Content type · 1,843 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5, 13 Nov 30, 2023
€50,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller had… SPAIN · ·Art. 6 Nov 27, 2023
€1.7M Norwegian Labor and Welfare Administration: Insufficient technical and organisational measures to ensure information security The Norwegian DPA has imposed a fine of EUR 1.7 million on Arbeids- og velferdsetaten, the Norwegian Labor and Welfare Administration (NAV). During its investigation, the DPA… NORWAY · ·Art. 5, 24, 25 +1 Nov 27, 2023
Belgian DPA settles with Mediafin: De Tijd cookie banner must add equal "refuse all" On 19 July 2023, a data subject, represented by noyb (European Centre for Digital Rights), filed a complaint against Mediafin, a Belgian media group, with the Belgian DPA. The… 159/2023 ·Belgium · Nov 24, 2023
€10,000 Pharmacy owner: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 10,000 on a pharmacy owner. The controller had disposed of a large number of personal documents, including medical information of data… SPAIN · ·Art. 5, 32 Nov 24, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered a neighbour… SPAIN · ·Art. 5 Nov 24, 2023
€10,000 Alpha Bank: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 10,000 on Alpha Bank. A data subject had filed a complaint with the DPA due to the controller's failure to respond to a request of… GREECE · ·Art. 12, 15 Nov 23, 2023
€400 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5 Nov 22, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered a neighbouring… SPAIN · ·Art. 5 Nov 21, 2023
€8,000 EASYJET AIRLINE COMPANY LIMITED: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on EASYJET AIRLINE COMPANY LIMITED. A data subject had filed a complaint against the controller with the DPA due to the controller's failure to… SPAIN · ·Art. 15 Nov 21, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Nov 20, 2023
€72,000 Eurocollege Oxford English Institute S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 72,000 on Eurocollege Oxford English Institute S.L. The data subject stated that they had signed a training contract with the affiliated… SPAIN · ·Art. 5, 6, 9 Nov 17, 2023
€20,000 FORO ASTURIAS: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 20,000 on FORO ASTURIAS. An individual had filed a complaint with the DPA due to the fact that personal data stored by the controller had… SPAIN · ·Art. 5, 32 Nov 16, 2023
€18,000 Cluster S.r.l.: Non-compliance with general data processing principles The Italian DPA imposed a fine of EUR 18,000 on Cluster S-r.l. A data subject had complained to the DPA because their son's health-related data and their own personal data had… ITALY · ·Art. 5, 32 Nov 16, 2023
€20,000 QUALITY-PROVIDER S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 20,000 on QUALITY-PROVIDER S.A.. The controller had processed the personal data of a data subject without a valid legal basis and had not… SPAIN · ·Art. 6, 58 Nov 16, 2023
€3,200 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 3,200 for failing to provide information requested by the DPA during an investigation. ·Art. 58 ·Insufficient cooperation with supervisory authority Nov 16, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The controller had uploaded an individual's personal data, including their name, a picture and their… SPAIN · ·Art. 6 Nov 15, 2023
€200,000 CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.. The controller had included the data subject's personal data in a credit… SPAIN · ·Art. 6 Nov 13, 2023
€110,000 Rompetrol Downstream SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 110,000 on Rompetrol Downstream SRL. The controller had suffered a data breach in which customer data was repeatedly accessed and used… ROMANIA · ·Art. 32 Nov 13, 2023
€20,000 Piraeus Leasing S.M.S.A.: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 20,000 on Piraeus Leasing S.M.S.A.. An individual had filed a complaint with the DPA because the controller processed an image on which… GREECE · ·Art. 5, 15 Nov 10, 2023
€600 Store owner: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a store owner. The controller had installed video surveillance cameras which, among other things, also covered a neighbour… SPAIN · ·Art. 5 Nov 7, 2023
€43,000 Indcap AB: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 43,000 on Indecap AB. The controller had accidentally sent an email to a large number of its customers containing an Excel document… SWEDEN ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 7, 2023
€1,000 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on a homeowners' association. A property owner had filed a complaint with the DPA. The controller had published an enforcement… SPAIN · ·Art. 5, 32 Nov 7, 2023
€240 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 240 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects. SPAIN · ·Art. 13 Nov 6, 2023
€3,000 OTP BANK ROMANIA SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on OTP BANK ROMANIA SA. The controller had accidentally transmitted personal data of an individual to an unauthorized third party.… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 3, 2023
€600 Hotel: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a hotel. The controller had installed video surveillance cameras which, among other things, also covered the public space and… SPAIN · ·Art. 5, 13 Nov 3, 2023
€30,000 APOLLONIA TOPCO, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on APOLLONIA TOPCO, S.L.. An individual had filed a complaint with the DPA due to the fact that, in order to receive a refund,… SPAIN · ·Art. 5, 38 Nov 2, 2023
€48,000 INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P.: Non-compliance with general data processing principles The Spanish DPA has imposed a finea INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P. The controller had suffered a data breach in which personal patient and employee data had… SPAIN · ·Art. 5, 32, 34 Nov 2, 2023
€300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed a video surveillance camera which recorded a communal area without this having… SPAIN · ·Art. 6 Oct 31, 2023
€180 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 180 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects. SPAIN · ·Art. 13 Oct 31, 2023
€5M CAIXABANK, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5 million on CAIXABANK, S.A.. A customer had filed a complaint about having access to a document containing information on a transfer… SPAIN · ·Art. 5, 25, 32 Oct 26, 2023
€7,000 Ophthalmologic institute: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 7,000 on a ophthalmologic institute. The controller had responded to an online review, disclosing personal data of a patient. SPAIN · ·Art. 5, 32 Oct 26, 2023
€1,000 SC Spark Car Sharing SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 1,000 on SC Spark Car Sharing SRL. An individual had filed a complaint with the DPA because the controller had processed their email… ROMANIA · ·Art. 5, 6, 7 Oct 25, 2023
€6.1M ENDESA ENERGÍA, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined ENDESA ENERGÍA, S.A.U. EUR 6,1 million due to a security breach resulting in unauthorized access to its systems. The controller had informed the DPA that… SPAIN · ·Art. 5, 32, 33 +2 Oct 25, 2023
€500 BILBAO AD INFINITUM, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined BILBAO AD INFINITUM, S.L. EUR 500. The controller had installed video surveillance cameras which, among other things, also covered the public street. The… SPAIN · ·Art. 5 Oct 25, 2023
€3,000 Mensajero SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Mensajero SRL. The controller had suffered a data breach where a link on the controller's website was publicly accessible… ROMANIA · ·Art. 32 Oct 24, 2023
€50,000 Oney Servicios Financieros E.F.C.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on Oney Servicios Financieros E.F.C... The controller had submitted data from the data subject to a credit information system… SPAIN · ·Art. 5 Oct 23, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Oct 23, 2023
€800,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has fined BANCO BILBAO VIZCAYA ARGENTARIA, S.A. EUR 800,000. A customer had lost her handbag, which also contained her bank card. The individual therefore… SPAIN · ·Art. 25, 32 Oct 20, 2023
€1,000 DANTE INTERNATIONAL SA: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on DANTE INTERNATIONAL SA. The controller had sent marketing SMS to a data subject without a valid legal basis. ROMANIA · ·Art. 6 Oct 20, 2023
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Oct 19, 2023
€600 FESTINA LOTUS S.A.: Insufficient fulfilment of data subjects rights The Spanish Data Protection Authority has imposed a fine of EUR 600 on FESTINA LOTUS S.A. due to the fact that the controller had not properly complied with a data subject's… SPAIN · ·Art. 17 Oct 18, 2023
€2,000 UNIQUE HOTEL APARTMENT S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on UNIQUE HOTEL APARTMENT. The controller had copied identification documents for the purposes of guest registration and stored the… SPAIN · ·Art. 5 Oct 18, 2023
€30,000 H&M Hennes & Mauritz GBC AB: Insufficient fulfilment of data subjects rights The Swedish DPA has imposed a fine of EUR 30,000 on H&M for sending out marketing messages, despite the fact that data subjects had exercised their right to objection. Six data… SWEDEN ·Art. 12, 21 ·Insufficient fulfilment of data subjects rights Oct 17, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 600 for installing a video surveillance camera that captured parts of a commonly shared garage. The DPA considered this a… SPAIN · ·Art. 5, 13 Oct 15, 2023
€70,000 Scionti Selezioni Superiori S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 70,000 on Scionti Selezioni Superiori S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were… ITALY · ·Art. 5, 6, 7 +7 Oct 12, 2023
€600,000 GROUPE CANAL +: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 600,000 on GROUPE CANAL+ for multiple violations of the GDPR. The DPA determined that the data controller failed to demonstrate that it… FRANCE · ·Art. 7, 12, 13 +5 Oct 12, 2023
€5,300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. An individual had rented a room from the controller and filed a complaint due to the fact that the… SPAIN · ·Art. 6, 13 Oct 11, 2023
€1,500 NORDETIA CLINICS MÓSTOLES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on NORDETIA CLINICS MÓSTOLES S.L.. The controller had sent an e-mail without using the blind copy option, revealing the email… SPAIN · ·Art. 5, 32 Oct 10, 2023
€15,000 ILUNION SEGURIDAD, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 15,000 on ILUNION SEGURIDAD, S.A. The controller had sent labor communications by e-mail without using the blind copy option, revealing… SPAIN · ·Art. 5, 32 Oct 10, 2023