Content type · 1,941 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€13,000 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 13,000 for failing to provide information requested by the DPA during an investigation. ·Art. 58 ·Insufficient cooperation with supervisory authority Aug 30, 2023
€1,500 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,500 on a private individual. The individual had installed video surveillance cameras in a residential complex, which also covered… SPAIN · ·Art. 6, 13 Aug 30, 2023
€1,500 ALBEN AIRPORT FACILITIES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on ALBEN AIRPORT FACILITIES S.L.. The controller had sent an email with certificates of participation in a training course to all participants,… SPAIN · ·Art. 5, 32 Aug 29, 2023
€4,800 WALL BOX CHARGERS S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on WALL BOX CHARGERS S.L.. The controller had inadvertently placed a person on CC on emails to other customers, giving them access to data from… SPAIN · ·Art. 5, 32 Aug 28, 2023
€1,500 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on a homeowners' association. A property owner had filed a complaint with the DPA. The controller had published an enforcement… SPAIN · ·Art. 5, 32 Aug 25, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Aug 23, 2023
DPC (Ireland) - 06/SIU/2018 The Irish DPC started an own volition inquiry into processing operations carried out by the Galway County Council (the controller), focusing mainly into the surveillance… 06/SIU/2018 ·Art. 5, 24, 35 Aug 22, 2023
€70,000 Uipath SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 70,000 on Uipath SRL. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. During its investigation, the DPA… ROMANIA · ·Art. 25, 32 Aug 21, 2023
€20,000 JOLY DIGITAL, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has fined JOLY DIGITAL, S.L.U. EUR 20,000. A person had filed a complaint with the DPA because the controller had published an image they had posted on their… SPAIN · ·Art. 6 Aug 18, 2023
€300 Private individual: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed a video surveillance system in a shared garage without properly informing about… SPAIN · ·Art. 13 Aug 16, 2023
€600 MÁRMOLES Y GRANITOS MEJIAS, S. L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on MÁRMOLES Y GRANITOS MEJIAS, S. L.. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5, 13 Aug 16, 2023
€5,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,000 on a private individual. The controller had installed CCTV at his house in a residential complex which also covered areas of the… SPAIN · ·Art. 6 Aug 16, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 11, 2023
€6,000 ELECTRAWORKS - CEUTA, S.A.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on ELECTRAWORKS - CEUTA, S.A.. The controller had failed to provide sufficient information about the retention periods of personal data. The… SPAIN · ·Art. 13 Aug 8, 2023
€6,000 ODRIA COSTAS INTERNACIONAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on ODRIA COSTAS INTERNACIONAL, S.L. A data subject had filed a complaint with the DPA because the controller had published a picture of their… SPAIN · ·Art. 5 Aug 8, 2023
€2,000 Med Life SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on Med Life SA. The controller had refused to disclose certain video recordings of the reception of a hospital to the data… ROMANIA · ·Art. 12, 15 Aug 3, 2023
€10,000 GYMOOGIMNASIOS S.L.: Non-compliance with general data processing principles The Spanish DPA has fined GYMOOGIMNASIOS S.L. EUR 10,000. The controller had installed a reservation system where data subjects had to consent to the processing of health-related… SPAIN · ·Art. 5, 7 Aug 2, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. Fraudulent third parties had pretended to be the data subject and asked the controller to change their phone number… SPAIN · ·Art. 6 Aug 1, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded common areas of a… SPAIN · ·Art. 5 Aug 1, 2023
€2.5M Open Bank, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has fined Open Bank, S.A. EUR 2,5 million. A data subject had filed a complaint with the DPA after being asked to provide proof of origin for payments on their… SPAIN · ·Art. 25, 32 Jul 28, 2023
€5,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on a private individual. The controller was both employer and landlord of the data subject. The controller had used the bank… SPAIN · ·Art. 5 Jul 27, 2023
€1,200 FONTANORTE, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on FONTANORTE, S.L.. The controller had disposed of documents containing personal data in publicly accessible trash containers. The original… SPAIN · ·Art. 32 Jul 27, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 300 euros on a private individual. The controller had installed video surveillance cameras that recorded a neighbor's property, among other… SPAIN · ·Art. 5 Jul 25, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public space.… SPAIN · ·Art. 5 Jul 24, 2023
€720 MADRID TOURISTIC
CAPITAL, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 720 on MADRID TOURISTIC CAPITAL, S.L. The controller had failed to adequatly inform about video surveillance at its premises. SPAIN · ·Art. 13 Jul 21, 2023
€1,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jul 20, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 300 euros on a private individual. The controller had installed video surveillance cameras that recorded a neighbor's property, among other… SPAIN · ·Art. 5 Jul 20, 2023
€100,000 Tiscali Italia SpA: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Tiscali Italia SpA. The controller had sent advertising messages to more than 160,000 customers within four months, even… ITALY · ·Art. 5, 12, 13 +2 Jul 18, 2023
€1,000 Prodav srl: Non-compliance with general data processing principles The Italian DPA has fined Prodav srl EUR 1,000. The controller had operated video surveillance cameras in one of their shops without the required authorization. Furthermore, the… ITALY · ·Art. 5, 13, 114 Jul 18, 2023
€40,000 Compara Facile S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on Compara Facile S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were registered in… ITALY · ·Art. 5, 6, 7 +8 Jul 18, 2023
€75,000 Università Telematica E-Campus: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 75,000 on Università Telematica E-Campus. The controller had sent advertising messages and made advertising calls without the consent of… ITALY · ·Art. 5, 6, 7 +6 Jul 18, 2023
€3,400 Company: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 3,400 on a company. The controller had reported a data breach to the DPA. The company car of a senior employee had been broken into,… POLAND · ·Art. 5, 24, 25 +1 Jul 18, 2023
€12,000 Azienda Socio Sanitaria Territoriale Ovest Milanese: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on Azienda Socio Sanitaria Territoriale Ovest Milanese. The controller had suffered data breaches that affected the privacy of… ITALY · ·Art. 5, 9, 32 Jul 18, 2023
€10,000 NANDIVALE, S.L: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on NANDIVALE, S.L.. The controller had uploaded images on social media of a party at its premises showing minors. The mother of a… SPAIN · ·Art. 6 Jul 17, 2023
€2,000 KUGELCHEN PROPIERTIES, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on KUGELCHEN PROPIERTIES, S.L.. The controller had continued to process data of the data subject, despite exercising their right to… SPAIN · ·Art. 6 Jul 7, 2023
€5,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jul 7, 2023
€15,000 RCL CRUISES LTD: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 15,000 on RCL CRUISES LTD. An individual had filed a complaint with the DPA. The individual, after requesting information about a cruise… SPAIN · ·Art. 5, 32 Jul 7, 2023
€10,000 AcegasApsAmga SpA: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on AcegasApsAmga SpA. A former employee had filed a complaint with the DPA due to the controller's failure to respond to their… ITALY · ·Art. 5, 12, 15 Jul 6, 2023
€5,000 Ristorante Francesco srl: Non-compliance with general data processing principles The Italian DPA has fined Ristorante Francesco srl EUR 5,000. The controller had operated video surveillance cameras in its premises without the required authorization.… ITALY · ·Art. 5, 13, 114 Jul 6, 2023
€1,200 LISMARTSA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on LISMARTSA, S.L.. A data subject had filed a complaint with the DPA because the controller had added them to a WhatsGroup without their… SPAIN · ·Art. 5, 32 Jul 5, 2023
€25,000 CaixaBank, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 25,000 on CaixaBank, S.A.. An individual had filed a complaint with the DPA due to the fact that when they requested information from the… SPAIN · ·Art. 32 Jul 4, 2023
€500 EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L. EUR 500. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5 Jul 4, 2023
€81,000 Heilsuveru: Insufficient technical and organisational measures to ensure information security The Icelandic DPA has fined Heilsuveru EUR 81,000. The controller had reported a data breach to the DPA, as two unauthorized persons had managed to view personal data. During its… ICELAND ·Art. 5, 25, 32 ·Insufficient technical and organisational measures to ensure information security Jul 3, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, covered a neighbor… SPAIN · ·Art. 5, 13 Jun 30, 2023
Greek DPA: Google breached Art. 17 GDPR erasure right over outdated criminal case links In 2020, the data subject filed a complaint with the DPA against Google LLC (the controller) for failing to fulfill their right to erasure (Article 17 GDPR) concerning links -… 54/2024 ·Greece · Jun 29, 2023
€13,400 Sjúkratyringur Íslands: Insufficient technical and organisational measures to ensure information security The Icelandic DPA has imposed a fine of EUR 13,400 on Sjúkratyringur Íslands. During its investigation, the DPA found that the controller had failed to implement adequate… ICELAND ·Art. 5, 25, 32 ·Insufficient technical and organisational measures to ensure information security Jun 28, 2023
€257,000 Creditinfo Lánstraust hf.: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 257,000 on Creditinfo Lánstraust hf.. The controller had registered information on loan defaults even though the required registration… ICELAND ·Art. 5, 6, 8 +1 ·Insufficient legal basis for data processing Jun 27, 2023
€2,500 Farmacia Ardealul SRL: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 2,500 on Farmacia Ardealul SRL. The controller had reported a data breach to the DPA. During its investigation, the DPA found that an… ROMANIA · ·Art. 32 Jun 27, 2023
€51,000 eCommerce 2020 ApS: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 51,000 on eCommerce 2020 ApS. The controller had submitted information on loan defaults for registration even though the required… ICELAND ·Art. 5, 6, 8 +1 ·Insufficient legal basis for data processing Jun 27, 2023
€24,000 Almennri innheimtu ehf: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 24,000 on Almennri innheimtu ehf. The controller had submitted information on loan defaults for registration even though the required… ICELAND ·Art. 5, 6, 8 +1 ·Insufficient legal basis for data processing Jun 27, 2023