Content type · 2,273 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€1,000 STS Di Prisinzano s.r.l: Insufficient fulfilment of information obligations The Italian DPA has fined STS Di Prisinzano s.r.l EUR 1,000. The company had processed data of a customer in the context of a breakdown service without sufficiently informing the… ITALY · ·Art. 5, 13 Nov 24, 2022
€1M Areti spa: Non-compliance with general data processing principles The Italian DPA has fined electricity supplier Areti spa EUR 1 million. A customer had filed a complaint with the DPA due to Areti classifying them as a defaulting customer, which… ITALY · ·Art. 5, 12, 15 +1 Nov 24, 2022
€20,000 ING Bank NV Amsterdam Sucursala București: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 20,000 on ING Bank NV Amsterdam Sucursala București. The bank had reported a data breach to the DPA pursuant to Art. 33 GDPR. Several… ROMANIA · ·Art. 32 Nov 21, 2022
€300 Homeowners Association Bld. Pipera 1-2E: Insufficient cooperation with supervisory authority The Romanian DPA (ANSPDCP) has fined Homeowners Association 'Bld. Pipera 1-2E' EUR 300 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Nov 18, 2022
€28,000 Raiffeisen Bank SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 28,000 on Raiffeisen Bank SA. The bank had reported several data breaches pursuant to Art. 33 GDPR to the DPA. During its investigation,… ROMANIA · ·Art. 25, 32 Nov 16, 2022
€80,000 BANKINTER, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on BANKINTER, S.A.. A person had filed a complaint with the DPA as personal data of a third person were also displayed to them when accessing… SPAIN · ·Art. 5, 32 Nov 15, 2022
€5,200 News service: Insufficient legal basis for data processing The Hungarian DPA imposed a fine of EUR 5,200 on a news service. A customer had complained to the DPA about subscribing to a newsletter to receive a daily news digest, however,… HUNGARY · ·Art. 6, 7, 12 Nov 15, 2022
€3,600 XASTRE DO PETO, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 3,600 on XASTRE DO PETO, S.L. (restaurant). An individual had filed a complaint with the DPA due to the fact that the controller required… SPAIN · ·Art. 6, 13, 21 Nov 11, 2022
€500,000 Vodafone Italia S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 500,000 on Vodafone Italia S.p.A.. A customer had filed a complaint with the DPA against Vodafone. The 80-year-old customer had been… ITALY · ·Art. 5, 6, 7 +3 Nov 10, 2022
€4,000 Villafranca di Verona municipality: Non-compliance with general data processing principles The Italian DPA (Garante) imposed a fine of EUR 4,000 on Villafranca di Verona municipality. The municipality had published a document containing personal data of an employee on… ITALY · ·Art. 2, 5, 6 Nov 10, 2022
€10,000 I-Model s.r.l.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on I-Model s.r.l. A data subject had filed a complaint with the DPA against the controller due to the fact that the… ITALY · ·Art. 6, 17 Nov 10, 2022
€800,000 DISCORD INC.: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 800,000 on DISCORD INC.. DISCORD offers an online communication service through which users can chat or make video calls. During its… FRANCE · ·Art. 5, 13, 25 +2 Nov 10, 2022
€40,000 Azienda Usl Valle d'Aosta: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Azienda Usl Valle d'Aosta EUR 40,000. An employee and patient of the health department had filed a complaint with the DPA because a colleague who had… ITALY · ·Art. 5, 9, 25 +1 Nov 10, 2022
€5,000 Cisterna di Latina Municipality: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Cisterna di Latina Municipality. An individual had filed a complaint with the DPA. The individual had submitted a request to the… ITALY · ·Art. 5, 12, 37 Nov 10, 2022
€5,000 Cisterna di Latina municipality: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 5,000 on Cisterna di Latina municipality. An individual had filed a complaint with the DPA because the municipality had not responded to… ITALY · ·Art. 5, 12, 37 Nov 10, 2022
€15,000 Poliambulatorio Radiologico 'il Sorriso' S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 15,000 on Poliambulatorio Radiologico 'il Sorriso' S.r.l.. A patient had filed a complaint with the DPA for not receiving sufficient… ITALY · ·Art. 5, 13, 37 Nov 10, 2022
€20,000 Sportitalia: Non-compliance with general data processing principles The Italian DPA (Garante) imposed a fine of EUR 20,000 on Sportitalia. The controller processed biometric data (fingerprints) of employees for the purpose of registering their… ITALY · ·Art. 5, 9, 13 +1 Nov 10, 2022
€6,000 Conservatorio di Musica S. Cecilia di Roma: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on 'Conservatorio di Musica S. Cecilia di Roma'. A student of the educational institution had filed a complaint with the DPA for… ITALY · ·Art. 2, 5, 6 +1 Nov 10, 2022
€1,000 SC Das Sense Society SRL: Insufficient cooperation with supervisory authority The Romanian DPA (ANSPDCP) has fined SC Das Sense Society SRL EUR 1,000 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Nov 9, 2022
€400 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 400 on a legal person. The accused did not provide access to information about the purpose of the processing, the storage period, the… CZECH REPUBLIC · ·Art. 15 Nov 9, 2022
€5,000 SC Prestige Media PHG SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 5,000 on SC Prestige Media PHG SRL. The controller had published 23 documents containing information on the termination of employment… ROMANIA · ·Art. 5, 6 Nov 8, 2022
€2,000 Romanian Post: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on the Romanian Post. The Post suffered a data breach where staff lost several mailings containing pension statements, employment… ROMANIA · ·Art. 32 Nov 7, 2022
€70,000 UNITED PARCEL SERVICE ESPAÑA LTD Y COMPAÑIA SRC: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 70,000 on UNITED PARCEL SERVICE ESPAÑA LTD Y COMPAÑIA SRC (UPS). A person had filed a complaint with the DPA because UPS had delivered a… SPAIN · ·Art. 5, 32 Nov 3, 2022
€75,000 Burwebs S.L.: Non-compliance with general data processing principles The Spanish DPA has fined Burwebs S.L. EUR 75,000. Burwebs operates websites with adult content. During its investigation, the DPA found that Burwebs did not process users' data… SPAIN · ·Art. 5, 12, 13 +3 Nov 3, 2022
€180,000 Setúbal municipality: Non-compliance with general data processing principles The Portuguese DPA has imposed a fine of EUR 170,000 on Setúbal municipality. The DPA found data protection violations regarding the collection of personal data from Ukrainian… PORTUGAL · ·Art. 5, 13, 37 Nov 2, 2022
€25,000 CAIXABANK S.A.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 25,000 on CAIXABANK S.A.. The data subject had repeatedly and unsuccessfully requested that their address on file with the bank be… SPAIN · ·Art. 16 Nov 2, 2022
€2,000 Rapido Finance, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on Rapido Finance, S.L.. The data subject had received a message from a company on behalf of Rapid Finance requesting payment of… SPAIN · ·Art. 6 Nov 2, 2022
€1,700 Mayor: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 1,700 on the mayor of Dobrzyniewo Duże municipality. The mayor had reported a data breach to the DPA pursuant to Art. 33 GDPR. An… POLAND · ·Art. 5, 25, 32 Nov 2, 2022
€4.3M Portuguese National Statistical Institute: Non-compliance with general data processing principles The Portuguese DPA has fined the Portuguese National Statistical Institute EUR 4,3 million. The DPA found numerous violations of the GPDR in connection with the 2021 census in… PORTUGAL · ·Art. 5, 9, 12 +5 Nov 2, 2022
€5,000 CÍTRICOS TANTA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,000 on CÍTRICOS TANTA, S.L.. The controller had entered personal data of an employee in the Social Security General Employee Register… SPAIN · ·Art. 6 Nov 2, 2022
€525,000 TECHPUMP SOLUTIONS S.L.: Non-compliance with general data processing principles The Spanish DPA has fined Techpump Solutions S.L. EUR 525,000. Techpump operates several websites with adult content. The DPA found several violations of data protection law… SPAIN · ·Art. 5, 6, 8 +5 Oct 31, 2022
€70,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 70,000 on BANCO BILBAO VIZCAYA ARGENTARIA, S.A.. A customer of the bank had filed a complaint with the DPA. The customer had in the past,… SPAIN · ·Art. 5, 32 Oct 31, 2022
€56,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA for having unsuccessfully requested a copy of their phone contract from… SPAIN · ·Art. 5, 32 Oct 31, 2022
DKK 500,000 Datatilsynet (Denmark) - 2022-63-0003 A law firm was exposed to a hacker attack. Thereby, hackers received access to the firm's servers that contained personal data and encrypted them. This posed a serious risk that… Art. 5, 9, 24 +2 Oct 28, 2022
€10,000 ACKERMANN & SCHWARTZ ATTORNEYS AT LAW SLP: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on ACKERMANN & SCHWARTZ ATTORNEYS AT LAW SLP. The law firm had collected personal data from website users without obtaining their… SPAIN · ·Art. 6, 13 Oct 26, 2022
€6,400 AIO E-COMMERCE, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on AIO E-COMMERCE, S.L.. The controller had suffered a data breach resulting in personal data such as bank details being siphoned off and… SPAIN · ·Art. 5 Oct 26, 2022
€8,000 ADSL HOUSE, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 8,000 on ADSL HOUSE, S.L.. The data subject had received advertising calls from the controller, although the data subject was… SPAIN · ·Art. 21, 23, 48 Oct 24, 2022
€1.4M Douglas Italia S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1.4 million on Douglas Italia S.p.a. for various GDPR violations. In the course of its investigation, the DPA initially found that… ITALY · ·Art. 5, 6, 7 +4 Oct 20, 2022
€10,000 Italian Archery Federation (FITARCO): Insufficient legal basis for data processing The Italian DPA (Garante) has fined the Italian Archery Federation (FITARCO) EUR 10,000. A member of the federation had filed a complaint with the DPA due to the fact that the… ITALY · ·Art. 2, 5, 6 +1 Oct 20, 2022
€9,000 Azienda Ospedaliero-Universitaria Careggi di Firenze: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 9,000 on Azienda Ospedaliero-Universitaria Careggi di Firenze. The controller had mistakenly sent a patient medical record to the wrong… ITALY · ·Art. 5, 9, 32 Oct 20, 2022
€900 Istituto di Istruzione Superiore G. Renda di Polistena, Reggio Calabria: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 900 on the educational institution 'Istituto di Istruzione Superiore G. Renda di Polistena, Reggio Calabria'. A former employee of the… ITALY · ·Art. 2, 5, 6 Oct 20, 2022
€12,000 Comune di Salento: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on Comune di Salento. An individual had lodged a complaint with the DPA for being recorded by a CCTV camera, which proved that he… ITALY · ·Art. 5, 6, 12 +3 Oct 20, 2022
€5,000 RESTEXPERIENCE, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined RESTEXPERIENCE, S.L. EUR 5,000. The controller had accidentally sent an email containing tax information of 36 individuals to 11 unauthorized… SPAIN · ·Art. 5, 32 Oct 19, 2022
€5M Interserve Group Limited: Insufficient technical and organisational measures to ensure information security The British DPA has fined the construction group Interserve Group Limited EUR 5,033,000. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. Interserve… UNITED KINGDOM · ·Art. 5, 32 Oct 19, 2022
€150 Private individual: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 150 on a private individual. The individual had made unauthorized use of another person's personal data without their consent. ROMANIA · ·Art. 6 Oct 18, 2022
€2,000 SC Materiale Constructii Online SRL: Insufficient cooperation with supervisory authority The Romanian DPA (ANSPDCP) has fined SC Materiale Constructii Online SRL EUR 2,000 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Oct 18, 2022
€20M Clearview Al Inc.: Insufficient fulfilment of data subjects rights The French DPA has fined Clearview Al Inc. EUR 20,000,000. The company holds a database of more than 20 billion facial images (including those of french residents and nationals)… FRANCE · ·Art. 6, 12, 15 +2 Oct 17, 2022
€35,000 OES GLOBAL ENERGY S.L.: Non-compliance with general data processing principles The Spanish DPA imposed a fine of EUR 35,000 on OES GLOBAL ENERGY S.L.. A customer of the controller had filed a complaint with the DPA after receiving an e-mail from the… SPAIN · ·Art. 5, 32 Oct 17, 2022
€12,000 SEAN SERIOS S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 12,000 on SEAN SERIOS S.L. The controller had published the results of a selection procedure on a website. This included, among other… SPAIN · ·Art. 6 Oct 14, 2022
€900 Private individual: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on a private individual. The individual unauthorizedly sent e-mails with personal data to several recipients in an open distribution list. This… SPAIN · ·Art. 5, 32 Oct 9, 2022