Content type · 1,843 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€50,000 Intellexa SA: Insufficient cooperation with supervisory authority The Hellenic DPA has fined Intellexa SA EUR 50,000. The controller had not properly cooperated with the DPA during an investigation. GREECE · ·Art. 31 Jan 13, 2023
€3,000 SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.. A former employee had filed a complaint with the DPA due to the controller's unauthorized… SPAIN · ·Art. 6 Jan 12, 2023
€5,000 Azienda Ospedale-Università Padova: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Azienda Ospedale-Università Padova. The controller had sent an email containing consent forms for participation in a clinical… ITALY · ·Art. 5, 9 Jan 11, 2023
€6,000 Praktiškas UAB: Insufficient legal basis for data processing The Lithuanian DPA has fined Praktiškas UAB, the operator of SportGates sports clubs, EUR 6,000. The controller had processed biometric data of customers in the context of their… LITHUANIA · ·Art. 5, 9, 13 +2 Jan 9, 2023
€3,000 Apă Canal Ilfov SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Apă Canal Ilfov SA. The controller sent an e-mail with personal data to several recipients in an open distribution list. This… ROMANIA · ·Art. 32 Jan 4, 2023
€500 Homeowners Association: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 500 on a homeowners' association. The controller had publicly posted a list with the first and last names of all members of the… ROMANIA · ·Art. 5 Jan 3, 2023
€24,000 FACTOR ENERGÍA,
S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a FACTOR ENERGÍA, S.A.. A data subject had filed a complaint with the DPA because they had received advertising messages from the controller… SPAIN · ·Art. 6 Jan 2, 2023
€16,600 Company: €16,600 fine The DPA of Niedersachsen has imposed a fine of EUR 16,600 on a company in the real estate industry for failing to conclude a joint controllership agreement. In addition, the… GERMANY ·Art. 6, 12, 26 ·Unknown Jan 1, 2023
Pizza delivery service: Non-compliance with general data processing principles The DPA of Baden-Wuerttemberg has imposed a four-digit fine on a pizza delivery service. The controller had disposed of receipts containing customers' personal data at a public… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2023
Company: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a company. The controller had stored the contact details of former employees without their prior consent in order to contact them in the… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Operator of a dating platform: Insufficient technical and organisational measures to ensure information security The DPA of Bremen has imposed a fine on the operator of an online dating platform. The controller had not provided an email verification procedure for registration on its dating… GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2023
Supermarket: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a five-figure fine on a company. The controller had posted a list of employees' sickness-related absences for the year 2022 in the employee… GERMANY ·Art. 6, 9 ·Insufficient legal basis for data processing Jan 1, 2023
€215,000 Humboldt Forum Service GmbH: Insufficient legal basis for data processing The DPA of Berlin has imposed fines totaling EUR 215,000 on Humboldt Forum Service GmbH. Humboldt Forum had improperly documented sensitive information about individual employees… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
€28,000 Political party: €28,000 fine The Austrian DPA has imposed a fine of EUR 50,700 on a political party. The controller had sent two emails in an open distribution list. This allowed the recipients to view the… AUSTRIA · ·Unknown Jan 1, 2023
Company: Insufficient legal basis for data processing The DPA in Bremen has imposed a fine on a company. The controller had stored an applicant's application documents after the application process for the purpose of further… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
€5,000 MALTA DPA: Non-compliance with general data processing principles The controller unlawfully gained access to audio recordings from a surveillance camera. Art. 5, 6 ·Non-compliance with general data processing principles Jan 1, 2023
Company: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a company. The controller had installed video cameras in the offices and monitored employees before, during and after their working hours… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
€8,000 Bank of Cyprus Public Company Ltd.: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 8,000 on Bank of Cyprus Public Company Ltd.. The controller had stored inaccurate data about a data subject in its system. Art. 5 ·Non-compliance with general data processing principles Jan 1, 2023
Real estate agency: Insufficient legal basis for data processing The DPA of Bremen has imposed five fines on a real estate agency. The controller had repeatedly sent advertising messages to a former prospect and tried to contact them by… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
€15,000 A&G Couriers Limited T/A Fastway Couriers (Ireland): Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) has fined A&G Couriers Limited T/A Fastway Couriers (Ireland) EUR 15,000. During a changeover of its IT systems, the controller had suffered a cyberattack in… Art. 32 ·Insufficient technical and organisational measures to ensure information security Dec 30, 2022
€24,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller carried out a… SPAIN · ·Art. 6 Dec 29, 2022
€3M CNIL fines VOODOO for cookie and tracker consent failures in mobile games VOODOO ('provider') was a mobile game developer. The investigation service of the French DPA (the investigation service) carried out several checks on voodoo.io and on several of… France ·Art. 4, 5, 82 Dec 29, 2022
€600 Homeowners Association: Insufficient legal basis for data processing The Spanish DPA has fined a homeowners association EUR 600. The controller had installed an unauthorized CCTV system in the residential area. In addition, the DPA found that the… SPAIN · ·Art. 6, 13 Dec 28, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Dec 28, 2022
€400 MAE WEST SYSTEMS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined MAE WEST SYSTEMS, S.L. EUR 400. The controller had installed video surveillance in a bar it operated without providing sufficient information… SPAIN · ·Art. 13 Dec 28, 2022
€2,000 Homeowners Association: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An individual who did cleaning work in the residential complex had filed a complaint with the DPA… SPAIN · ·Art. 6, 15 Dec 28, 2022
€3,000 Kaufland Romania SCS: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Kaufland Romania SCS. The controller had reported a data breach to the DPA according to Art. 33 GDPR. An employee had taken… ·Art. 29, 32 ·Insufficient technical and organisational measures to ensure information security Dec 27, 2022
€100,000 VIEC Limited: Non-compliance with general data processing principles The Irish DPA has imposed a fine of EUR 100,000 on the nursing home operator VIEC Limited. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. The… IRELAND ·Art. 5, 32 ·Non-compliance with general data processing principles Dec 22, 2022
€10,000 SUDREZIDENȚIAL Broker S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on SUDREZIDENȚIAL Broker S.R.L.. An employee of the controller had unauthorizedly published an Excel spreadsheet containing… ROMANIA · ·Art. 32 Dec 22, 2022
€8,000 Hotel: Insufficient legal basis for data processing The Hungarian DPA has imposed a fine of EUR 8,000 on a hotel. The controller had installed video surveillance cameras that covered the dining room and a whirlpool area permanently… HUNGARY · ·Art. 5, 6, 12 +2 Dec 21, 2022
€1,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on a private individual. A person had filed a complaint with the DPA because the controller had published their personal data such… SPAIN · ·Art. 5 Dec 20, 2022
€7,000 ΜΑΡΙΑ ΠΕΔΙΩΤΗ ΚΑΙ ΣΙΑ Ο.Ε.: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 7,000 on the company ΜΑΡΙΑ ΠΕΔΙΩΤΗ ΚΑΙ ΣΙΑ Ο.Ε. The company had not sufficiently complied with the request for information from a… GREECE · ·Art. 12, 15, 31 Dec 19, 2022
€30,000 ORANGE ESPAGNE, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine ORANGE ESPAGNE, S.A.U. due to insufficient legal basis for data processing. The data subject had filed a complaint against the data… SPAIN · ·Art. 6 Dec 15, 2022
€16,000 HOSPITAL RECOLETAS PONFERRADA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on the healthcare facility HOSPITAL RECOLETAS PONFERRADA, S.L.. A patient had filed a complaint with the DPA. The patient had filled out a… SPAIN · ·Art. 6, 15 Dec 15, 2022
€120,000 Eurosanità S.P.A.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 120,000 on Eurosanità S.P.A.. The controller operates various healthcare facilities. An individual had filed a complaint with the DPA for… ITALY · ·Art. 5, 9, 32 Dec 15, 2022
€750,000 Alektum Oy: Insufficient fulfilment of data subjects rights The Finnish DPA has fined the debt collection company Alektum Oy EUR 750 000. The DPA opened an investigation against the controller after three people filed complaints against… FINLAND · ·Art. 12, 15 Dec 13, 2022
€1,500 Manager of a real estate co-ownership: Insufficient legal basis for data processing The DPA of Luxembourg has imposed a fine of EUR 1,500 on a manager of a real estate co-ownership. The controller had disclosed personal data to unauthorized third parties without… LUXEMBOURG · ·Art. 5, 6, 12 +1 Dec 13, 2022
€1,400 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 1,400 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12, 13 Dec 13, 2022
€700 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 700 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12, 13 Dec 13, 2022
€2,100 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 2,100 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12, 13 Dec 13, 2022
€2,000 Casa Rusu S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Casa Rusu S.R.L. . The controller had reported a data breach to the DPA pursuant to Art. 33 GDPR. The controller had used an… ROMANIA · ·Art. 25, 32 Dec 9, 2022
€230,000 Viking Line Oy Abp: Non-compliance with general data processing principles The Finnish DPA has imposed a fine of EUR 230,000 on Viking Line Oy Abp. A former employee had filed a complaint with the DPA. During its investigation, the DPA found that the… FINLAND · ·Art. 5, 12, 13 +2 Dec 9, 2022
€8,000 Notary: Insufficient legal basis for data processing The Spanish DPA has fined a notary. The controller had consulted the land register of a property belonging to the data subject without an order requiring the consultation of this… SPAIN · ·Art. 6 Dec 9, 2022
€120 Private individual: Insufficient fulfilment of information obligations The Spanish DPA has fined a private individual. The controller had installed a video surveillance system in a multi-party residential building that they own. However, the… SPAIN · ·Art. 13 Dec 9, 2022
€2,654 Jewelry manufacturer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a jewelry manufacturer. The controller had installed a video surveillance system in its premises, however the DPA found… CROATIA · ·Art. 27 Dec 8, 2022
€2,654 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 8, 2022
€2,654 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 7, 2022
€1,991 Fish market: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a fish market. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 7, 2022
€3,185 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 3,185 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 6, 2022
€1,991 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 6, 2022