Content type · 2,802 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The controller had published a video showing an individual without their consent. SPAIN · ·Art. 6 Jan 8, 2024
€10,000 Website operator: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine in the amount of EUR 11,000 on a website operator. An individual had filed a complaint with the DPA because the controller had failed to comply… AUSTRIA · ·Art. 17, 25, 58 Jan 4, 2024
€15,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 15,200 on a media company. The company failed to react to requests by the DPA. AUSTRIA · ·Art. 58 Jan 2, 2024
Multiple Police Officers: Data Protection Authority of Berlin The DPA of Berlin imposed fined 23 police officers. The police officers misused their access to the police information system for private purposes. GERMANY ·Unknown Jan 1, 2024
€12,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has imposed a fine of EUR 12,000 on a company providing vehicle history check services. The controller refused a data subject's request to rectify personal data… LITHUANIA · ·Art. 5, 15, 16 Jan 1, 2024
€1,500 SLOVAKIA DPA: Insufficient cooperation with supervisory authority The Slovak DPA has imposed a fine of EUR 1,500 on an unkown controller. The controller obstructed an inspection of the DPA. ·Insufficient cooperation with supervisory authority Jan 1, 2024
Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine on a company due to technical security vulnerabilities in its support ticket systems. GERMANY ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
Private individual: Insufficient legal basis for data processing The DPA of Hamburg has imposed a fine on a private individual for recording a video of their neighbor in the bathroom without their consent. GERMANY ·Insufficient legal basis for data processing Jan 1, 2024
€22,080 Company: Insufficient cooperation with supervisory authority The DPA from Saxony has fined a company EUR 22,080 for failing to sufficiently cooperate with the DPA during an investigation. GERMANY ·Art. 31 ·Insufficient cooperation with supervisory authority Jan 1, 2024
€3,300 Doctor´s Office: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 3,300 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2024
€60,000 Company: Insufficient technical and organisational measures to ensure information security The DPA of Berlin imposed a fine of EUR 60,000 on a healthcare company. The company offers practice management software that includes a patient communication portal with… GERMANY ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€7,500 SLOVAKIA DPA: Non-compliance with general data processing principles The Slovak DPA has imposed a fine of EUR 7,500 on an unknown controller. The controller violated the principle of lawfulness, the principle of transparency and the principle of… ·Non-compliance with general data processing principles Jan 1, 2024
€6,000 Online retailer: Insufficient fulfilment of data breach notification obligations The DPA of Hamburg has imposed a fine of EUR 6,000 on an online retailer for failing to report a data breach in a timely manner. GERMANY ·Insufficient fulfilment of data breach notification obligations Jan 1, 2024
Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine on a company due to technical security vulnerabilities in its support ticket systems. GERMANY ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€41 GERMANY DPA: €41 fine The DPA of Hessen has imposed fines totaling EUR 13,486 on 41 data controllers. In its 2024 activity report, the DPA of Hesse reported a total of 47 fines that year. Six of these… Unknown Jan 1, 2024
€16,000 Hotel: Insufficient legal basis for data processing The DPA of Hamburg has imposed a fine of EUR 16,000 on a hotel for processing ID card data without a legal basis. GERMANY ·Insufficient legal basis for data processing Jan 1, 2024
€16,000 Freelancer: Insufficient cooperation with supervisory authority The DPA of Hessen has imposed a fine of EUR 16,000 on a freelancer. The controller operates a website without a privacy policy. The DPA contacted the controller, ordering him to… GERMANY ·Art. 13, 31, 58 ·Insufficient cooperation with supervisory authority Jan 1, 2024
Private individual: Insufficient legal basis for data processing The DPA of Hamburg has imposed five fines of private individuals for taking or storing photos of individuals without their consent. GERMANY ·Insufficient legal basis for data processing Jan 1, 2024
€10,000 Company: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 10,000 on a company. The controller used data for marketing purposes without a legal basis. The company obtained the data through… GERMANY ·Art. 6, 7 ·Insufficient legal basis for data processing Jan 1, 2024
€120,000 Company: Insufficient cooperation with supervisory authority The DPA from Saxony has fined a company EUR 120,000 for failing to provide information requested by the DPA during an investigation. GERMANY ·Art. 31 ·Insufficient cooperation with supervisory authority Jan 1, 2024
Police employees: Insufficient legal basis for data processing The DPA of Hamburg has imposed two fines on members of the police for accessing police databases for private research purposes. GERMANY ·Insufficient legal basis for data processing Jan 1, 2024
€11,500 Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg imposed a fine of EUR 11,500 on a company operating in the advertising industry for failing to comply with its deletion obligations. In addition, it was found… GERMANY ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€496,000 Company: Non-compliance with general data processing principles The DPA of Hessen has imposed a fine of EUR 496,000 on a company. The DPA identified several GDPR violations, including transmitting customer data to the incorrect recipient and… GERMANY ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Jan 1, 2024
€32,000 Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine of EUR 32,000 on a logistics company for incorrectly disposing of delivery lists. GERMANY ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€2,500 Doctor´s Office: Insufficient technical and organisational measures to ensure information security The DPA of Hessen has imposed a fine of EUR 2,500 on a doctor´s office. The controller hired an office manager who worked partly from home. The manager worked with patient files,… GERMANY ·Art. 5, 6, 9 +1 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€3,700 Doctor´s Office: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 3,700 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2024
€200 Civic Association: Insufficient legal basis for data processing The Slovak DPA has imposed a fine of EUR 200 on a civic association. The controller violated the principle of lawfulness of processing. SLOVAKIA · ·Insufficient legal basis for data processing Jan 1, 2024
€6.5M THE PHONE HOUSE SPAIN, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 6.5 million on THE PHONE HOUSE SPAIN, S.L. The controller had suffered a ransomware attack affecting personal data of 13 million… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Dec 27, 2023
€3,500 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. The private individual had installed a camera in their apartment, where they also rented out a room,… SPAIN · ·Art. 6, 13 Dec 23, 2023
Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company. The controller had collected data from applicants, even though the processing of the specific data was not necessary for the job… FRANCE · ·Art. 5 Dec 22, 2023
FRANCE DPA: Insufficient cooperation with supervisory authority The French DPA has imposed a fine on a data controller for lack of cooperation. ·Insufficient cooperation with supervisory authority Dec 22, 2023
Candidate for parliamentary elections: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine on a candidate for parliamentary elections. The candidate had sent the data subject election advertising by email despite the data subject's… FRANCE · ·Art. 21 Dec 22, 2023
€2,000 Company: Insufficient fulfilment of information obligations The Italian DPA has fined a company s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… ITALY · ·Art. 5, 13 Dec 21, 2023
€4,300 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,400 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Dec 21, 2023
€23,000 Polish Minister of Health: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 23,000 on the Polish Minister of Health. The controller had accessed information via a database relating to a physician who had prescribed… POLAND · ·Art. 25, 32, 34 Dec 20, 2023
€2,300 District Court Krakow: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined the District Court in Krakow EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. POLAND · ·Art. 33, 34 Dec 19, 2023
€600 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed a video surveillance camera in a residential building which recorded a communal… SPAIN · ·Art. 6, 13 Dec 17, 2023
€400 TITAN STRONG, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on TITAN STRONG, S.L.. The controller had installed video surveillance cameras which, among other things, also covered the public space… SPAIN · ·Art. 5 Dec 17, 2023
€200 Private individual: Insufficient cooperation with supervisory authority The Romanian DPA has fined a private individual EUR 200 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Dec 15, 2023
€5,500 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 5,500 for failing to sufficiently cooperate with the DPA during an investigation. POLAND · ·Insufficient cooperation with supervisory authority Dec 13, 2023
€400,000 UK Ministry of Defense: Insufficient technical and organisational measures to ensure information security The UK DPA has fined the Ministry of Defense EUR 400,000 for disclosing personal data of individuals who were to be relocated to the UK after the Taliban took control of… UNITED KINGDOM · ·Insufficient technical and organisational measures to ensure information security Dec 13, 2023
€5,900 AUSTRIA DPA: Insufficient fulfilment of data breach notification obligations The Austrian DPA fined a controller EUR 5,900 for failing to report a data breach in a timely manner and for not cooperating with the DPA. ·Art. 31, 33 ·Insufficient fulfilment of data breach notification obligations Dec 12, 2023
€5,000 Kourou municipality: Insufficient cooperation with supervisory authority The French DPA has imposed a fine of EUR 5,000 on Kourou municipality for failing to appoint a data protection officer and to sufficiently cooperate with the DPA. FRANCE · ·Art. 31, 37 Dec 12, 2023
€10,000 VACACIONES EDREAMS, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 10,000 on VACACIONES EDREAMS, S.L.. A data subject had filed a complaint against the controller with the DPA due to the controller's… SPAIN · ·Art. 15 Dec 12, 2023
€3,000 Veranda Obor S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Veranda Obor S.A.. The controller had disclosed personal data (e.g. name, e-mail adress etc.) of lottery participants on its… ROMANIA · ·Art. 32 Dec 11, 2023
€10M Uber Technologies Inc.
Uber B.V.: Insufficient fulfilment of information obligations The Dutch DPA has fined Uber Technologies Inc. and Uber B.V. EUR 10 million for failing to provide sufficient information about the storage period of European drivers' data and… THE NETHERLANDS · ·Art. 12, 13 Dec 11, 2023
€3,200 SOLAR PROGRESS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on SOLAR PROGRESS, S.L.. The controller had published a screenshot with an email from a former employee who had a professional question in a… SPAIN · ·Art. 5 Dec 7, 2023
€2,000 Mushtaq Rubina Kebabish: Insufficient fulfilment of information obligations The Italian DPA has fined Mushtaq Rubina Kebabish EUR 2,000. The controller had operated video surveillance cameras in one of their premises without properly informing about the… ITALY · ·Art. 5, 13 Dec 7, 2023
€1,000 Sirio S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,000 on Sirio S.p.A.. An employee filed a complaint with the DPA because the controller had passed on their personal data to a bank… ITALY · ·Art. 5, 6, 13 Dec 7, 2023
€24,000 Hora Credit IFN SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA imposed a fine of EUR 24,000 on Hora Credit IFN SA. The controller had accidentally sent documents containing the personal data of another person to a customer by… ROMANIA · ·Art. 12, 15, 32 +1 Dec 7, 2023