Content type · 1,282 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€10,000 Favrskov municipality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 10,000 on Favrskov municipality. On August 19, 2020, the DPA received a notification from Favrskov Municipality of a personal data breach… DENMARK · ·Art. 32 Sep 16, 2021
€5,000 Ciechi Ardizzone Gioeni di Catania: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the Ciechi Ardizzone Gioeni di Catania residential home for blind people. A visitor to the residence filed a complaint… ITALY · ·Art. 5, 12, 13 +1 Sep 16, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that, unauthorized third parties had… SPAIN · ·Art. 6 Sep 14, 2021
€1,500 AMPUDIA DIAZ, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on AMPUDIA DIAZ, S.L.. The controller had installed a video surveillance system in its premises, which recorded a public… SPAIN · ·Art. 5, 13 Sep 4, 2021
€8,000 Rhodes Municipal Transport Company: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 8,000 on the Rhodes Municipal Transport Company. A former employee had filed a complaint against the controller with the DPA. The former… GREECE · ·Art. 5, 12, 15 Sep 3, 2021
€4,000 Automecanica Jerez, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has fined Automecanica Jerez, S.L. EUR 4,000. The controller had sent commercial e-mails to a large number of people without their consent. In doing so, the… SPAIN · ·Art. 5, 21, 32 Sep 2, 2021
€225M WhatsApp Ireland Ltd.: Insufficient fulfilment of information obligations The Irish DPA (DPC) has imposed a fine of EUR 225,000,000 on WhatsApp Ireland Ltd. The DPA had started extensive investigations into the messaging service's compliance with… Art. 5, 12, 13 +1 ·Insufficient fulfilment of information obligations Sep 2, 2021
€6,000 Furnishyourspace S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 6,000 on FurnishYourSpace S.L.. The AEPD had received a complaint from the Berlin DPA via the EU Internal Market Information System… SPAIN · ·Art. 5, 6, 12 +2 Aug 30, 2021
€5,000 NOW DOCTOR – Εταιρία Παροχής Ηλεκτρονικών Υπηρεσιών Αναζήτησης και Προβολής Ιατρών Ε.Π.Ε.: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 5,000 on the operator of the medical platform nowdoctor.gr that enables online booking of medical appointments. A doctor had filed a… GREECE · ·Art. 5, 6, 12 +1 Aug 26, 2021
€1,000 Owners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on an owners' association. The controller had unlawfully installed a video surveillance system in a residential complex… SPAIN · ·Art. 5 Aug 26, 2021
€1,500 MOVE Ireland: Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) has fined the organization MOVE (Men Overcoming Violence) EUR 1,500. MOVE is a charity working in the field of domestic violence. The organization aims to… Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Aug 20, 2021
€2,000 DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES, S.L.. The controller had forwarded two emails containing personal data… SPAIN · ·Art. 5 Aug 10, 2021
€3,000 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a private individual. Two neighbors had complained about the individual to the DPA due to the fact that he had installed… SPAIN · ·Art. 5 Aug 5, 2021
€200 Private Individual: Insufficient legal basis for data processing The Romanian DPA (ANSPDCP) has imposed a fine of EUR 200 on a private individual due to the unlawful disclosure of personal data. The controller had disclosed personal data of… ROMANIA · ·Art. 5, 6, 14 Jul 30, 2021
€600 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a private individual EUR 600 for unauthorized video surveillance. The controller had installed a video surveillance camera which covered, among… SPAIN · ·Art. 5 Jul 30, 2021
€3,000 INSTAPACK, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on INSTAPACK, S.L.. A data subject had filed a complaint with the DPA. The reason for the complaint is that he had been… SPAIN · ·Art. 5, 6 Jul 27, 2021
€2,000 Owners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on an owners' association. A data subject claimed to the DPA that the controller had installed a camera that recorded both… SPAIN · ·Art. 5 Jul 27, 2021
€2,400 PODEMOS PARTIDO POLÍTICO: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on the political party PODEMOS PARTIDO POLÍTICO. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5, 13 Jul 27, 2021
€900 Owners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on an owners' association. A data subject claimed to the DPA that the controller had installed a camera on one of his houses, which… SPAIN · ·Art. 5 Jul 27, 2021
€3,000 UST GLOBAL ESPAÑA, S.A.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on UST GLOBAL ESPAÑA, S.A.. An employee filed a complaint against the controller with the DPA. UST GLOBAL ESPAÑA, S.A. was… SPAIN · ·Art. 5 Jul 27, 2021
€4,000 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a private individual EUR 4,000 for unauthorized video surveillance. The controller had installed two cameras on a public road and another in a… SPAIN · ·Art. 5 Jul 27, 2021
€2.5M Mercadona S.A.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Mercadona S.A. EUR 2,520,000. The controller had installed facial recognition systems in Mercadona stores for the purpose of tracking individuals… SPAIN · ·Art. 5, 6, 9 +4 Jul 26, 2021
€400,000 Monsanto Company: Insufficient fulfilment of information obligations The French DPA (CNIL) has fined MONSANTO EUR 400,000. In May 2019, several media revealed that MONSANTO was in possession of a file containing the personal data of more than 200… FRANCE · ·Art. 14, 28 Jul 26, 2021
€200,000 Regione Lombardia: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 200,000 on the Region of Lombardy. The region had published on its website the personal data of more than 100,000 students who… ITALY · ·Art. 5, 6 Jul 22, 2021
€30,000 Flowbird Italia s.r.l.: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 30,000 on Flowbird Italia s.r.l.. The Garante had launched an investigation following a complaint from an individual who had… ITALY · ·Art. 5, 6, 30 Jul 22, 2021
€2.5M Deliveroo Italy s.r.l.: Non-compliance with general data processing principles The Italian DPA (Garante) has fined food delivery service Deliveroo Italy s.r.l. EUR 2,500,000 for unlawfully processing the personal data of approximately 8000 drivers. Garante's… ·Art. 5, 13, 22 +5 ·Non-compliance with general data processing principles Jul 22, 2021
€400,000 Atac s.p.a.: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 400,000 against Atac s.p.a.. The Garante had launched an investigation following a complaint from an individual who had… ITALY · ·Art. 5, 6, 30 +1 Jul 22, 2021
€800,000 Roma Capitale: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 800,000 on Roma Capitale. The Garante had launched an investigation following a complaint from an individual who had complained… ITALY · ·Art. 5, 12, 13 +3 Jul 22, 2021
€1.8M SGAM AG2R LA MONDIALE: Non-compliance with general data processing principles The French DPA (CNIL) has fined private insurer SGAM AG2R LA MONDIALE EUR 1,750,000. The CNIL had carried out an inspection at the AG2R LA MONDIALE group in 2019. On this… FRANCE · ·Art. 5, 13, 14 Jul 20, 2021
€746M Amazon Europe Core S.à.r.l.: Non-compliance with general data processing principles In its quarterly report, Amazon.com Inc. announced that the DPA from Luxembourg (CNPD) had fined Amazon Europe Core S.à r.l. EUR 746,000,000 for failing to process personal data… LUXEMBOURG · ·Non-compliance with general data processing principles Jul 16, 2021
€67,900 Region of Syddanmark: Insufficient technical and organisational measures to ensure information security The Danish DPA (Datatilsynet) has fined the Region of Syddanmark EUR 67,900 for failing to comply with its obligation as a data controller to implement adequate security measures.… DENMARK · ·Art. 32 Jul 16, 2021
€80,700 Medicals Nordic I/S: Non-compliance with general data processing principles The Danish DPA (Datatilsynet) has fined Medicals Nordic I/S EUR 80,700. In January 2021, the DPA became aware that Medicals Nordic was using WhatsApp to transmit confidential… DENMARK · ·Non-compliance with general data processing principles Jul 9, 2021
€1,500 Aparcamiento Arcusa S.L.U.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on Aparcamiento Arcusa S.L.U. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5, 13 Jul 9, 2021
€2,000 Homeowners Association: Non-compliance with general data processing principles Usage of CCTV camera which also captured the public space in violation of the principle of data minimisation. SPAIN · ·Art. 5 Jul 7, 2021
€53,800 Nordbornholms Byggeforretning Aps: Insufficient legal basis for data processing The Danish DPA ( Datatilsynet) has imposed a fine of EUR 53,800 on Nordbornholms Byggeforretning Aps. In 2018, the DPA was contacted by a data subject who complained that his… DENMARK · ·Art. 5, 6 Jul 7, 2021
€25,000 Higher Education Institution: Non-compliance with general data processing principles The Finnish DPA imposed a fine of EUR 25,000 on a higher education institution for data protection violations in the processing of employee location data. The controller had… FINLAND · ·Art. 5, 6 Jul 5, 2021
€1,500 Private Individual: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. That private individual had published personal data of the data subject on a website without her… SPAIN · ·Art. 6 Jul 2, 2021
€12,500 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 12,500 on a company. The company had installed a video surveillance system for the purpose of protecting company property,… ·Art. 5, 13 ·Non-compliance with general data processing principles Jun 29, 2021
€8,500 Magazine publisher: Insufficient legal basis for data processing The Finnish DPA has imposed a fine of EUR 8,500 on a magazine publisher. The DPA received four complaints against the magazine publisher for unsolicited telephone advertising.The… FINLAND · ·Art. 5, 7, 12 +3 Jun 24, 2021
€10,000 TNT EXPRESS WORLDWIDE SPAIN, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on TNT EXPRESS WORLDWIDE SPAIN, S.L.. The data subject had placed a private order with the controller and had entered the… ·Art. 5 ·Non-compliance with general data processing principles Jun 22, 2021
€35,300 Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A.: Insufficient fulfilment of data breach notification obligations The controller had sent an email to that contained personal data of a customer to the wrong recipient. The leaked data included data such as the name, postal address of the data… POLAND · ·Art. 33, 34 Jun 21, 2021
€20,000 UAB VS FITNESS: Non-compliance with general data processing principles The Lithuanian DPA (VDAI) has imposed a fine of EUR 20,000 on UAB VS FITNESS. After receiving a notification from an individual stating that scanning a fingerprint was necessary… LITHUANIA · ·Art. 5, 9, 13 +2 Jun 21, 2021
€1.6M Storstockholms Lokaltrafik: Insufficient legal basis for data processing The Swedish DPA has fined Storstockholms Lokaltrafik (Stockholm Local Transport Company) EUR 1,600,000. The controller had equipped ticket inspectors with body-worn cameras, which… SWEDEN ·Art. 5, 6, 13 ·Insufficient legal basis for data processing Jun 21, 2021
€27,000 Vejle Municipality: Insufficient technical and organisational measures to ensure information security The Danish DPA (Datatilsynet) has imposed a fine of EUR 27,000 on Vejle municipality. The Danish DPA had started investigations against the municipality after it had reported a… DENMARK · ·Art. 32 Jun 16, 2021
€34,000 Huppuís ehf: Non-compliance with general data processing principles The Icelandic DPA (Persónuvernd) has imposed a fine of EUR 34,000 on Huppuís ehf. A former employee filed a complaint against the controller with the DPA. The reason for this was… ICELAND ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Jun 15, 2021
€500,000 BRICO PRIVÉ: Non-compliance with general data processing principles The French DPA (CNIL) has imposed a fine of EUR 500,000 on BRICO PRIVÉ. CNIL conducted three inspections at BRICO PRIVÉ between 2018 and 2021 and identified several deficiencies… FRANCE · ·Art. 5, 13, 17 +2 Jun 14, 2021
€7,600 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,600 on a company. This company had installed a video surveillance system for the purpose of protecting the company's… ·Art. 5, 13 ·Non-compliance with general data processing principles Jun 11, 2021
€7,200 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 7,200 on a company. The company had installed a video surveillance system to protect the company's assets, prevent… ·Art. 5, 13, 32 ·Non-compliance with general data processing principles Jun 11, 2021
€40,000 aiComply S.r.l.: Insufficient technical and organisational measures to ensure information security The identity of whistleblowers must be protected by special confidentiality rules, as the information processed is particularly sensitive and the risk of retaliation and… ITALY · ·Art. 28, 32 Jun 10, 2021
€2.6M Foodinho s.r.l.: Non-compliance with general data processing principles The Italian DPA (Garante) has fined Foodinho s.r.l. EUR 2,600,000. Foodinho is an Italian food delivery service. The investigation against Foodinho mainly focused on the drivers… ITALY · ·Art. 5, 13, 22 +5 Jun 10, 2021