. EUR 10,000. A former employee had filed a complaint with the DPA. The company had failed to respond to a request for access to personal… ITALY · ·Art. 5, 12, 13 +2 Jul 21, 2022
€2,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 2,000 euros on a private individual. The individual had installed video cameras in the apartment building where they live that recorded,… SPAIN · ·Art. 5 Jul 19, 2022
€5,000 Bar owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a bar owner EUR 5,000. The owner had unlawfully shared recordings from the CCTV in the bar via WhatsApp and other social media platforms. SPAIN · ·Art. 5 Jul 19, 2022
€4,000 Bookstore employee: Insufficient technical and organisational measures to ensure information security The Spanish Data Protection Agency has imposed a fine of EUR 4,000 on an employee of a bookstore. An individual had filed a complaint with the DPA because he had received an… SPAIN · ·Art. 5, 32 Jul 19, 2022
€56,000 BANKINTER, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 56,000 on BANKINTER, S.A.. The controller had inadvertently sent a report on the data subject's investment portfolio to a third party.… SPAIN · ·Art. 5 Jul 18, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jul 15, 2022
€202,000 Manx Care Ltd: Non-compliance with general data processing principles The DPA of Isle of Man has imposed a fine of EUR 202,000 on Manx Care Ltd. Manx Care had emailed an unsecured attachment containing a patient's confidential health information to… ISLE OF MAN ·Art. 5, 24, 25 +3 ·Non-compliance with general data processing principles Jul 13, 2022
€132,000 DKV Seguros y Reaseguros, S.A.E.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on DKV Seguros y Reaseguros, S.A.E.. An individual had filed a complaint with the DPA after receiving multiple e-mails from the controller… SPAIN · ·Art. 5, 32, 33 Jul 13, 2022
€20M Clearview Al Inc.: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 20,000,000 on Clearview AI Inc. The non-profit organization 'Homos Digitalis' had filed a complaint with the DPA on behalf of the data… Jul 13, 2022
€1,600 JOYPAZAR, S.A.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of 1,600 on JOYPAZAR, S.A.. The company had installed video surveillance cameras which, among other things, also covered a public… SPAIN · ·Art. 5 Jul 12, 2022
€800 SMART ELECTRIC SOLUTIONS, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 800 on SMART ELECTRIC SOLUTIONS, S.L.. The company had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5, 13 Jul 12, 2022
€175,000 UBEEQO INTERNATIONAL: Non-compliance with general data processing principles The French DPA (CNIL) has fined the company UBEEQO INTERNATIONAL EUR 175,000. The vehicle rental company had collected geolocation data on rented vehicles at every 500 meters. The… FRANCE · ·Art. 5, 12 Jul 7, 2022
€20,000 Intesa Sanpaolo Vita S.p.a.: Non-compliance with general data processing principles The Italian DPA has fined Intesa Sanpaolo Vita S.p.a. EUR 20,000. The data subject, who had taken out a life insurance policy with the controller, had filed a complaint with the… ITALY · ·Art. 5 Jul 7, 2022
€4,000 E Software Concept SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 4,000 on E Software Concept SRL. The company had uploaded certain documents on its website that were publicly accessible. Among other… ROMANIA · ·Art. 32, 58 Jul 7, 2022
Garante per la protezione dei dati personali (Italy) - 9788429 Social media platform TikTok (the controller) provided personalized advertising to its users (the data subjects) on the legal basis of consent (Article 6(1)(a) GDPR). In June… 9788429 ·Art. 5, 6, 122 Jul 7, 2022
€45,000 Senseonics Inc.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 45,000 on Senseonics Inc. The company had reported a data breach to the DPA pursuant to Art. 33 GDPR, involving an employee accidentally… ITALY · ·Art. 5, 6, 7 +4 Jul 7, 2022
€3,000 ASOCIACIÓN DE AFICIONADOS Y PEQUEÑOS ACCIONISTAS UNIDAD HERCULANA: Non-compliance with general data processing principles The Spanish DPA (AEPD) imposed a fine of EUR 3,000 on ASOCIACIÓN DE AFICIONADOS Y PEQUEÑOS ACCIONISTAS UNIDAD HERCULANA for the lack of a privacy policy on its website, in… SPAIN · ·Art. 5, 13 Jul 6, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that, unauthorized third parties had… SPAIN · ·Art. 6 Jul 6, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jul 5, 2022
€300 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300 for the unauthorized installation of a video surveillance camera on their property. The cameras recorded public space and… SPAIN · ·Art. 5 Jul 1, 2022
€500 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 500 for the unauthorized installation of a video surveillance camera on their property. The cameras recorded public space and… SPAIN · ·Art. 5 Jul 1, 2022
€1,400 Company: Non-compliance with general data processing principles The DPA of Luxembourg (CNPD) has imposed a fine of EUR 1,400 on a company. The controller had installed location sensors on a number of cars in its fleet. The purpose of this was… LUXEMBOURG · ·Art. 5, 13 Jun 30, 2022
€5,000 Federazione Italiana Sommelier, Albergatori e Ristoratori: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Federazione Italiana Sommelier, Albergatori e Ristoratori. The federation had sent a protocol containing personal data of a… ITALY · ·Art. 5, 6 Jun 30, 2022