Content type · 2,636 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€50,000 A.S. Watson Health & Beauty Continental Europe B.V.: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of EUR 600,000 on A.S. Watson Health & Beauty Continental Europe B.V.. The controller had tracked visitors to their drugstore website… THE NETHERLANDS · ·Art. 5 May 2, 2024
€10,000 ASSOCIACIO OASIS CULTURAL: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on ASSOCIACIO OASIS CULTURAL. A discotheque operated by the controller had published videos of dancing minors on a social media… SPAIN · ·Art. 6 Apr 26, 2024
€16,000 Association: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 16,000 on an association for processing personal data without a sufficient legal basis. FRANCE · ·Art. 6 Apr 25, 2024
€5,000 Dly S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Dly S.r.l.. The company had installed video surveillance systems in its premises, however, their specific use was not authorized. ITALY · ·Art. 5, 88, 114 Apr 24, 2024
€3,000 I.N.P.A.S.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on I.N.P.A.S. (Istituto Nazionale di Previdenza e di Assistenza Sociale). During its investigation, the DPA found that a former… ITALY · ·Art. 2, 5, 6 +1 Apr 24, 2024
€2,000 ALPHA BANK ROMANIA SA.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on ALPHA BANK ROMANIA SA. The controller had suffered a data breach due to an employee mismanaging recording systems. During its… ·Art. 29, 32 ·Insufficient technical and organisational measures to ensure information security Apr 23, 2024
€2,000 S.C. Tensa Art Design S.A..: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 2,000 on S.C. Tensa Art Design S.A.. The controller had processed the personal data of a data subject for marketing purposes without the… ROMANIA · ·Art. 6 Apr 22, 2024
CROATIA DPA: Insufficient fulfilment of information obligations The Croatian DPA (AZOP) has imposed seven fines totaling EUR 16,000 on data controllers for failing to adequately mark video-monitored areas. This lack of marking resulted in… ·Art. 13, 27 ·Insufficient fulfilment of information obligations Apr 22, 2024
€20,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 20,000 on a data controller operating in the gambling and betting sector. The data controller collected and processed personal… CROATIA · ·Art. 6, 7, 13 Apr 22, 2024
€15,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 15,000 on a data controller operating in the gambling and betting sector. The data controller collected and processed personal… CROATIA · ·Art. 6, 7, 13 Apr 22, 2024
€1,000 DELSA ALQUILERES S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,000 on DELSA ALQUILERES S.L.. The controller had installed video surveillance cameras in a residential complex which, among other… SPAIN · ·Art. 6, 13 Apr 12, 2024
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The individual had installed a video surveillance camera which, among other things, also recorded public… SPAIN · ·Art. 5 Apr 12, 2024
€1.2M CAIXABANK, S.A: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on CAIXABANK, S.A. A person filed a complaint with the DPA because they were asked to fill out a form with personal data. A clause on the form… SPAIN · ·Art. 6 Apr 12, 2024
€100,000 Olimpia S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Olimpia S.r.l.. During its investigation, the DPA found that data subjects had received advertising calls on behalf of the… ITALY · ·Art. 5, 6, 24 +3 Apr 11, 2024
€1,000 Store owner: Insufficient fulfilment of information obligations The Italian DPA has fined a store owner EUR 1,000. The controller had installed video surveillance cameras in its premises without properly informing data subjects about the… ITALY · ·Art. 5, 13 Apr 11, 2024
€20,000 Istituto Nazionale di Previdenza Sociale: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 20,000 on the Italian National Institute of Social Security (INPS). The controller had published personal data of participants in a… ITALY · ·Art. 2, 5, 6 Apr 11, 2024
€100,000 Facile.Energy S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Facile.Energy S.r.l.. During its investigation, the DPA found that data subjects had received advertising calls on behalf of… ITALY · ·Art. 5, 6, 24 +3 Apr 11, 2024
€112,000 VODAFONE ESPAÑA, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on VODAFONE ESPAÑA, S.A.U.. A person had lodged a complaint with the DPA because they had received their telephone bill which, however, had been… SPAIN · ·Art. 5 Apr 5, 2024
€525,000 HUBSIDE.STORE: Insufficient legal basis for data processing The French DPA has imposed a fine of EUR 525,000 on HUBSIDE.STORE. The company had used data from data brokers for commercial acquisition campaigns without ensuring that the data… FRANCE · ·Art. 6, 14 Apr 4, 2024
€2,400 Restaurant owner: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The data controller had installed a video surveillance camera in their restaurant, which also captured the guest area.… SPAIN · ·Art. 5 Mar 25, 2024
€10,000 Stjörnuna ehf: Non-compliance with general data processing principles The Icelandic DPA has imposed a fine of EUR 10,000 on Stjörnuna ehf. (the operator of a Subway branch). An employee had filed a complaint with the DPA regarding video surveillance… ICELAND · ·Art. 5, 6, 12 +1 Mar 24, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 200,000 on Vodafone España, S.A.U. A data subject had filed a complaint against the data controller as unauthorized fraudsters… SPAIN · ·Art. 6 Mar 15, 2024
€800 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The… SPAIN · ·Art. 5, 13 Mar 15, 2024
€20,000 Centro Riparazioni Piacentino S.p.A.: Non-compliance with general data processing principles The Italian DPA (Garante) imposed a fine of EUR 20,000 on Centro Riparazioni Piacentino S.p.A.. The controller had kept a former employee's email account active despite the… ITALY · ·Art. 5, 13 Mar 7, 2024
€2,000 Bar: Non-compliance with general data processing principles The Italian DPA has fined the owner of a bar EUR 2,000. The controller had operated video surveillance cameras in one of their premises without the required authorization.… ITALY · ·Art. 5, 13, 114 Mar 7, 2024
€856,000 Verkkokauppa.com: Non-compliance with general data processing principles The Finnish DPA has imposed a fine of EUR 856,000 on Verkkokauppa.com Plc for not specifying the retention period of customer account data of e-commerce customers. The DPA also… FINLAND · ·Art. 5, 25 Mar 6, 2024
€5,000 EURO MINI STORAGE ROMANIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of 5,000 euros on EURO MINI STORAGE ROMANIA SRL. The controller had suffered a data breach in which customer data was accessed without… ·Art. 24, 32 ·Insufficient technical and organisational measures to ensure information security Mar 5, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN · ·Art. 6 Mar 1, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN · ·Art. 6 Feb 29, 2024
€3,000 VESTA CEU ROMÂNIA SRL.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on VESTA CEU ROMÂNIA SRL. The controller had reported a data breach to the DPA pursuant to Art. 33 GDPR. The controller had… ROMANIA · ·Art. 32 Feb 26, 2024
€20,000 Company: Insufficient legal basis for data processing Croatian Data Protection Authority (azop) fined Company €20,000 on 2024-02-26 for: Insufficient legal basis for data processing. Croatia · ·Art. 6, 7, 13 Feb 26, 2024
€2,000 Camera di Commercio Industria Artigianato e Agricoltura: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Camera di Commercio Industria Artigianato e Agricoltura. An individual had filed a complaint against the controller with the DPA… ITALY · ·Art. 2, 5, 6 Feb 22, 2024
€50,000 Azienda Trasporto Passeggeri Emilia-Romagna S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 50,000 on the transport company azienda Trasporto Passeggeri Emilia-Romagna S.p.A.. The controller provided insufficient information on… ITALY · ·Art. 5, 6, 7 +4 Feb 22, 2024
€100,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA imposed a fine of EUR 100,000 on VODAFONE ESPAÑA, S.A.U. for insufficient legal basis for data processing. The data subject had filed a complaint against the… SPAIN · ·Art. 6 Feb 13, 2024
€365,000 CTC EXTERNALIZACIÓN, S.L: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 365,000 on CTC EXTERNALIZACIÓN, S.L.. An employee had filed a complaint with the DPA due to the fact that the controller had requested… SPAIN · ·Art. 13, 32, 35 Feb 12, 2024
€300,000 Medtronic Italia: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 300,000 on Medtronic Italia. The controller had sent emails in an open distribution list to hundreds of individuals using the… ITALY · ·Art. 5, 9, 12 +2 Feb 8, 2024
€30,000 CENTRO MÉDICO SALUS BALEARES, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on CENTRO MÉDICO SALUS BALEARES, S.L.. An individual had filed a complaint with the DPA due to the clinic's use of an electronic… SPAIN · ·Art. 5, 32 Feb 8, 2024
€800,000 NTT Data Italia S.P.A: Insufficient fulfilment of data breach notification obligations The Italian DPA has imposed a fine of EUR 800,000 on NTT Data Italia S.P.A. The fine is related to the fine imposed on UniCredit (ETid-2227). UniCredit had contracted NTT to carry… ITALY · ·Art. 28, 33 Feb 8, 2024
€200,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN · ·Art. 6 Feb 8, 2024
€3M IBERDROLA, S.A.: Non-compliance with general data processing principles The Spanish DPA has fined IBERDROLA, S.A. EUR 3 million following a cyberattack on I-DE Redes, which led to the compromise of customer data from millions of individuals. Although… SPAIN · ·Art. 5, 32 Feb 7, 2024
€2,000 Account Exchange SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 2,000 on Account Exchange SRL for using personal data without the consent of the data subjects. ROMANIA · ·Art. 5, 6 Feb 7, 2024
€160,000 SANITAS, S.A. DE SEGUROS: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on SANITAS, S.A. DE SEGUROS. A customer had filed a complaint with the DPA due to the fact that the controller had concluded a contract without… SPAIN · ·Art. 6, 9 Feb 6, 2024
€5M ENERGYA VM GESTIÓN DE ENERGÍA, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined ENERGYA VM GESTIÓN DE ENERGÍA, S.L. EUR 5 million following an investigation into unlawful personal data processing by Nivalco, a company… SPAIN · ·Art. 5 Feb 6, 2024
€500 Owners' association: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 500 on an owners' association for publishing personal data of an individual in a WhatsApp group without a valid legal basis and for… ROMANIA · ·Art. 5, 6, 12 Feb 5, 2024
€3.5M I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3.5 million on I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U. The controller had suffered a cyber attack on its GEA web application resulting… SPAIN · ·Art. 5, 32 Feb 5, 2024
€10,000 FRANCE DPA: €10,000 fine The French DPA has imposed a fine of EUR 10,000 on a data controller due to data security vulnerabilities. ·Unknown Jan 31, 2024
€2,000 Sectorul 1 al Municipiului București: Insufficient cooperation with supervisory authority The Romanian DPA has fined Sectorul 1 al Municipiului București EUR 2,000 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Jan 30, 2024
€2,000 Istituto Comprensivo Statale “F.S. Cabrini: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Istituto Comprensivo Statale “F.S. Cabrini. The controller had published a document, which contained personal data of school… ITALY · ·Art. 2, 5, 6 Jan 24, 2024
€1,200 VUKMAL TRADE, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a VUKMAL TRADE, S.L.. A former employee had filed a complaint against the controller due to unlawful disclosure of their private mobile… SPAIN · ·Art. 6 Jan 24, 2024
€20,000 Pharmaceutical wholesaler: €20,000 fine The French DPA has imposed a fine of EUR 20,000 on a pharmaceutical wholesaler due to violations of several regulations, including a lack of data security and insufficient… FRANCE · ·Unknown Jan 24, 2024