Content type · 1,282 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€30,000 RADIO TELEVISION MADRID, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on RADIO TELEVISION MADRID, S.A.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's… SPAIN · ·Art. 5 Jun 23, 2022
€30,000 CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A. Several media outlets, including the controller had published an audio recording of a… SPAIN · ·Art. 5 Jun 23, 2022
€134,000 Gyldendal A/S: Non-compliance with general data processing principles The Danish DPA has fined publisher Gyldendal A/S EUR 134,000. During its investigation, the DPA found that the company had kept the data of approximately 685,000 unsubscribed… DENMARK · ·Art. 5 Jun 22, 2022
€3,000 Company: Non-compliance with general data processing principles The DPA of Luxembourg (CNPD) has imposed a fine of EUR 3,000 on a company. The company had installed a video surveillance system for the purpose of protecting company property and… LUXEMBOURG · ·Art. 5, 13 Jun 22, 2022
€1,000 SC Interactions Marketing SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on SC Interactions Marketing SRL. The controller had sent advertising messages by e-mail to several people on behalf of another… ROMANIA · ·Art. 32 Jun 20, 2022
€1,000 SCOTCH CORNER BAR: Non-compliance with general data processing principles The Spanish DPA has fined the bar operator SCOTCH CORNER BAR EUR 1,000. The controller had installed a CCTV which also covered parts of the public space. Furthermore the… SPAIN · ·Art. 5, 58 Jun 16, 2022
€3,000 S.C. Wine Point S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on S.C. Wine Point S.R.L.. A data subject had filed a complaint with the DPA for having received an advertising e-mail from the… ROMANIA · ·Art. 32 Jun 15, 2022
€91,000 Tavistock & Portman NHS Foundation Trust: Insufficient technical and organisational measures to ensure information security The UK DPA (ICO) has fined the Tavistock and Portman NHS Foundation Trust EUR 91,000. The Tavistock and Portman NHS Foundation Trust is a mental health specialist trust located in… UNITED KINGDOM · ·Art. 5, 32 Jun 9, 2022
€600 Private individual: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour and the public space. SPAIN · ·Art. 5 Jun 9, 2022
€10,000 Cribis Credit Management s.r.l.: Insufficient legal basis for data processing The Italian DPA has fined Cribis Credit Management s.r.l. EUR 10,000. The company had inadvertently sent an e-mail about late payments on a subscription to the head of the data… ITALY · ·Art. 5, 6 Jun 9, 2022
€26,000 Garante per la protezione dei dati personali (Italy) - 9794895 The Municipality of Policoro (Basilicata), implemented the use of CCTV cameras to monitor and fight waste abandonment within its territory. A data subject complained the… Art. 5, 12, 13 +3 Jun 9, 2022
€360 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 360 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jun 3, 2022
€3,000 LODEJU, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on the restaurant operator LODEJU, S.L.. The controller had installed video surveillance cameras in its premises which,… SPAIN · ·Art. 5, 13 Jun 3, 2022
€300 Private individual: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour and the public space. SPAIN · ·Art. 5 Jun 1, 2022
€1,600 CORON ISLAND SLU: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,600 on CORON ISLAND SLU. A customer had filed a complaint with the DPA against the restaurant. The customer had asked for a bill in her… SPAIN · ·Art. 5 May 31, 2022
€10,000 Afragola municipality: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10,000 on Afragola municipality. A former employee of the municipality had filed a complaint with the DPA because the municipality had… ITALY · ·Art. 2, 5, 12 May 26, 2022
€46,000 Azienda Sanitaria Locale Roma: Insufficient legal basis for data processing The Italian DPA has fined Azienda Sanitaria Locale Roma EUR 46,000. The healthcare facility had published the names and health information of 1337 patients on its website. In most… ITALY · ·Art. 2, 5, 6 +1 May 26, 2022
€50 APD/GBA (Belgium) - 85/2022 On 16 January 2019, the Executive-committee of the Belgian DPA (GBA) started an investigation on the use of cookies on Belgian media websites. The controller in this case is… Art. 4, 5, 6 +3 May 25, 2022
€12,000 Comune di Napoli Corpo di Polizia Municipale: Insufficient legal basis for data processing The Italian DPA has fined the police authority 'Comune di Napoli Corpo di Polizia Municipale' EUR 12,000. The police authority had sent a list of names, addresses, tax numbers,… ITALY · ·Art. 5, 6, 88 +1 May 22, 2022
€3,000 Zito Auto di Gianfranco Zito: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 3,000 on the company Zito Auto di Gianfranco Zito. The company had installed video surveillance cameras which monitored, among other… ITALY · ·Art. 5, 114 May 22, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras in his car which, among other things, also… SPAIN · ·Art. 5 May 20, 2022
€9M Clearview Al Inc.: Non-compliance with general data processing principles The UK DPA has fined Clearview AI Inc. EUR 9 million. The company holds a database of more than 20 billion facial images (including those of UK residents and nationals) from… UNITED KINGDOM · ·Art. 5, 6, 9 +7 May 18, 2022
€5,000 Kredyt Inkaso Investments RO S.A: Insufficient legal basis for data processing The Romanian DPA has fined Kredyt Inkaso Investments RO S.A. EUR 5,000. A data subject had filed a complaint with the DPA against the controller for having disclosed their… ROMANIA · ·Art. 5, 6, 9 +1 May 18, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras on his property which, among other things,… SPAIN · ·Art. 5 May 17, 2022
€1,500 MAYR MELNHOF PACKAGING ROMANIA S.R.L.: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 1,500 on MAYR MELNHOF PACKAGING ROMANIA S.R.L.. The controller had installed video surveillance cameras in the premises for the purpose… ·Art. 5, 6 ·Non-compliance with general data processing principles May 17, 2022
€42,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España S.A.U.. A data subjects had filed a complaint with the AEPD against the controller. The data subject complained about… SPAIN · ·Art. 6 May 17, 2022
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed a surveillance camera on his property, which recorded, among other… SPAIN · ·Art. 5 May 12, 2022
€6,000 Villabate municipality: Non-compliance with general data processing principles The Italian DPA has fined Villabate municipality EUR 6,000. The municipality had disclosed personal data of a former employee to unauthorized third parties without a valid legal… ITALY · ·Art. 5, 6, 37 +1 May 12, 2022
€600 Bar owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a bar owner EUR 600. The bar operated a video surveillance system in which the observation angle of the cameras extended into the public space. The… SPAIN · ·Art. 5 May 11, 2022
€6,000 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on a homeowners' association. An apartment owner who had been a resident for 15 years had filed a complaint with the DPA due… SPAIN · ·Art. 5, 13 May 11, 2022
€36,000 City of Reykjavík: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 36,000 on the City of Reykjavík. The city had used the digital education system 'Seesaw' at several schools. The student system… ICELAND ·Art. 5, 6, 32 ·Insufficient legal basis for data processing May 3, 2022
€16,000 LABORATORIOS GONZÁLEZ, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined LABORATORIOS GONZÁLEZ, S.L.. The laboratory had sent the results of a Covid-19 test that the data subject had taken not only to them but also to… SPAIN · ·Art. 5 Apr 29, 2022
€3,000 Comune di Monte Sant'Angelo: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Monte Sant'Angelo. A person who had participated in a selection procedure had filed a complaint with the DPA due to… ITALY · ·Art. 2, 5, 6 +1 Apr 28, 2022
€150,000 Tarento municipality: Insufficient fulfilment of information obligations The Italian DPA has imposed a fine of EUR 150,000 on Tarento municipality. The company Amiu S.p.A had operated the local waste collection service on behalf of the municipality.… ITALY · ·Art. 5, 12, 13 +3 Apr 28, 2022
€1,500 CAFFE VECCHIO, S.L.: Insufficient legal basis for data processing The Spanish DPA has fined CAFFE VECCHIO, S.L. EUR 1,500. A former employee of the café had filed a complaint with the DPA. The operator of the café had responded to negative… SPAIN · ·Art. 5, 6 Apr 28, 2022
€70,000 Ospedale San Raffaele s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 70,000 on the healthcare facility Ospedale San Raffaele s.r.l.. The hospital had reported two data breaches to the DPA under Art. 33… ITALY · ·Art. 5, 9 Apr 28, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Apr 27, 2022
€500 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 500 on a homeowners' association. The executive board of the owners' association had publicly posted a list of defaulting owners. The DPA… SPAIN · ·Art. 5 Apr 12, 2022
€40,000 ISWEB S.p.A.: Insufficient data processing agreement The Italian DPA imposed a fine of EUR 40,000 on ISWEB S.p.A.. The fine is related to a fine against the healthcare facility Azienda ospedaliera di Perugia. ISWEB had provided the… ITALY · ·Art. 28 Apr 7, 2022
€10,000 Tecnomed Trento s.r.l.: Non-compliance with general data processing principles The Italian DPA has fined Tecnomed Trento s.r.l. EUR 10,000. The controller had operated several video surveillance cameras in its premises, some of them without the required… ITALY · ·Art. 5, 13, 29 +2 Apr 7, 2022
€50,000 Palumbo Superyacht Ancona s.r.l.: Insufficient legal basis for data processing The Italian DPA has fined Palumbo Superyacht Ancona s.r.l. EUR 50,000. The company had blocked an employee's company email account without permission. The employee had reported… ITALY · ·Art. 5, 12, 13 +3 Apr 7, 2022
€3.7M Dutch Tax and Customs Administration: Non-compliance with general data processing principles The Dutch DPA has imposed a fine of EUR 3,7 million on the Dutch Tax and Customs Administration. This is the highest fine ever imposed by the Dutch DPA As part of its… THE NETHERLANDS · ·Art. 5, 6, 32 +1 Apr 7, 2022
€10,000 Findomestic Banca spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10,000 on Findomestic Banca spa. A customer had filed a complaint with the DPA regarding a breach of confidentiality related to the… ITALY · ·Art. 5 Apr 7, 2022
€40,000 Azienda ospedaliera di Perugia: Non-compliance with general data processing principles The Italian DPA (Garante) has fined Azienda ospedaliera di Perugia EUR 40,000. During an investigation at the healthcare facility, the DPA found multiple GDPR violations. The… ITALY · ·Art. 5, 13, 14 +4 Apr 7, 2022
€1.3M Danske Bank: Non-compliance with general data processing principles The Danish DPA has imposed a fine of EUR 1.3 million on Danske Bank. The DPA had opened an investigation against the bank after it informed the DPA that it had a problem with the… DENMARK · ·Art. 5 Apr 5, 2022
€10,000 Piraeus Bank: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on Piraeus Bank. The bank had mistakenly sent a document containing data of the data subject to a third party. This error was… GREECE · ·Art. 5, 33, 34 Apr 4, 2022
€5,000 Mayor: Insufficient legal basis for data processing The Hellenic DPA has fined a mayor EUR 5,000. The mayor had sent documents of an employee of the municipality to third parties without the employee's consent. The DPA considered… GREECE · ·Art. 5 Apr 4, 2022
€7,500 Company: Insufficient fulfilment of data subjects rights The Belgian DPA has imposed a fine of EUR 7,500 on a company. A former managing director had filed a complaint against the company with the DPA. In the context of being dismissed,… BELGIUM · ·Art. 5, 6, 15 +4 Apr 1, 2022
€1,300 Workshop: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 1,300 on a workshop. The workshop had installed a video surveillance system to protect the company's assets. However, the cameras also… HUNGARY · ·Art. 5, 6, 13 Mar 29, 2022
€720,000 Klarna Bank AB: Insufficient fulfilment of information obligations The Swedish DPA has imposed a fine of EUR 720,000 on Klarna Bank AB. Klarna is a financial company that processes a large number of personal data in various ways. As part of its… SWEDEN ·Art. 5, 12, 13 +1 ·Insufficient fulfilment of information obligations Mar 28, 2022