Content type · 118 documents in this view · 3,634 in total

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filtering by Topic Clear filter Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
51–100 of 118 sort newestlargest fineoldest
€50,000 LA VANGUARDIA EDICIONES, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on LA VANGUARDIA EDICIONES, S.L.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN ·aepd ·Art. 5 Social Media IP Address Controllers Mar 21, 2023
€50,000 DISPLAY CONNECTORS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on DISPLAY CONNECTORS, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN ·aepd ·Art. 5 Social Media IP Address Telecommunications Mar 21, 2023
€50,000 DIARIO ABC, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on DIARIO ABC, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's… SPAIN ·aepd ·Art. 5 Social Media IP Address Controllers Mar 21, 2023
€50,000 EL DIARIO DE PRENSA DIGITAL SL.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on EL DIARIO DE PRENSA DIGITAL SL.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN ·aepd ·Art. 5 Social Media IP Address Controllers Mar 21, 2023
€50,000 UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.. Several media outlets, including the controller had published an audio recording… SPAIN ·aepd ·Art. 5 Social Media IP Address Controllers Mar 21, 2023
€3,000 CASAL DE L'ESPLUGA DE FRANCOLÍ: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on CASAL DE L'ESPLUGA DE FRANCOLÍ. A club managed by the controller had uploaded pictures of a competition showing minors on social media . The… SPAIN ·aepd ·Art. 6 Social Media Controllers Minors Jan 25, 2023
€390M Meta Platforms Ireland Limited: Non-compliance with general data processing principles The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 390 million. The DPA has imposed a fine of EUR 210 million for violations related to the provision of its Facebook… Social Media Notified Body Competence Challenges and Dispute Resolution Fairness & Transparency Jan 4, 2023
€9,600 PIONIER (law firm): Insufficient legal basis for data processing The Polish DPA has imposed a fine of EUR 9,600 on the law firm PIONIER. The law firm mainly represents victims of traffic accidents in proceedings against insurance companies and… POLAND ·UODO ·Art. 5, 6, 9 Social Media Insurance Health Data Nov 30, 2022
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN ·aepd ·Art. 5 Video Surveillance Social Media IP Address Nov 29, 2022
€265M Meta Platforms Ireland Limited: Insufficient technical and organisational measures to ensure information security The Irish DPA has fined Meta Platforms Ireland Limited EUR 265 million. The DPA had launched an investigation against Meta in 2021 after media reports indicated that a dataset… Social Media Security Telecommunications Nov 25, 2022
€10,000 SOPHIE ET VOILA, S.L: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on SOPHIE ET VOILA, S.L..The wedding dress company had published a picture of a customer in a wedding dress on its Instagram… SPAIN ·aepd ·Art. 6 Lawful Basis Social Media Personal Data Sep 16, 2022
€405M Meta Platforms, Inc.: Non-compliance with general data processing principles The Irish DPA (DPC) has imposed a fine of EUR 405,000,000 on Meta Platforms, Inc. (Instagram). Following the investigation, the DPC submitted a draft decision under Art. 60 GDPR… IRELAND ·Art. 5, 6, 12 +3 ·Non-compliance with general data processing principles Notified Body Competence Challenges and Dispute Resolution Social Media IP Address Sep 5, 2022
€5,000 Bar owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a bar owner EUR 5,000. The owner had unlawfully shared recordings from the CCTV in the bar via WhatsApp and other social media platforms. SPAIN ·aepd ·Art. 5 Video Surveillance Social Media IP Address Jul 19, 2022
Garante per la protezione dei dati personali (Italy) - 9788429 Social media platform TikTok (the controller) provided personalized advertising to its users (the data subjects) on the legal basis of consent (Article 6(1)(a) GDPR). In June… 9788429 ·Art. 5, 6, 122 Cookies Legitimate Interest Social Media Jul 7, 2022
€30,000 CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A. Several media outlets, including the controller had published an audio recording of a… SPAIN ·aepd ·Art. 5 Social Media IP Address Controllers Jun 23, 2022
€30,000 RADIO TELEVISION MADRID, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on RADIO TELEVISION MADRID, S.A.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's… SPAIN ·aepd ·Art. 5 Social Media IP Address Controllers Jun 23, 2022
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 10,000. The individual had created a humiliating and discriminatory video of three siblings based on their skin color, and… SPAIN ·aepd ·Art. 6 Social Media Processing Processing Agreement Jun 9, 2022
€50 APD/GBA (Belgium) - 85/2022 On 16 January 2019, the Executive-committee of the Belgian DPA (GBA) started an investigation on the use of cookies on Belgian media websites. The controller in this case is… Art. 4, 5, 6 +3 Cookies Telecommunications Direct Marketing May 25, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had taken photos of a group of minors as well as police officers without their consent and… SPAIN ·aepd ·Art. 6 Social Media Consent Processing May 20, 2022
€1,000 LORIS FUEL SHOP SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on the gas station operator LORIS FUEL SHOP SRL. A person had filed a complaint with the DPA because pictures of him were… ROMANIA ·ANSPDCP ·Art. 29, 32 Video Surveillance Integrity and Confidentiality Principle Security May 12, 2022
€10,000 Nationale Maatschappij der Belgische Spoorwegen: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 10,000 on the Belgian national railroad company (Nationale Maatschappij der Belgische Spoorwegen). A Twitter user who had received an… BELGIUM ·APD ·Art. 5, 6, 12 +1 Social Media Right to Object Personal Data May 4, 2022
€200,000 Amiu S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 200,000 on Amiu S.p.A.. The company operates the waste collection service for the city of Taranto and acted as a processor for this… ITALY ·Garante ·Art. 5, 6, 28 +1 Video Surveillance Monitoring Audit Logs Apr 28, 2022
€150,000 Tarento municipality: Insufficient fulfilment of information obligations The Italian DPA has imposed a fine of EUR 150,000 on Tarento municipality. The company Amiu S.p.A had operated the local waste collection service on behalf of the municipality.… ITALY ·Garante ·Art. 5, 12, 13 +3 Video Surveillance DPIA Monitoring Apr 28, 2022
€17M Meta Platforms Ireland Limited: Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) has imposed a fine of EUR 17 million on Meta Platforms Ireland Limited (former Facebook Ireland Limited). The decision is based on twelve notifications of data… Art. 5, 24 Social Media Security Processing Agreement Mar 15, 2022
€89,250 Retail company (name not available at the moment): Insufficient technical and organisational measures to ensure information security A retail company, i.e. the data controller, reported the breach of personal data to the DPA informing that its employees have recorded video surveillance footage via mobile phone… CROATIA ·azop ·Art. 32 Data Breaches Integrity and Confidentiality Principle Controllers Mar 8, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had published audiovisual material of a court trial on Twitter without obtaining the… SPAIN ·aepd ·Art. 6 Social Media Consent Processing Feb 4, 2022
€1,200 Researcher: Non-compliance with general data processing principles The Belgian DPA has fined a researcher EUR 1,200. The fine was issued in connection with another fine against the NGO EU DisinfoLab. The researcher was employed at the NGO. In… BELGIUM ·APD ·Art. 5, 6, 9 +3 Religious Beliefs Fairness & Transparency Social Media Jan 27, 2022
BfDI (Germany) - 24-191 II The data subject is a customer and user of services by the Deutsche Telekom AG (controller), the biggest telecommunications and internet provider in Europe. The data subject… 24-191 II#4781 ·Art. 15, 20, 95 Recipient Telecommunications Data Portability Jan 27, 2022
€2,800 EU DisinfoLab: Non-compliance with general data processing principles The Belgian DPA has fined the NGO EU DisinfoLab EUR 2,700. In 2018, the NGO published an analysis to identify the possible political origin of tweets circulating on a particularly… BELGIUM ·APD ·Art. 5, 6, 9 +5 Religious Beliefs Social Media Fairness & Transparency Jan 27, 2022
Belgian DPA rules on competence in cross-border cookie consent complaint involving The respondent owns a website 'YourOnlineChoices', through which data subjects can control their ad experience online. When browsing the web and visiting different websites, they… 11/2022 ·Belgium ·APD/GBA Cookies Legitimate Interest Supervisory Authorities Jan 21, 2022
€2,000 MEETING PUERTO C.B.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on MEETING PUERTO C.B.. The data controller had unlawfully published a picture of the complainant with his partner on Facebook and… SPAIN ·aepd ·Art. 6 Social Media Controllers Processing Agreement Jan 17, 2022
EDPS - 2020-1013 In January 2021, noyb filed a complaint against the European Parliament on behalf of six Members of the European Parliament over an internal coronavirus testing website. The… 2020-1013 ·European Union ·Art. 6, 13 Controllers Personal Data Legitimate Interest Jan 5, 2022
€5,000 Cyprus Judo Federation: Insufficient cooperation with supervisory authority The Cypriot DPA has imposed a fine on the Cyprus Judo Federation. The father of a member had filed a complaint with the DPA because the judo coach of his minor son had published… Art. 31 ·Insufficient cooperation with supervisory authority Social Media Supervisory Authorities Supervision Jan 1, 2022
€150M CNIL rejects Google's stay request and ne bis in idem challenge in cookie consent case Google LLC is a subsidiary owned wholly by Alphabet Inc. Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and… France ·Art. 56 Cookies Telecommunications Material scope (GDPR) Dec 31, 2021
€60M Facebook Ireland Ltd.: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 60,000,000 on Facebook Ireland Ltd. The CNIL received several complaints regarding the manner in which cookies… FRANCE ·CNIL ·Art. 82 Social Media Cookies Direct Marketing Dec 31, 2021
€6,000 REAL CLUB NÁUTICO DE RIBADEO: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on REAL CLUB NÁUTICO DE RIBADEO. The controller had uploaded links to court decisions containing personal data of the data… SPAIN ·aepd ·Art. 6 Personal Data Social Media Controllers Dec 28, 2021
€6,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 6,000 on a private individual. The person had shared a video on Twitter showing images of a sexual assault by a man on a woman. The… SPAIN ·aepd ·Art. 6 Legitimate Interest Social Media Processing Dec 21, 2021
€10,000 Centro di Medicina preventiva s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has fined Centro di Medicina preventiva s.r.l. EUR 10,000. The controller reported a database under Art. 33 GDPR in connection with a cyberattack by a… ITALY ·Garante ·Art. 5, 25, 32 +1 Security Health Data Healthcare Dec 16, 2021
€30,000 Casa di cura Fondazione Gaetano e Piera Borghi s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has fined Casa di cura Fondazione Gaetano e Piera Borghi s.r.l. EUR 30,000. The nursing home notified the DPA of a data breach pursuant to Art. 33 GDPR.… ITALY ·Garante ·Art. 5, 32 Data Breaches Security Right of Access Dec 2, 2021
€7,000 Società Med Store Saronno s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has fined Società Med Store Saronno s.r.l. EUR 7,000. The nursing home notified the DPA of a data breach pursuant to Art. 33 GDPR. The facility had… ITALY ·Garante ·Art. 5, 32 Data Breaches Security Healthcare Dec 2, 2021
€10,000 MAF.COM ESQUI CLUB: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on MAF.COM ESQUI CLUB. The mother of an underage girl who had attended ski lessons with the controller filed a complaint… SPAIN ·aepd ·Art. 7 Social Media Controllers Processing Agreement Oct 11, 2021
Facebook Ireland Limited: Insufficient fulfilment of information obligations The organization 'None of your business' (NOYB) published a draft decision of the Irish DPA (DPC) on October 13, 2021, which indicates that it proposes a fine between EUR 28… Art. 5, 12, 13 ·Insufficient fulfilment of information obligations Social Media Processing Agreement Telecommunications Oct 6, 2021
€5,000 La Prima S.r.l.: Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the real estate portal La Prima S.r.l.. A data subject had filed a complaint against the controller with the DPA. She… ITALY ·Garante ·Art. 5, 6, 24 +1 Social Media IP Address Controllers Sep 16, 2021
€9,000 Website operator: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 9,000 on the controller of a website. A person had filed a complaint with the DPA due to the fact that the controller had… SPAIN ·aepd ·Art. 6, 13 Personal Data Social Media Controllers Sep 13, 2021
€225M WhatsApp Ireland Ltd.: Insufficient fulfilment of information obligations The Irish DPA (DPC) has imposed a fine of EUR 225,000,000 on WhatsApp Ireland Ltd. The DPA had started extensive investigations into the messaging service's compliance with… Art. 5, 12, 13 +1 ·Insufficient fulfilment of information obligations Notified Body Competence Challenges and Dispute Resolution Fairness & Transparency Social Media Sep 2, 2021
€20,000 National Bank of Greece: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 20,000 on the National Bank of Greece. A data subject had filed a complaint against a company and the bank after they failed to comply… HDPA ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Personal Data Social Media Controllers Aug 26, 2021
€20,000 Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 20,000 on Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ. A data subject had filed a complaint against the controller after it failed to… GREECE ·HDPA ·Art. 12, 15 Personal Data Social Media Controllers Aug 26, 2021
€5,000 CLUB GIMNASIA RÍTMICA SAN ANTONIO: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on CLUB GIMNASIA RÍTMICA SAN ANTONIO. A person had filed a complaint against the controller with the AEPD based on the… SPAIN ·aepd ·Art. 6 Social Media Controllers Processing Agreement Aug 9, 2021
€200 Private Individual: Insufficient legal basis for data processing The Romanian DPA (ANSPDCP) has imposed a fine of EUR 200 on a private individual due to the unlawful disclosure of personal data. The controller had disclosed personal data of… ROMANIA ·ANSPDCP ·Art. 5, 6, 14 Personal Data Social Media Controllers Jul 30, 2021
€400,000 Monsanto Company: Insufficient fulfilment of information obligations The French DPA (CNIL) has fined MONSANTO EUR 400,000. In May 2019, several media revealed that MONSANTO was in possession of a file containing the personal data of more than 200… FRANCE ·CNIL ·Art. 14, 28 Fairness & Transparency Social Media Processors Jul 26, 2021