Content type · 2,395 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€2,000 Sectorul 1 al Municipiului București: Insufficient cooperation with supervisory authority The Romanian DPA has fined Sectorul 1 al Municipiului București EUR 2,000 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Jan 30, 2024
€2,000 Istituto Comprensivo Statale “F.S. Cabrini: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Istituto Comprensivo Statale “F.S. Cabrini. The controller had published a document, which contained personal data of school… ITALY · ·Art. 2, 5, 6 Jan 24, 2024
€7,500 ROUNDED TECHNOLOGIES, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 7,500 on ROUNDED TECHNOLOGIES, S.L. The company continued to send a customer a newsletter by e-mail, although they had previously… SPAIN · ·Art. 21 Jan 23, 2024
€200,000 ORANGE ESPAGNE S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Orange Espagne S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card… SPAIN · ·Art. 6 Jan 23, 2024
€2,300 POLAND DPA: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined a data controller EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. ·Art. 33, 34 ·Insufficient fulfilment of data breach notification obligations Jan 18, 2024
€273,000 Centrum Medyczne Ujastek Sp. z o.o.: Non-compliance with general data processing principles The Polish DPA has imposed two fines on the medical facility “Centrum Medyczne Ujastek” totaling approximately EUR 273,000. The first fine of approximately EUR 163,000 was imposed… POLAND · ·Art. 5, 6, 9 +3 Jan 17, 2024
€174,640 Black Tiger Belgium: Insufficient fulfilment of information obligations The Belgian DPA has imposed a fine of EUR 174,640 on Black Tiger Belgium. An individual had filed a complaint with the DPA due to the controller's failure to properly comply with… ·Art. 5, 6, 12 +5 ·Insufficient fulfilment of information obligations Jan 16, 2024
€150,000 International Card Services B.V.: Insufficient technical and organisational measures to ensure information security The Dutch DPA has imposed a fine of EUR 150,000 on International Card Services B.V. (ICS). ICS failed to carry out a data protection impact assessment before starting the digital… THE NETHERLANDS · ·Art. 35 Jan 15, 2024
€3,000 TECHNINK LEB SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on TECHNINK LEB SRL. The controller had suffered a data breach in which personal customer data had been unlawfully disclosed.… ROMANIA · ·Art. 32 Jan 15, 2024
€5,000 Attorney: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5000 on an attorney. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of a request of erasure of… FRANCE · ·Insufficient fulfilment of data subjects rights Jan 15, 2024
€17,000 Alior Bank SA: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 17,000 on Alior Bank SA. The investigation was initiated following complaints that the bank continued to send unsolicited electronic… ROMANIA · ·Art. 5, 6 Jan 12, 2024
€1,500 Website operator: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 1,500 on a website operator. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of data subject… FRANCE · ·Insufficient fulfilment of data subjects rights Jan 9, 2024
€10,000 Website operator: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine in the amount of EUR 11,000 on a website operator. An individual had filed a complaint with the DPA because the controller had failed to comply… AUSTRIA · ·Art. 17, 25, 58 Jan 4, 2024
€12,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has imposed a fine of EUR 12,000 on a company providing vehicle history check services. The controller refused a data subject's request to rectify personal data… LITHUANIA · ·Art. 5, 15, 16 Jan 1, 2024
€41 GERMANY DPA: €41 fine The DPA of Hessen has imposed fines totaling EUR 13,486 on 41 data controllers. In its 2024 activity report, the DPA of Hesse reported a total of 47 fines that year. Six of these… Unknown Jan 1, 2024
€6.5M THE PHONE HOUSE SPAIN, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 6.5 million on THE PHONE HOUSE SPAIN, S.L. The controller had suffered a ransomware attack affecting personal data of 13 million… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Dec 27, 2023
Candidate for parliamentary elections: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine on a candidate for parliamentary elections. The candidate had sent the data subject election advertising by email despite the data subject's… FRANCE · ·Art. 21 Dec 22, 2023
€2,000 Company: Insufficient fulfilment of information obligations The Italian DPA has fined a company s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… ITALY · ·Art. 5, 13 Dec 21, 2023
€4,300 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,400 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Dec 21, 2023
€23,000 Polish Minister of Health: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 23,000 on the Polish Minister of Health. The controller had accessed information via a database relating to a physician who had prescribed… POLAND · ·Art. 25, 32, 34 Dec 20, 2023
€2,300 District Court Krakow: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined the District Court in Krakow EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. POLAND · ·Art. 33, 34 Dec 19, 2023
€200 Private individual: Insufficient cooperation with supervisory authority The Romanian DPA has fined a private individual EUR 200 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Dec 15, 2023
€5,500 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 5,500 for failing to sufficiently cooperate with the DPA during an investigation. POLAND · ·Insufficient cooperation with supervisory authority Dec 13, 2023
€400,000 UK Ministry of Defense: Insufficient technical and organisational measures to ensure information security The UK DPA has fined the Ministry of Defense EUR 400,000 for disclosing personal data of individuals who were to be relocated to the UK after the Taliban took control of… UNITED KINGDOM · ·Insufficient technical and organisational measures to ensure information security Dec 13, 2023
€10,000 VACACIONES EDREAMS, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 10,000 on VACACIONES EDREAMS, S.L.. A data subject had filed a complaint against the controller with the DPA due to the controller's… SPAIN · ·Art. 15 Dec 12, 2023
€10M Uber Technologies Inc.
Uber B.V.: Insufficient fulfilment of information obligations The Dutch DPA has fined Uber Technologies Inc. and Uber B.V. EUR 10 million for failing to provide sufficient information about the storage period of European drivers' data and… THE NETHERLANDS · ·Art. 12, 13 Dec 11, 2023
€3,000 Veranda Obor S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Veranda Obor S.A.. The controller had disclosed personal data (e.g. name, e-mail adress etc.) of lottery participants on its… ROMANIA · ·Art. 32 Dec 11, 2023
€2,000 Mushtaq Rubina Kebabish: Insufficient fulfilment of information obligations The Italian DPA has fined Mushtaq Rubina Kebabish EUR 2,000. The controller had operated video surveillance cameras in one of their premises without properly informing about the… ITALY · ·Art. 5, 13 Dec 7, 2023
€2,700 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 2,700 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Dec 7, 2023
€1,000 Sirio S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,000 on Sirio S.p.A.. An employee filed a complaint with the DPA because the controller had passed on their personal data to a bank… ITALY · ·Art. 5, 6, 13 Dec 7, 2023
€1,500 Physician: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 1,500 on a physician. An individual had filed a complaint with the DPA because the physician had accessed their personal data in a… CYPRUS · ·Art. 5 Dec 7, 2023
€24,000 Hora Credit IFN SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA imposed a fine of EUR 24,000 on Hora Credit IFN SA. The controller had accidentally sent documents containing the personal data of another person to a customer by… ROMANIA · ·Art. 12, 15, 32 +1 Dec 7, 2023
€3,200 SOLAR PROGRESS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on SOLAR PROGRESS, S.L.. The controller had published a screenshot with an email from a former employee who had a professional question in a… SPAIN · ·Art. 5 Dec 7, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5, 13 Nov 30, 2023
€60,000 Limit Call S.r.l.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 60,000 on Limit Call S.r.l.s. for unauthorized telemarketing. The controller had acquired lists of personal data without checking the… ITALY · ·Art. 5, 6, 7 +6 Nov 30, 2023
€3,000 A R.L Spartan Gym: Non-compliance with general data processing principles The Italian DPA has fined A R.L Spartan Gym EUR 3,000. The controller had operated video surveillance cameras in one of their premises without the required authorization.… ITALY · ·Art. 5, 13, 114 Nov 30, 2023
€1,000 Techno Security s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,000 on Techno Security s.r.l.. A data subject had filed a complaint with the DPA due to the controller's failure to respond to a… ITALY · ·Art. 12, 15 Nov 30, 2023
€1.7M Norwegian Labor and Welfare Administration: Insufficient technical and organisational measures to ensure information security The Norwegian DPA has imposed a fine of EUR 1.7 million on Arbeids- og velferdsetaten, the Norwegian Labor and Welfare Administration (NAV). During its investigation, the DPA… NORWAY · ·Art. 5, 24, 25 +1 Nov 27, 2023
APD/GBA · 159/2023 On 19 July 2023, a data subject, represented by noyb (European Centre for Digital Rights), filed a complaint against Mediafin, a Belgian media group, with the Belgian DPA. The… 159/2023 ·Belgium ·Art. 4, 6, 7 Nov 24, 2023
€10,000 Pharmacy owner: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 10,000 on a pharmacy owner. The controller had disposed of a large number of personal documents, including medical information of data… SPAIN · ·Art. 5, 32 Nov 24, 2023
€10,000 Alpha Bank: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 10,000 on Alpha Bank. A data subject had filed a complaint with the DPA due to the controller's failure to respond to a request of… GREECE · ·Art. 12, 15 Nov 23, 2023
€45,000 Open University of Cyprus: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 45,000 on Open University of Cyprus. The university had suffered a data breach involving hackers publishing personal data of students,… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Nov 22, 2023
€56,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish data protection authority has imposed a fine of EUR 50,000 on VODAFONE ESPAÑA, S.A.U.. A customer had filed a complaint with the DPA regarding the fact that due to a… SPAIN · ·Art. 6 Nov 22, 2023
€8,000 EASYJET AIRLINE COMPANY LIMITED: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on EASYJET AIRLINE COMPANY LIMITED. A data subject had filed a complaint against the controller with the DPA due to the controller's failure to… SPAIN · ·Art. 15 Nov 21, 2023
€1,500 Libra Internet Bank SA: Insufficient cooperation with supervisory authority The Romanian DPA has imposed a fine of EUR 1500 on Libra Internet Bank SA for failing to comply with an order issued by the DPA. ROMANIA · ·Art. 58 Nov 20, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Nov 20, 2023
€72,000 Eurocollege Oxford English Institute S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 72,000 on Eurocollege Oxford English Institute S.L. The data subject stated that they had signed a training contract with the affiliated… SPAIN · ·Art. 5, 6, 9 Nov 17, 2023
€18,000 Cluster S.r.l.: Non-compliance with general data processing principles The Italian DPA imposed a fine of EUR 18,000 on Cluster S-r.l. A data subject had complained to the DPA because their son's health-related data and their own personal data had… ITALY · ·Art. 5, 32 Nov 16, 2023
€20,000 QUALITY-PROVIDER S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 20,000 on QUALITY-PROVIDER S.A.. The controller had processed the personal data of a data subject without a valid legal basis and had not… SPAIN · ·Art. 6, 58 Nov 16, 2023
€100,000 Autostrade per l’Italia S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Autostrade per l’Italia S.p.A. EUR 100,000 for failing to adequately respond to requests from employees for access to their personal data. ITALY · ·Art. 12, 15 Nov 16, 2023