Content type · 1,535 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€3,000 Gas station: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 3,000 on a gas station operator. A person had filed a complaint with the DPA due to the controller's failure to grant them access to… GREECE · ·Art. 12, 14 Sep 22, 2022
€5,000 Curtea Veche Publishing SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Curtea Veche Publishing SRL. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR. In the first… ROMANIA · ·Art. 32 Sep 21, 2022
€5,000 Surveyor: Insufficient legal basis for data processing The DPA of Baden-Württemberg has imposed a fine of EUR 5,000 on a surveyor. The surveyor had used his authority to inspect the electronic land register to identify several hundred… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Sep 21, 2022
€50,000 Property development company: Insufficient legal basis for data processing The DPA of Baden-Württemberg has imposed a fine of EUR 50,000 on a property development company. The company had sent a letter to a property owner in which it made a purchase… GERMANY ·Art. 6, 14 ·Insufficient legal basis for data processing Sep 21, 2022
€525,000 Company: Insufficient involvement of data protection officer The DPA of Berlin has imposed a fine of EUR 525,000 on the subsidiary of a Berlin-based e-commerce group. The company had appointed a data protection officer, who however was also… GERMANY ·Art. 38 ·Insufficient involvement of data protection officer Sep 20, 2022
€1,800 Union Sindical Obrera: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on the trade union Union Sindical Obrera. An individual had filed a complaint with the DPA for repeatedly receiving emails from the controller… SPAIN · ·Art. 6 Sep 20, 2022
€2,000 Banca Comercială Română SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Banca Comercială Română SA. The bank had notified the DPA of a data breach pursuant to Art. 33 GDPR. Due to an error in the IT… ROMANIA · ·Art. 25, 32 Sep 19, 2022
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5 Sep 16, 2022
€3,000 MARIELI GABRIELA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 3,000 on MARIELI GABRIELA, S.L.. A person had filed a complaint with the DPA due to the fact that the company had debited their bank… SPAIN · ·Art. 6 Sep 16, 2022
€2,000 Agent of the real estate agency BARCELONA DREAM HOUSE AGENCY: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on an agent of the real estate agency BARCELONA DREAM HOUSE AGENCY. An individual had filed a complaint with the DPA because the… SPAIN · ·Art. 13 Sep 16, 2022
€3,000 Thiene municipality: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 3,000 on Thiene municipality. A former employee of the municipality filed a complaint with the DPA because a document containing… ITALY · ·Art. 2, 5, 6 Sep 15, 2022
€100,000 Lazio Region: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Lazio Region. An individual had filed a complaint with the DPA because she had received an invitation from the regional health… ITALY · ·Art. 5, 6, 9 +4 Sep 15, 2022
€10,000 Bper Banca S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Bper Banca S.p.A.. An individual had filed a complaint with the DPA regarding the failure to fulfill their right to erasure of… ITALY · ·Art. 12 Sep 15, 2022
€2,000 Immobiliare Riscostruzione Meloria s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has imposed a fine of EUR 2,000 on Immobiliare Riscostruzione Meloria s.r.l.. The controller had installed a video surveillance system at its office which covered… ITALY · ·Art. 5, 13 Sep 15, 2022
€40,000 FCA Italy S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on FCA Italy S.p.A.. An employee of the controller had requested access to personal data processed in the context of their… ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Sep 15, 2022
€2,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Sep 13, 2022
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The private individual had installed three video surveillance cameras on his property which, among other… SPAIN · ·Art. 5 Sep 13, 2022
€250,000 GIE INFOGREFFE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 250,000 on GIE INFOGREFFE. The portal operates a website where people can access legal information about companies and order documents… FRANCE · ·Art. 5, 32 Sep 13, 2022
€6,700 Hørsholm municipality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 6,700 on Hørsholm municipality. The municipality had reported a data breach to the DPA pursuant to Art. 33 GDPR. An employee's work… DENMARK · ·Art. 32 Sep 12, 2022
€180 EURO DONER KEBAB: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on EURO DONER KEBAB. The controller had installed video surveillance cameras which, among other things, also covered the public space.… SPAIN · ·Art. 5, 13 Sep 9, 2022
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Sep 9, 2022
€2,000 SC Raiffeisen Bank SA: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 2,000 on SC Raiffeisen Bank SA. An individual had filed a complaint with the DPA for receiving text messages about money transfers to… ROMANIA · ·Art. 5 Sep 9, 2022
€15,000 School: Non-compliance with general data processing principles The Hellenic DPA has fined a school EUR 15,000. The school had installed several video surveillance cameras on the building, which permanently recorded students, teachers and… GREECE · ·Art. 5, 6, 12 +2 Sep 9, 2022
€8,000 Realmedia Network SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined Realmedia Network SA EUR 8,000. The company had suffered security breaches on a website it operates. This allowed it to leak and access unauthorized… ROMANIA · ·Art. 32 Sep 8, 2022
€20,000 MUXERS CONCEPT, S.L.: Insufficient legal basis for data processing The Spanish DPA has fined MUXERS CONCEPT, S.L. EUR 20,000. The company had installed video surveillance cameras and microphones in the employee changing room in one of the… SPAIN · ·Art. 6 Sep 6, 2022
€405M Meta Platforms, Inc.: Non-compliance with general data processing principles The Irish DPA (DPC) has imposed a fine of EUR 405,000,000 on Meta Platforms, Inc. (Instagram). Following the investigation, the DPC submitted a draft decision under Art. 60 GDPR… IRELAND ·Art. 5, 6, 12 +3 ·Non-compliance with general data processing principles Sep 5, 2022
€360 Store owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a store owner. The controller had installed video surveillance cameras which, among other things, also covered the public space. The… SPAIN · ·Art. 5, 13 Sep 4, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR on a private individual. The data subject had filed a complaint against his ex-wife with the DPA. The ex-wife had installed video… SPAIN · ·Art. 5 Sep 4, 2022
€240 MH VILASECA S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on MH VILASECA S.L.. The controller had failed to provide a notice with information about video surveillance in its premises. The original fine… SPAIN · ·Art. 13 Sep 1, 2022
€1,700 Bazar Pekin: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 1,700 on Bazar Pekin. The controller had failed to provide a notice with information about video surveillance in its premises. In… SPAIN · ·Art. 13, 30 Aug 30, 2022
€1,000 Alpha Bank Romania SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Alpha Bank Romania SA. The bank had accidentally sent a document to the wrong recipient via WhatsApp. The document contained… ·Art. 29, 32 ·Insufficient technical and organisational measures to ensure information security Aug 29, 2022
€1,200 DIGITECNIA SOLUTIONS, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on DIGITECNIA SOLUTIONS, S.L.. An individual had filed a complaint with the DPA due to the fact that the company had published a picture of… SPAIN · ·Art. 6 Aug 28, 2022
€480 SERVICIOS PROFESIONALES LA PARADA S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on SERVICIOS PROFESIONALES LA PARADA S.L.. The company had installed video surveillance cameras which, among other things, also covered… SPAIN · ·Art. 5, 13 Aug 25, 2022
€25,000 Operator of a public toilet: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 25,000 on an operator of a public toilet. The controller had installed a video surveillance camera on the restrooms and secretly… AUSTRIA · ·Art. 5, 6, 13 Aug 23, 2022
€2,500 Company: Insufficient technical and organisational measures to ensure information security The Belgian DPA has imposed a fine of EUR 2,500 on a company. The company operates a digital management platform where suppliers and customers can communicate and upload… BELGIUM · ·Art. 5, 24, 32 Aug 23, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 22, 2022
€600,000 ACCOR SA: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has imposed a fine of EUR 600,000 on ACCOR SA. Both CNIL and other European DPAS had received complaints against ACCOR from several individuals. In the… FRANCE · ·Art. 12, 13, 15 +2 Aug 19, 2022
€20,000 Medical laboratory: Insufficient technical and organisational measures to ensure information security The Belgian DPA imposed a fine of EUR 20,000 on a medical laboratory. During its investigation, the DPA found that the laboratory had failed to conduct a data protection impact… BELGIUM · ·Art. 5, 12, 13 +3 Aug 19, 2022
€5,000 RODALI GESTIÓN INMOBILIARIA, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 5,000 on RODALI GESTIÓN INMOBILIARIA, S.L.. An individual had filed a complaint with the DPA due to the fact that the controller had not… SPAIN · ·Art. 13 Aug 16, 2022
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 180 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Aug 12, 2022
€1,000 Wabag Water Services SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on SC Wabag Water Services SRL. An employee of the company had filed a complaint with the DPA due to the fact that their employer… ROMANIA · ·Art. 5, 6 Aug 9, 2022
€7,000 CDI Transport Intern și Internațional SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 7,000 on CDI Transport Intern și Internațional SRL. During its investigation, the DPA found that the company's website did not provide… ROMANIA · ·Art. 12, 58 Aug 9, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 8, 2022
€600 Restaurant owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a restaurant owner. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 8, 2022
€735 Company: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 735 on a company. An individual had filed a complaint against the company with the DPA. An employee of the company had made sound… HUNGARY · ·Art. 5, 6, 13 Aug 8, 2022
€5,000 IDIKA SA: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on IDIKA SA. IDIKA was operating in the context of providing free COVID-19 tests. The DPA found that IDIKA, in the course of its… GREECE · ·Art. 5, 25 Aug 8, 2022
€20,000 Cosmopol Security S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Cosmopol Security S.p.A. EUR 20,000. An individual had filed a complaint with the DPA against the controller. The individual had received invoices… ITALY · ·Art. 12, 15 Aug 5, 2022
€9,000 Prodesspa Decoratius i Pintures , S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Prodesspa Decoratius i Pintures , S.L.. A former employee had filed a complaint with the DPA due to the company's unlawful disclosure of… SPAIN · ·Art. 6 Aug 5, 2022
€1,000 Mister Brick S.a.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,000 on Mister Brick S.a.s.. An individual had filed a complaint with the DPA against the controller for having received unsolicited… ITALY · ·Art. 5, 6, 12 +2 Aug 5, 2022
€1,000 Colosseo S.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,000 on Colosseo S.r.l.. An individual had filed a complaint with the DPA because the controller had sent him an unsolicited commercial… ITALY · ·Art. 5, 6, 12 +4 Aug 5, 2022