Content type · 2,025 documents in this view · 3,835 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3609 Processing 2638 Personal Data 2407 Controllers 2025 Processing Agreement 1114 Security 1016 Supervision 859 Healthcare 622 Law Enforcement 568 Monitoring 551 Public Authority 545 Consent 507
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public space.… SPAIN · ·Art. 5 Jun 14, 2023
€400 SPAIN DPA: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 600 on a controller for failing to comply with an order issued by the DPA. ·Art. 58 ·Insufficient cooperation with supervisory authority Jun 14, 2023
DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR On 03 May 2021, the data subject sent a request to the controller for the erasure of their financial asset information. The controller did not respond to their erasure request. On… 2021-0.909.100 ·Art. 55, 77 Jun 12, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 Jun 8, 2023
€150,000 KG COM: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 150,000 on the company KG COM. The company operates several websites and offers fortune-telling consultations to customers via chat or… FRANCE · ·Art. 5, 6, 9 +6 Jun 8, 2023
€20,000 RCI BANQUE, S.A. SUCURSAL EN ESPAÑA: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine of EUR 20,000 RCI BANQUE, S.A. SUCURSAL EN ESPAÑA. A data subject complained that she was receiving text messages from the controller,… SPAIN · ·Art. 17 Jun 7, 2023
€1,200 CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L.. During its investigation, the DPA found that the controller had failed to properly and… SPAIN · ·Art. 21 Jun 7, 2023
€84,000 UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC a fine. A person had filed a complaint against the controller because a package addressed to them… SPAIN · ·Art. 5, 32 Jun 7, 2023
€56,000 VODAFONE ONO, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on VODAFONE ONO, S.A.U.. The controller had carried out a credit check on an individual without there being a customer relationship or other… SPAIN · ·Art. 6 Jun 6, 2023
€3,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 3,000. An individual had filed a complaint with the DPA against the controller due to the fact that the controller had provided… SPAIN · ·Art. 5, 32 Jun 6, 2023
€10,000 ALPA 57 PRODUCCIONES: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on ALPA 57 PRODUCCIONES. A data subject had filed a complaint with the DPA because the controller had unlawfully transmitted their… SPAIN · ·Art. 6 Jun 5, 2023
€20,000 QUALITY-PROVIDER S.A.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 20,000 on QUALITY-PROVIDER S.A.. A data subject had filed a complaint with the DPA because the controller had continued to use their data… SPAIN · ·Art. 6, 17 Jun 2, 2023
€4,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 Jun 2, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which also recorded a neighbor property. The DPA… SPAIN · ·Art. 5 Jun 2, 2023
€20,000 Ew Business Machines S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on Ew Business Machines S.p.A.. The controller had installed a video surveillance system that not only recorded images in real… ITALY · ·Art. 5, 9, 13 +1 Jun 1, 2023
€42,000 PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA. An individual had filed a complaint with the DPA because the controller had disclosed… SPAIN · ·Art. 5, 32 Jun 1, 2023
€20,000 Azienda Usl Toscana Sud Est.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 against Azienda Usl Toscana Sud Est. The controller had put up an information poster in the emergency room showing a healthcare… ITALY · ·Art. 2, 5, 9 +1 Jun 1, 2023
€2,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 2,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 May 31, 2023
€10,600 Company: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 10,600 on a company. The company had suffered a ransomware attack on their systems which resulted in the loss of personal data. During its… POLAND · ·Art. 5, 25, 32 +2 May 31, 2023
€300,000 Deutsche Kreditbank: Insufficient fulfilment of data subjects rights The DPA of Berlin has imposed a fine of EUR 300,000 on Deutsche Kreditbank. A customer had filed a complaint with the DPA. The customer had submitted an application for a credit… GERMANY ·Art. 5, 15, 22 ·Insufficient fulfilment of data subjects rights May 31, 2023
€300 CBHNOS S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CBHNOS S.L.. The controller had installed video surveillance cameras which, among other things, also covered a public road. The DPA… SPAIN · ·Art. 5 May 29, 2023
€180 CARROZADOS TECAI, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on CARROZADOS TECAI, S.L.. The controller had installed a video surveillance system but had not added all the required information on the… SPAIN · ·Art. 13 May 29, 2023
€150,000 NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ
Α.Ε.,: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 150,000 on NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ. Α.Ε., imposed a fine of EUR 150,000. A customer had filed a complaint with the… GREECE · ·Art. 12, 15, 21 +1 May 29, 2023
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed a video surveillance camera which also covered the public space and a neighbour property.… SPAIN · ·Art. 5, 13 May 25, 2023
€1,000 Global Baby Brand SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on Global Baby Brand SRL. A person had filed a complaint with the DPA alleging that the controller had sent commercial SMS… ROMANIA · ·Art. 7 May 23, 2023
€18,000 AUTOMOBILE BAVARIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 18,000 on AUTOMOBILE BAVARIA SRL. The data controller had notified the authority of a data breach pursuant to Art. 33 GDPR. Unknown… ROMANIA · ·Art. 25, 32 May 18, 2023
€380,000 Sports betting operator: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 380,000 on a sports betting operator. AZOP had received a complaint from a data subject, stating that the controller had obtained… CROATIA · ·Art. 6, 13, 25 +1 May 18, 2023
€10,000 La Gazzetta di Parma S.r.l.: Non-compliance with general data processing principles The Italian DPA has fined La Gazzetta di Parma S.r.l. EUR 10,000. The controller had published photos in its newspaper of an individual accused of murder. The photos showed the… ITALY · ·Art. 5 May 17, 2023
€10,000 Azienda ULSS 6 Euganea: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Azienda ULSS 6 Euganea. The controller had mistakenly sent documents containing personal data to the wrong patients. The DPA… ITALY · ·Art. 5, 6, 32 May 17, 2023
€40,000 Volkswagen Leasing GmbH: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on Volkswagen Leasing. A customer had filed a complaint with the DPA because the controller had not provided them with information… ITALY · ·Art. 12, 15 May 17, 2023
€60,000 Website operator: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on a website operator. The controller had published unauthorized personal data on the website www.trovanumeri.com, which it had… ITALY · ·Art. 5, 6, 12 +6 May 17, 2023
€50,000 FUSIONA SOLUCIONES ENERGÉTICAS, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on FUSIONA SOLUCIONES ENERGÉTICAS, S.A.. The controller had submitted data from the data subject to a credit information system… SPAIN · ·Art. 6 May 17, 2023
€6,700 Municipality: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 6,700 on a municipality. The controller had reported a data breach to the DPA. During its investigation, the DPA found that the controller… POLAND · ·Art. 5, 24, 25 +1 May 16, 2023
€5,000 Compania Națională Poșta Română S.A.: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 5,000 on the Romanian Post (Compania Națională Poșta Română S.A.). During its investigation, the DPA found that the controller had… ROMANIA · ·Art. 5, 6 May 16, 2023
€1,500 NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,500 on the insurance company NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.. The controller had… ROMANIA · ·Art. 32 May 12, 2023
€1,000 NN Asigurări de Viață S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,00 on the insurance company NN Asigurări de Viață S.A.. The controller had notified the authority of a data breach pursuant to Art. 33… ROMANIA · ·Art. 32 May 12, 2023
€5,000 ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has fined ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U. EUR 5,000. An individual had filed a complaint with the DPA because employees of the controller had visted their… SPAIN · ·Art. 6 May 9, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 May 9, 2023
€2,200 Municipality: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 2,200 on a municipality. The controller had reported a data breach to the DPA. An employee had unauthorizedly copied a document containing… POLAND · ·Art. 5, 25, 32 May 5, 2023
€1,200 FUNDACIÓ PRIVADA UNIVERSITARIA EADA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on FUNDACIÓ PRIVADA UNIVERSITARIA EADA. An individual who had participated in a training event filed a complaint against the educational… SPAIN · ·Art. 6 May 5, 2023
€2.3M Debt collection agency: Insufficient technical and organisational measures to ensure information security The Croatian DPA (AZOP) has imposed a fine of EUR 2,265,000 on a debt collection agency. The fine is the highest ever imposed by AZOP. AZOP had received an anonymous complaint in… CROATIA · ·Art. 6, 13, 28 +1 May 4, 2023
€200,000 GSMA LTD.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 200,000 against GSMA LTD.. An individual had filed a complaint with the DPA because they had to transfer special categories of personal… SPAIN · ·Art. 35 May 3, 2023
€5,000 BANQUETES SANTA ANA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on BANQUETES SANTA ANA, S.L.. The controller had asked a couple celebrating their wedding at its premises to provide the personal… SPAIN · ·Art. 5 May 3, 2023
€9,000 NAGA Markets Europe Ltd: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 9,000 on NAGA Markets Europe Ltd. The controller had suffered a data breach in which an unknown person accessed the company's database,… CYPRUS · ·Art. 5, 32 May 2, 2023
€240,000 Benetton Group S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 240,000 on Benetton Group S.r.l.. The controller had stored a large amount of customer data indefinitely. The DPA also found that the… ITALY · ·Art. 5, 32 Apr 27, 2023
€4,000 Università degli studi di Cassino e del Lazio Meridionale: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR on Università degli studi di Cassino e del Lazio Meridionale. A professor at the university had filed a complaint against the university… ITALY · ·Art. 2, 5, 6 +1 Apr 27, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which also recorded a neighbor property. The DPA… SPAIN · ·Art. 5 Apr 25, 2023
€1,000 Tensa Art Design SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Tensa Art Design SA. The controller failed to comply with a data subject's right to object. ROMANIA · ·Art. 12 Apr 24, 2023
€25,000 KFC RESTAURANTS SPAIN, S.L.: Insufficient involvement of data protection officer The Spanish DPA has fined KFC RESTAURANTS SPAIN, S.L EUR 25,000. During its investigation, the DPA found that the controller had failed to appoint a data protection officer. In… ·Art. 13, 37 ·Insufficient involvement of data protection officer Apr 20, 2023
€20,000 Company: Non-compliance with general data processing principles The Lithuanian DPA has fined a company EUR 20,000. The company had suffered a data breach in which personal data of 50,000 data subjects were compromised. During its… LITHUANIA · ·Art. 5, 32 Apr 20, 2023