Content type · 3,446 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€2.4M Posti Jakelu Oy: Insufficient legal basis for data processing The Finnish DPA imposed a fine of EUR 2.4 million on Posti Jakelu Oy following an investigation. It was found that Posti had automatically set up an electronic mailbox for… FINLAND · ·Art. 6 Nov 13, 2024
€5M Foodinho Srl: Non-compliance with general data processing principles The Italian DPA has fined the food delivery service Foodinho Srl EUR 5 million for unlawfully processing the data of approximately 35,000 drivers and for several violations of the… ITALY · ·Art. 2, 5, 6 +11 Nov 13, 2024
€2,500 COYARE SLU: Non-compliance with general data processing principles The Spanish DPA fined COYARE SLU EUR 2,500 for sending emails to different recipients without including them in the blind carbon copy (BCC) list. This resulted in the unauthorized… SPAIN · ·Art. 5, 32 Nov 13, 2024
€29,500 Sligo County Council: Non-compliance with general data processing principles The Irish DPA has imposed a fine of EUR 29,500 on the Sligo County Council. The controller used video surveillance but failed to ensure compliance with the GDPR. They failed to… IRELAND ·Art. 5, 13, 24 +3 ·Non-compliance with general data processing principles Nov 13, 2024
€6,700 Uptime-IT ApS: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 9,700 on Uptime-IT ApS. Uptime-IT ApS, the data processor for a chiropractic clinic, failed to install sufficient security measures,… DENMARK · ·Insufficient technical and organisational measures to ensure information security Nov 12, 2024
€900,000 Debt collection service provider: Insufficient legal basis for data processing The DPA of Hamburg has imposed a fine of EUR 900,000 on a debt collection service provider. The company had unlawfully stored personal data (amounting to a six-digit number of… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Nov 12, 2024
€200,000 Correo Inteligente Postal, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA fined Correo Inteligente Postal, S.L. EUR 200,000 after several incidents of undelivered letters containing personal data were reported. These letters, which… SPAIN · ·Art. 5, 32 Nov 11, 2024
€2,000 KAFFA KOFFEE ORGANISATION, S.L.: Non-compliance with general data processing principles The Spanish DPA fined KAFFA KOFFEE ORGANISATION, S.L. EUR 2,000 for sending emails to different recipients without including them in the blind carbon copy (BCC) list. This… SPAIN · ·Art. 5, 32 Nov 7, 2024
€1,000 MINAS DE VALDECASTILLO, S.A..: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on MINAS DE VALDECASTILLO, S.A.. The controller had installed video surveillance cameras which, among other things, also covered… SPAIN · ·Art. 5, 13 Nov 6, 2024
€1,000 Blackcab Systems SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Blackcab Systems SRL. A individual lodged a complaint with the DPA, alleging that the controller had failed to properly respond… ROMANIA · ·Art. 12, 15 Nov 4, 2024
€15M OpenAI OpCo LLC: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 15 million on OpenAI in connection with the operation of the generative AI chatbot “ChatGPT”. The DPA found that OpenAI had violated… ITALY · ·Art. 5, 6, 12 +4 Nov 2, 2024
€12,000 NEGOCIOS R&R 2020 S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined NEGOCIOS R&R 2020 S.L. EUR 12,000 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Oct 31, 2024
€4,000 GESTIÓN DE VENTAS IBERIA S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined GESTIÓN DE VENTAS IBERIA S.L. EUR 4000 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Oct 31, 2024
€900 RIVENDELL TECHNOLOGY, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 900 on RIVENDELL TECHNOLOGY, S.L. for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Oct 31, 2024
€15,000 Untold SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 15,000 on Untold SRL. During its investigation, the DPA found that the controller had failed to properly comply with a data subject's… ROMANIA · ·Art. 12, 15, 17 Oct 30, 2024
€5,000 Vodafone Romania S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA fined Vodafone Romania S.A. EUR 5,000 for sending emails to different recipients without including them in the blind carbon copy (BCC) list. This resulted in the… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Oct 28, 2024
€310M LinkedIn: Insufficient legal basis for data processing The Irish DPA (DPC) has fined LinkedIn EUR 310 million. This decision is related to an investigation following a complaint in 2018 from the French NGO 'La Quadrature Du Net'. In… Art. 60 Oct 24, 2024
€10,000 Profi Rom Food SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 10,000 on Profi Rom Food SRL. During its investigation, the DPA found that the controller had forwarded copies of several employees' ID… ROMANIA · ·Art. 5, 6 Oct 23, 2024
€180,000 IBERCAJA BANCO, S.A.: Insufficient legal basis for data processing The Spanish DPA has fined IBERCAJA BANCO, S.A. for unlawfully accessing a customer’s credit file after the termination of their contractual relationship. The DPA concluded that… SPAIN · ·Art. 6 Oct 22, 2024
€20,800 Grue municipality: Insufficient technical and organisational measures to ensure information security The Norwegian DPA fined Grue municipality EUR 20,800 following the municipality's notification of a data breach. The municipality reported that personal data of students had been… NORWAY · ·Art. 24, 32 Oct 21, 2024
€200,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. An individual had filed a complaint with the DPA because the company had given a duplicate of their… SPAIN · ·Art. 6 Oct 18, 2024
€9,000 Vilnius District Municipality Administration: Insufficient technical and organisational measures to ensure information security The Lithuanian DPA has imposed a fine of EUR 1,000 on the Vilnius District Municipality Administration. The Municipality Administration had been hacked. The attack resulted in… LITHUANIA · ·Art. 5, 32, 34 Oct 18, 2024
€5,800 POLAND DPA: Insufficient involvement of data protection officer The Polish DPA has imposed a fine of EUR 5,800 on a data controller. The controller failed to appoint a data protection officer and to provide the DPA with the contact details in… ·Art. 37 ·Insufficient involvement of data protection officer Oct 18, 2024
€1,000 KUR KLINIKUM, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1000 on KUR KLINIKUM, S.L. for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Oct 17, 2024
€5,000 Company: Lack of appointment of data protection officer The Austrian DPA has imposed a fine on a company. The controller appointed a DPO who had a conflict of interest, meaning the person was not suitable for the role. AUSTRIA · ·Art. 38 Oct 16, 2024
€3,000 Your Consulting SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Your Consulting SRL. The controller had suffered a data breach involving the unauthorized disclosure of personal data. During… ROMANIA · ·Art. 25, 32 Oct 16, 2024
Belgian DPA finds cookie banner without reject-all button and unequal withdrawal violates On 10 February 2023 the data subject, a trainee working at noyb – European Center for Digital Rights, visited the website of the controller, a Belgian media company. The data… 131/2024 ·Belgium · Oct 11, 2024
€5,000 ROCA & ASOCIADOS ABOGADOS Y ECONOMISTAS, S.L.P.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on ROCA & ASOCIADOS ABOGADOS Y ECONOMISTAS, S.L.P. The controller, a law firm, published the names and photos of its… SPAIN · ·Art. 6 Oct 4, 2024
€600 VOLTIUM CONSULTORES 2020: Insufficient cooperation with supervisory authority The Spanish DPA has fined VOLTIUM CONSULTORES 2020 EUR 600 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Oct 4, 2024
€900 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 900 on a private individual for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Oct 4, 2024
€91M Meta Platforms Ireland Limited: Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) has imposed a fine of EUR 91 million on Meta Platforms Ireland Limited (MPIL). The DPC had initiated an investigation after MPIL reported that user passwords… Sep 27, 2024
€4,000 CI & DI Food s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA imposed a fine of EUR 4,000 against CI & DI Food s.r.l. for failing to comply with a former employee's request for access to their personal data. ITALY · ·Art. 12, 15 Sep 26, 2024
€250,000 COSMOSPACE: Non-compliance with general data processing principles The French DPA imposed a fine of EUR 250,000 on COSMOSPACE. The controller is a company that offers personalized clairvoyance consultations by telephone. As part of its services,… FRANCE · ·Art. 5, 9 Sep 26, 2024
€150,000 TELEMAQUE: Non-compliance with general data processing principles The French DPA imposed a fine of EUR 150,000 on TELEMAQUE. The controller is a company that offers digital services in the field of divinatory arts, including fortune telling by… FRANCE · ·Art. 5, 9 Sep 26, 2024
€1.3M TELEFÓNICA DE ESPAÑA SAU: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1.3 million on TELEFÓNICA DE ESPAÑA SAU. The controller had reported a security incident to the DPA, stating that they had suffered a… SPAIN · ·Art. 5 Sep 26, 2024
€2,000 PPC ENERGIE MUNTENIA S.A.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on PPC ENERGIE MUNTENIA S.A. for failing to respond to a data subject's request for the deletion of their personal data in a… ROMANIA · ·Art. 12, 17 Sep 23, 2024
€600 SERVICIOS INMOBILIARIOS Y GESTIÓN RCL-MADRID, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined SERVICIOS INMOBILIARIOS Y GESTIÓN RCL-MADRID, S.L. €600 on 2024-09-23 for: Insufficient cooperation with supervisory authority. Spain · ·Art. 58 Sep 23, 2024
€1,400 Attorney: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 1,400 on an attorney. An individual had filed a complaint with the DPA because the controller did not adequately respond to their… GREECE · ·Art. 12, 31 Sep 23, 2024
€3,000 Constanța South Container Terminal SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Constanța South Container Terminal SRL. The controller had suffered a data breach in which personal data of employees had been… ROMANIA · ·Art. 32 Sep 17, 2024
€1,000 SC Class IT Outsourcing SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on SC Class IT Outsourcing SRL for failing to respond to a data subject's request for the deletion of their personal data in a… ROMANIA · ·Art. 12, 17 Sep 16, 2024
€3,000 Vodafone România SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 3,000 on Vodafone România SA for failing to respond to a data subject's request for access and deletion of their personal data in a… ROMANIA · ·Art. 12, 15, 17 Sep 16, 2024
€45,000 Hotel: €45,000 fine The Croatian DPA (AZOP) has imposed a fine of EUR 45,000 on two hotels for unlawfully processing personal data through the use of cookies. CROATIA · ·Unknown Sep 13, 2024
€190,000 Hospital: Insufficient technical and organisational measures to ensure information security The Croatian DPA (AZOP) has imposed a fine of EUR 190,000 on a hospital. The hospital had suffered a data breach in which radiological image files were irrevocably lost. AZOP had… CROATIA · ·Art. 5, 6, 12 +4 Sep 13, 2024
€35,700 Company: €35,700 fine The Croatian DPA (AZOP) has imposed fines totaling EUR 35,700 on nine companies for failing to adequately indicate their video surveillance areas and for failing to provide all… CROATIA · ·Unknown Sep 13, 2024
€5,000 Top Quality Corporation s.r.l.s.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 5,000 on Top Quality Corporation s.r.l.s. A data subject (former emplyee) had filed a complaint with the DPA due to the controller's… ITALY · ·Art. 12, 15 Sep 12, 2024
€800,000 CEGEDIM SANTÉ: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 800,000 on CEGEDIM SANTÉ. The company, which provides software for medical practices, had transferred customer data for research purposes.… FRANCE · ·Art. 5, 66 Sep 12, 2024
€842,062 Sky Italia S.r.l.: Insufficient legal basis for data processing The Italian DPA has fined Sky Italia EUR 842,062 for unlawful telemarketing. The investigation revealed that Sky contacted individuals without proper consent, including those… ITALY · ·Art. 5, 6, 130 Sep 12, 2024
€400 Private individual: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 400 on a private individual. The individual had installed video surveillance cameras, which however also recorded parts of neighboring… ITALY · ·Art. 5, 6 Sep 12, 2024
€600 KVIKU SPAIN, S.L: Insufficient cooperation with supervisory authority The Spanish DPA has fined KVIKU SPAIN, S.L. EUR 600 for failing to provide information requested by the DPA. ·Art. 58 ·Insufficient cooperation with supervisory authority Sep 11, 2024
€20,900 Eidskog municipality: Insufficient legal basis for data processing The Norwegian DPA imposed a fine of EUR 20,900 on Eidskog municipality for giving two former employees access to a whistleblower’s report without redacting sensitive health and… NORWAY · ·Art. 6 Sep 6, 2024