Content type · 2,395 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€50,000 Athens Urban Transport Organization: Non-compliance with general data processing principles The Hellenic DPA imposed a fine of EUR 50,000 on the Athens Urban Transport Organization. As part of its investigation, the DPA found that the controller had failed to comply with… GREECE · ·Art. 5, 25, 35 Sep 25, 2023
€2,000 UAT Comuna Albeni: Insufficient cooperation with supervisory authority The Romanian DPA has fined UAT Comuna Albeni EUR 2,000 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Sep 25, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 25, 2023
€17,000 FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with… SPAIN · ·Art. 9, 13 Sep 25, 2023
€12,000 CHATWITH.IO WORLDWIDE, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 12,000 on the website operator CHATWITH.IO WORLDWIDE, S.L. During its investigation, the DPA found that the controller had failed to… SPAIN · ·Art. 5, 13, 22 Sep 23, 2023
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 19, 2023
€1,000 NN Asigurări de Viață S.A.: Insufficient fulfilment of data subjects rights The Romanian DPA has fined NN Asigurări de Viață S.A. EUR 1,000. A person had filed a complaint for receiving advertising messages, although they had objected to receiving… ROMANIA · ·Art. 21 Sep 18, 2023
€30,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 30,000 on a company engaged in gambling and betting activities due to three identified violations of the GDPR. As noted by AZOP,… CROATIA · ·Art. 6, 7, 13 Sep 14, 2023
€10,000 Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb for failing to adequately comply with its obligation to comply… ITALY · ·Art. 12 Sep 14, 2023
€42,000 Intesa Sanpaolo Spa: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. ITALY · ·Art. 15 Sep 14, 2023
€10,000 San Severo municipality: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 10,000 on San Severo municipality. The municipality had published a document containing personal data of employees on its website without a… ITALY · ·Art. 2, 5, 6 Sep 14, 2023
€20,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 20,000 on a company engaged in gambling and betting activities due to three identified violations of the GDPR. As noted by AZOP,… CROATIA · ·Art. 6, 7, 13 Sep 14, 2023
€90,000 GFB One s.r.l.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 90,000 on GFB One s.r.l.. An individual had filed a complaint with the DPA because SIM cards were registered in their name, although they… ITALY · ·Art. 5, 6, 13 +1 Sep 14, 2023
€20,000 Shardana Working Soc. Coop. a r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Shardana Working Soc. Coop. a r.l. EUR 20,000 for failing to respond adequately to requests from employees for access to information regarding their… ITALY · ·Art. 12, 15 Sep 14, 2023
€25,000 Zagreb Holding d.o.o.: Insufficient fulfilment of information obligations The Croatian DPA (AZOP) has imposed a fine of EUR 25,000 on Zagreb Holding d.o.o., utilities company owned by the city of Zagreb. The DPA had received a complaint from a citizen… CROATIA · ·Art. 13, 25 Sep 13, 2023
€23,000 Suomen Yritysrekisteri: Insufficient fulfilment of data subjects rights The Finnish DPA has fined Suomen Yritysrekisteri EUR 23,000. The controller had not sufficiently complied with data subjects' requests for access to their personal data. The… FINLAND · ·Art. 12, 15 Sep 11, 2023
€80,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Sep 5, 2023
€1,600 Company: Insufficient fulfilment of data subjects rights The Finnish DPA has imposed a fine of EUR 1,600 on a company providing psychotherapy services. A customer had submitted a request for access to their stored personal data.… FINLAND · ·Art. 12, 15 Sep 4, 2023
€300 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 13 Sep 1, 2023
€ 2,000M Decision 14-09-2023 The two companies in question, as controllers, made use of cookies on their websites, but failed to inform data subjects visiting their web pages about the legal basis for… Croatia · ·Art. 6, 7, 13 Sep 1, 2023
€345M TikTok Limited: Non-compliance with general data processing principles The Irish DPA (DPC), has imposed a fine of EUR 345 million on TikTok Limited. The DPC conducted an investigation primarily focused on the processing of personal data between July… IRELAND · ·Art. 5, 12, 13 +2 Sep 1, 2023
€10,000 Mednow Medical Center di Giugni Marco: Non-compliance with general data processing principles The Italian DPA has fined Mednow Medical Center di Giugni Marco EUR 10,000. An individual had filed a complaint with the DPA because the controller had inadvertently sent the… ITALY · ·Art. 5, 9, 12 +5 Aug 31, 2023
€1,600 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 1,600 on a legal person. The accused did not comply with the data subject's request to delete their data from its database and sent them… CZECH REPUBLIC · ·Art. 12 Aug 31, 2023
€20,000 Bar association: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on a bar association. Two individuals had filed a complaint with the DPA against the controller because documents relating to a… ITALY · ·Art. 2, 5 Aug 31, 2023
€10,000 RCS Mediagroup Spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10,000 on RCS Mediagroup Spa. A data subject had filed a complaint with the DPA due to the fact that their personal data had been… ITALY · ·Art. 2, 5, 137 +1 Aug 31, 2023
€140,000 GENERAL LOGISTICS SYSTEMS SPAIN, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR EUR 140,000 against GENERAL LOGISTICS SYSTEMS SPAIN, S.A.. Two individuals had filed a complaint with the DPA about parcels intended for… ·Art. 6 ·Insufficient legal basis for data processing Aug 30, 2023
€13,000 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 13,000 for failing to provide information requested by the DPA during an investigation. ·Art. 58 ·Insufficient cooperation with supervisory authority Aug 30, 2023
€3M Trygg-Hansa: Non-compliance with general data processing principles The Swedish DPA has fined Trygg-Hansa EUR 3 million for serious data security breaches. The security breach was discovered when a recipient of an email from Trygg-Hansa realized… SWEDEN ·Art. 5, 32 ·Non-compliance with general data processing principles Aug 28, 2023
€1,500 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on a homeowners' association. A property owner had filed a complaint with the DPA. The controller had published an enforcement… SPAIN · ·Art. 5, 32 Aug 25, 2023
06/SIU/2018 The Irish DPC started an own volition inquiry into processing operations carried out by the Galway County Council (the controller), focusing mainly into the surveillance… 06/SIU/2018 ·Ireland · Aug 22, 2023
€70,000 Uipath SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 70,000 on Uipath SRL. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. During its investigation, the DPA… ROMANIA · ·Art. 25, 32 Aug 21, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 11, 2023
€6,000 ELECTRAWORKS - CEUTA, S.A.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on ELECTRAWORKS - CEUTA, S.A.. The controller had failed to provide sufficient information about the retention periods of personal data. The… SPAIN · ·Art. 13 Aug 8, 2023
€6,000 ODRIA COSTAS INTERNACIONAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on ODRIA COSTAS INTERNACIONAL, S.L. A data subject had filed a complaint with the DPA because the controller had published a picture of their… SPAIN · ·Art. 5 Aug 8, 2023
€2,000 Med Life SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on Med Life SA. The controller had refused to disclose certain video recordings of the reception of a hospital to the data… ROMANIA · ·Art. 12, 15 Aug 3, 2023
€10,000 GYMOOGIMNASIOS S.L.: Non-compliance with general data processing principles The Spanish DPA has fined GYMOOGIMNASIOS S.L. EUR 10,000. The controller had installed a reservation system where data subjects had to consent to the processing of health-related… SPAIN · ·Art. 5, 7 Aug 2, 2023
Multiple website operators: Czech Data Protection Auhtority (UOOU) In the period from January 2023 to July 2023, the Czech DPA imposed fines totaling EUR 178,000, with the highest fine being EUR 36,000. These fines were imposed due to unlawful… CZECH REPUBLIC · ·Unknown Aug 2, 2023
€3,570 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 3,570 on a legal person. Following the complaint, the Office for personal data protection carried out an inspection of the accused's… CZECH REPUBLIC · ·Art. 6, 13, 44 Aug 1, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. Fraudulent third parties had pretended to be the data subject and asked the controller to change their phone number… SPAIN · ·Art. 6 Aug 1, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Aug 1, 2023
€70,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on TELEFÓNICA MÓVILES ESPAÑA, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of… SPAIN · ·Art. 6 Jul 31, 2023
€2.5M Open Bank, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has fined Open Bank, S.A. EUR 2,5 million. A data subject had filed a complaint with the DPA after being asked to provide proof of origin for payments on their… SPAIN · ·Art. 25, 32 Jul 28, 2023
€5,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on a private individual. The controller was both employer and landlord of the data subject. The controller had used the bank… SPAIN · ·Art. 5 Jul 27, 2023
€1,200 FONTANORTE, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on FONTANORTE, S.L.. The controller had disposed of documents containing personal data in publicly accessible trash containers. The original… SPAIN · ·Art. 32 Jul 27, 2023
€5,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 5,000 for repeatedly publishing personal data of various data subjects on a public Telegram channel without a valid legal basis. SPAIN · ·Art. 6 Jul 27, 2023
€1,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jul 20, 2023
€12,000 Azienda Socio Sanitaria Territoriale Ovest Milanese: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on Azienda Socio Sanitaria Territoriale Ovest Milanese. The controller had suffered data breaches that affected the privacy of… ITALY · ·Art. 5, 9, 32 Jul 18, 2023
€75,000 Università Telematica E-Campus: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 75,000 on Università Telematica E-Campus. The controller had sent advertising messages and made advertising calls without the consent of… ITALY · ·Art. 5, 6, 7 +6 Jul 18, 2023
€3,400 Company: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 3,400 on a company. The controller had reported a data breach to the DPA. The company car of a senior employee had been broken into,… POLAND · ·Art. 5, 24, 25 +1 Jul 18, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jul 18, 2023