Content type · 2,802 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€1,000 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on a homeowners' association. A property owner had filed a complaint with the DPA. The controller had published an enforcement… SPAIN · ·Art. 5, 32 Nov 7, 2023
€400 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 400 on a private individual for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 Nov 6, 2023
€200,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Nov 6, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN · ·Art. 5 Nov 6, 2023
€240 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 240 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects. SPAIN · ·Art. 13 Nov 6, 2023
€600 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a Homeowners Association. The association had installed several video surveillance cameras which, among other things, also… SPAIN · ·Art. 5 Nov 3, 2023
€2,000 SINDICATO LIBRE DE TRANSPORTES: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on SINDICATO LIBRE DE TRANSPORTES. A member of the union had shared the data subject's payslip in a WhatsApp group without the data subject's… SPAIN · ·Art. 5, 32 Nov 3, 2023
€600 Hotel: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a hotel. The controller had installed video surveillance cameras which, among other things, also covered the public space and… SPAIN · ·Art. 5, 13 Nov 3, 2023
€3,000 OTP BANK ROMANIA SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on OTP BANK ROMANIA SA. The controller had accidentally transmitted personal data of an individual to an unauthorized third party.… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 3, 2023
€30,000 APOLLONIA TOPCO, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on APOLLONIA TOPCO, S.L.. An individual had filed a complaint with the DPA due to the fact that, in order to receive a refund,… SPAIN · ·Art. 5, 38 Nov 2, 2023
€48,000 INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P.: Non-compliance with general data processing principles The Spanish DPA has imposed a finea INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P. The controller had suffered a data breach in which personal patient and employee data had… SPAIN · ·Art. 5, 32, 34 Nov 2, 2023
€30,000 Voorschoten municipality: Non-compliance with general data processing principles The Dutch DPA has imposed a fine of EUR 30,000 on Voorschoten municipality. The municipality had kept information about household waste for longer than necessary and had not… THE NETHERLANDS · ·Art. 5, 6, 14 Nov 2, 2023
€300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed a video surveillance camera which recorded a communal area without this having… SPAIN · ·Art. 6 Oct 31, 2023
€180 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 180 on a private individual. The controller had installed video surveillance cameras without properly informing data subjects. SPAIN · ·Art. 13 Oct 31, 2023
€240 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 240 on a private individual for unlawfully installing a video surveillance camera on their house capturing the public space. SPAIN · ·Art. 6 Oct 30, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual for publishing intimate images of the data subject on YouTube without their consent. SPAIN · ·Art. 6 Oct 28, 2023
€20,000 Region of Lombardy: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 20,000 on the Region of Lombardy. In the context of the sale of company shares held by the region, personal data of employees of the… ITALY · ·Art. 2, 5, 6 +1 Oct 26, 2023
€1,000 Homeowner administrator: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 1,000 on a homeowner administrator who had installed a video surveillance system without a permit from the homeowners' association. ITALY · ·Art. 5, 6 Oct 26, 2023
€500 UPMOBILE SOLUTIONS, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined UPMOBILE SOLUTIONS, S.L. EUR 500 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Oct 26, 2023
€7,000 Ophthalmologic institute: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 7,000 on a ophthalmologic institute. The controller had responded to an online review, disclosing personal data of a patient. SPAIN · ·Art. 5, 32 Oct 26, 2023
€5M CAIXABANK, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5 million on CAIXABANK, S.A.. A customer had filed a complaint about having access to a document containing information on a transfer… SPAIN · ·Art. 5, 25, 32 Oct 26, 2023
€6.1M ENDESA ENERGÍA, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined ENDESA ENERGÍA, S.A.U. EUR 6,1 million due to a security breach resulting in unauthorized access to its systems. The controller had informed the DPA that… SPAIN · ·Art. 5, 32, 33 +2 Oct 25, 2023
€500 BILBAO AD INFINITUM, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined BILBAO AD INFINITUM, S.L. EUR 500. The controller had installed video surveillance cameras which, among other things, also covered the public street. The… SPAIN · ·Art. 5 Oct 25, 2023
€1,000 SC Spark Car Sharing SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 1,000 on SC Spark Car Sharing SRL. An individual had filed a complaint with the DPA because the controller had processed their email… ROMANIA · ·Art. 5, 6, 7 Oct 25, 2023
€3,000 Mensajero SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Mensajero SRL. The controller had suffered a data breach where a link on the controller's website was publicly accessible… ROMANIA · ·Art. 32 Oct 24, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Oct 23, 2023
€50,000 Oney Servicios Financieros E.F.C.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on Oney Servicios Financieros E.F.C... The controller had submitted data from the data subject to a credit information system… SPAIN · ·Art. 5 Oct 23, 2023
€1,000 DANTE INTERNATIONAL SA: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on DANTE INTERNATIONAL SA. The controller had sent marketing SMS to a data subject without a valid legal basis. ROMANIA · ·Art. 6 Oct 20, 2023
€800,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has fined BANCO BILBAO VIZCAYA ARGENTARIA, S.A. EUR 800,000. A customer had lost her handbag, which also contained her bank card. The individual therefore… SPAIN · ·Art. 25, 32 Oct 20, 2023
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Oct 19, 2023
€24,000 Insurance company: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined an insurance company EUR 24,000 for failing to report a data breach to the DPA in a timely manner. POLAND · ·Art. 33 Oct 18, 2023
€2,000 UNIQUE HOTEL APARTMENT S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on UNIQUE HOTEL APARTMENT. The controller had copied identification documents for the purposes of guest registration and stored the… SPAIN · ·Art. 5 Oct 18, 2023
€30,000 H&M Hennes & Mauritz GBC AB: Insufficient fulfilment of data subjects rights The Swedish DPA has imposed a fine of EUR 30,000 on H&M for sending out marketing messages, despite the fact that data subjects had exercised their right to objection. Six data… SWEDEN ·Art. 12, 21 ·Insufficient fulfilment of data subjects rights Oct 17, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 600 for installing a video surveillance camera that captured parts of a commonly shared garage. The DPA considered this a… SPAIN · ·Art. 5, 13 Oct 15, 2023
€40,000 Azienda socio sanitaria territoriale di Lodi CF: Non-compliance with general data processing principles The Italian DPA has imposed a fine of ERU 40,000 on the health authority Azienda socio sanitaria territoriale di Lodi CF. Employees of the health authority had accessed the file… ITALY · ·Art. 5, 9, 32 Oct 12, 2023
€600,000 GROUPE CANAL +: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 600,000 on GROUPE CANAL+ for multiple violations of the GDPR. The DPA determined that the data controller failed to demonstrate that it… FRANCE · ·Art. 7, 12, 13 +5 Oct 12, 2023
€70,000 Scionti Selezioni Superiori S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 70,000 on Scionti Selezioni Superiori S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were… ITALY · ·Art. 5, 6, 7 +7 Oct 12, 2023
€1,000 GREECE DPA: Non-compliance with general data processing principles Unlawful disclosure of health data. ·Art. 5 ·Non-compliance with general data processing principles Oct 11, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN · ·Art. 5 Oct 11, 2023
€5,300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. An individual had rented a room from the controller and filed a complaint due to the fact that the… SPAIN · ·Art. 6, 13 Oct 11, 2023
€500 ALBEN AIRPORT FACILITIES S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined ALBEN AIRPORT FACILITIES S.L. EUR 500 for failing to provide information requested by the DPA during an investigation. SPAIN · ·Art. 58 Oct 11, 2023
€1,500 NORDETIA CLINICS MÓSTOLES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on NORDETIA CLINICS MÓSTOLES S.L.. The controller had sent an e-mail without using the blind copy option, revealing the email… SPAIN · ·Art. 5, 32 Oct 10, 2023
€15,000 ILUNION SEGURIDAD, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 15,000 on ILUNION SEGURIDAD, S.A. The controller had sent labor communications by e-mail without using the blind copy option, revealing… SPAIN · ·Art. 5, 32 Oct 10, 2023
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 500. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN · ·Art. 5 Oct 9, 2023
€4,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 4,000 for installing a video surveillance camera that captured parts of a commonly shared garage. The DPA considered this a… SPAIN · ·Art. 5 Oct 9, 2023
€24,000 Link4 Towarzystwo Ubezpieczeń S. A.: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined Link4 Towarzystwo Ubezpieczeń S. A. EUR 24,000 for failing to report a data breach to the DPA in a timely manner. POLAND · ·Art. 33 Oct 8, 2023
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Oct 5, 2023
€5.5M Debt collection company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed of fine of EUR 5,470,000 to a debt collection company. The investigation was triggered by an anonymous complaint stating that controller… CROATIA · ·Art. 5, 6, 12 +2 Oct 5, 2023
€70,000 Schockholm School borard: Non-compliance with general data processing principles The Swedish DPA has fined the Stockholm School Board EUR 70,000 for excessive video surveillance in a school. A school had installed extensive video surveillance due to past… SWEDEN ·Art. 5, 6, 13 ·Non-compliance with general data processing principles Oct 3, 2023
€1,000 Cez Vânzare S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Cez Vânzare S.A.. The controller had accidentally sent emails containing personal customer data to the wrong recipients. The… ROMANIA · ·Art. 32 Oct 2, 2023