Content type · 2,430 documents in this view · 3,870 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3615 Processing 2657 Personal Data 2430 Controllers 2040 Processing Agreement 1116 Security 1025 Supervision 869 Healthcare 624 Public Authority 577 Law Enforcement 576 Monitoring 552 Consent 511
€900,000 Sats ASA: Insufficient fulfilment of data subjects rights The Norwegian DPA has imposed a fine of EUR 900,000 on the fitness chain 'Sats'. The DPA had received several complaints from customers who had submitted requests for information… NORWAY · ·Art. 5, 6, 12 +3 Feb 6, 2023
€80,500 I&S Limited Kft: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 80,500 on the spa operator, 'I&S Limited Kft'. During its investigation, the DPA found that the controller had installed video… HUNGARY · ·Art. 5, 6, 9 +3 Feb 6, 2023
€30,000 Piraeus Bank: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 30,000 on Piraeus Bank. A customer had filed a complaint with the DPA because the bank had disclosed transaction and account balance… GREECE · ·Art. 5, 33, 34 Feb 2, 2023
€10,000 Vodafone: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on Vodafone. An individual had filed a complaint with the DPA because they had received a package containing promotional gifts… GREECE · ·Art. 5, 6, 13 Feb 2, 2023
€1,000 Tensa Art Design SA: Insufficient fulfilment of data subjects rights The Romanian data protection authority (AEPD) has imposed a fine of EUR 1,000 on Tensa Art Design SA. A data subject had objected to a further newsletter subscription and however… ROMANIA · ·Art. 21 Feb 1, 2023
€1,000 Dentist: Insufficient legal basis for data processing The Romanian DPA has fined a dentist EUR 1,000. The controller had published medical information of a patient, such as photos and X-rays, in an article on a medical blog. However,… ROMANIA · ·Art. 6, 9 Jan 31, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jan 31, 2023
€1,000 Dent Estet Clinic SA: Insufficient fulfilment of data breach notification obligations The Romanian DPA has fined Dent Estet Clinic SA (dental practice) EUR 1,000. An employed dentist at the practice had published medical information of a patient, such as photos and… ROMANIA · ·Art. 33 Jan 31, 2023
€5,000 Misterbianco municipality: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Misterbianco municipality. An employee had filed a complaint with the DPA due to the fact, that the municipality had published a… ITALY · ·Art. 2, 5, 6 Jan 26, 2023
€12,800 Political Party: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 12,800 on a political party. In preparation for an upcoming election, the controller submitted a list of supporters to the Central… BULGARIA · ·Art. 6 Jan 26, 2023
€5,000 Azienda ULSS n.5 Polesana: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 5,000 on Azienda ULSS n.5 Polesana. The healthcare facility had mistakenly sent a patient medical record to the wrong patient. The DPA… ITALY · ·Art. 5, 9, 32 Jan 26, 2023
€7,000 Azienda Ospedaliera Bianchi Melacrino Morelli: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 7,000 on Azienda Ospedaliera Bianchi Melacrino Morelli. The controller had mistakenly sent a document containing health data of the data… ITALY · ·Art. 5, 32, 75 Jan 26, 2023
€4,100 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,100 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 Jan 25, 2023
€8,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has fined a company EUR 8, 000. The controller failed ot properly fulfil the data subject's right to access their personal data processed by the company. The… LITHUANIA · ·Art. 5, 15 Jan 24, 2023
€460,000 Centric Health Ltd.: Non-compliance with general data processing principles The Irish DPA has imposed a fine of EUR 460,000 on Centric Health Ltd.. The controller suffered a ransomware attack in which personal data such as name, date of birth and contact… IRELAND · ·Art. 5, 32 Jan 23, 2023
€5.5M WhatsApp Ireland Ltd.: Insufficient legal basis for data processing The Irish DPA (DPC) has fined WhatsApp Ireland Ltd. EUR 5.5 million. The Austrian organization 'None of Your Business' (NOYB) had filed a complaint with the DPA on behalf of an… ·Art. 6, 12, 13 ·Insufficient legal basis for data processing Jan 19, 2023
€56,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on BANCO BILBAO VIZCAYA ARGENTARIA, S.A.. An individual had filed a complaint with the DPA because the controller had disclosed their personal… SPAIN · ·Art. 5, 32 Jan 19, 2023
€150,000 Dutch Social Insurance Institution (SVB): Insufficient technical and organisational measures to ensure information security The Dutch DPA has imposed a fine of EUR 150,000 on the Dutch Social Insurance Institution (SVB). The controller had suffered a data breach in which a client's data had been leaked… THE NETHERLANDS · ·Art. 32 Jan 19, 2023
€6,400 Szczecin-Centrum District Court: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 6,400 on the Szczecin-Centrum District Court. The court had reported a data breach to the DPA involving the loss of three data carriers.… POLAND · ·Art. 5, 24, 25 +1 Jan 19, 2023
€1,000 Dante Internațional SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Dante Internațional SA. A data subject had filed a complaint with the DPA against the controller due to the fact that the… ROMANIA · ·Art. 17 Jan 18, 2023
€2,000 Private investigator: Insufficient fulfilment of information obligations The Spanish DPA has fined a private investigator EUR 2,000. An individual who had hired the investigator filed a complaint with the DPA. They stated that the controller had failed… SPAIN · ·Art. 13 Jan 18, 2023
€17,900 Dalarna Region: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 17,900 on Dalarna Region. The region had sent out invitations for patient visits where the respective healthcare facility, such as a… SWEDEN · ·Art. 32 Jan 17, 2023
€1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient technical and organisational measures to ensure… BULGARIA · ·Art. 5, 6 Jan 17, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jan 16, 2023
€40,000 Thomas International Systems, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Thomas International Systems, S.A.. Thomas International performs psychological tests on behalf of other companies. Thomas International had… SPAIN · ·Art. 9 Jan 16, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Jan 16, 2023
€50,000 DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance This case involves an own-volition investigation conducted by the Irish DPA (DPC) into Kildare County Council, the controller. In June 2018, Officers from the Special… Art. 2, 5, 6 +5 Jan 16, 2023
€3,000 SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.. A former employee had filed a complaint with the DPA due to the controller's unauthorized… SPAIN · ·Art. 6 Jan 12, 2023
€2,000 BRISTOL LOGISTICS SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on BRISTOL LOGISTICS SA. The DPA received a notification from BRISTOL LOGISTICS SA of a personal data breach under Art. 33 GDPR.… ROMANIA · ·Art. 32 Jan 12, 2023
€2,500 Azienda Sanitaria Locale di Brindisi: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 2,500 on Azienda Sanitaria Locale di Brindisi. A data subject had filed a complaint with the DPA due to the health authority's failure to… ITALY · ·Art. 12, 15 Jan 11, 2023
€6,000 Praktiškas UAB: Insufficient legal basis for data processing The Lithuanian DPA has fined Praktiškas UAB, the operator of SportGates sports clubs, EUR 6,000. The controller had processed biometric data of customers in the context of their… LITHUANIA · ·Art. 5, 9, 13 +2 Jan 9, 2023
€390M Meta Platforms Ireland Limited: Non-compliance with general data processing principles The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 390 million. The DPA has imposed a fine of EUR 210 million for violations related to the provision of its Facebook… Jan 4, 2023
€3,000 Apă Canal Ilfov SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Apă Canal Ilfov SA. The controller sent an e-mail with personal data to several recipients in an open distribution list. This… ROMANIA · ·Art. 32 Jan 4, 2023
€3,000 Transport Workers' Union of Aragon: Non-compliance with general data processing principles The Spanish DPA has fined the Transport Workers' Union of Aragon EUR 3,000. The union had published a document with personal data (surname, first name and identity card number) of… SPAIN · ·Art. 5, 32 Jan 3, 2023
€500 Homeowners Association: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 500 on a homeowners' association. The controller had publicly posted a list with the first and last names of all members of the… ROMANIA · ·Art. 5 Jan 3, 2023
€24,000 FACTOR ENERGÍA,
S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a FACTOR ENERGÍA, S.A.. A data subject had filed a complaint with the DPA because they had received advertising messages from the controller… SPAIN · ·Art. 6 Jan 2, 2023
€8,000 Cypriot Ministry of the Interior: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 8,000 on the Cypriot Ministry of the Interior. The Ministry of Interior had unlawfully transmitted personal data of employees to the… CYPRUS · ·Art. 5 Jan 1, 2023
Private individual: Non-compliance with general data processing principles The DPA of Hamburg has imposed a mid-four-figure fine on a private individual for improper use of the personal data of an opponent in a video game. The case occurred on the live… GERMANY · ·Non-compliance with general data processing principles Jan 1, 2023
€25,000 Company: Insufficient fulfilment of data subjects rights The DPA of Hessen has fined a company EUR 25,000. A person had filed a complaint for receiving advertising messages, although they had objected to receiving advertising messages GERMANY ·Art. 21 ·Insufficient fulfilment of data subjects rights Jan 1, 2023
Pizza delivery service: Non-compliance with general data processing principles The DPA of Baden-Wuerttemberg has imposed a four-digit fine on a pizza delivery service. The controller had disposed of receipts containing customers' personal data at a public… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2023
Real estate agency: Insufficient legal basis for data processing The DPA of Bremen has imposed five fines on a real estate agency. The controller had repeatedly sent advertising messages to a former prospect and tried to contact them by… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Daycare center: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a four-figure fine on a daycare center that had disposed of documents containing personal data of children and their parents in a publicly… GERMANY · ·Art. 32 Jan 1, 2023
€28,000 Political party: €28,000 fine The Austrian DPA has imposed a fine of EUR 50,700 on a political party. The controller had sent two emails in an open distribution list. This allowed the recipients to view the… AUSTRIA · ·Unknown Jan 1, 2023
€2,000 Private individual: Insufficient legal basis for data processing The DPA of Baden-Wuerttemberg has imposed a fine of EUR 2,000 on a clinic employee. The employee had unlawfully accessed a patient administration system in order to find out more… GERMANY ·Art. 6, 9 ·Insufficient legal basis for data processing Jan 1, 2023
€3,000 Breikot Management Ltd: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 3,000 on Breikot Management Ltd. The DPA found that the company had violated the principle of minimization by processing excessive… CYPRUS · ·Art. 5, 6 Jan 1, 2023
€9,000 Magdeburg University Hospital: Insufficient fulfilment of data breach notification obligations The DPA of Sachsen-Anhalt has imposed a fine of EUR 9,000 on Magdeburg University Hospital. The clinic had failed to report to the DPA a data breach involving a former employee… GERMANY ·Art. 33 ·Insufficient fulfilment of data breach notification obligations Jan 1, 2023
Fishing club: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a three-figure fine on a fishing club due to the fact that lists of members' personal data such as first and last names, full addresses with… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Private individual: Insufficient legal basis for data processing The DPA in Baden-Wuerttemberg imposed a fine on a private individual for installing a motion tracker on the data subject's car without their consent. GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Clinic: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a clinic for transmitting an unredacted treatment report on the psychiatric treatment of the data subject to an accident insurance fund… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Operator of a dating platform: Insufficient technical and organisational measures to ensure information security The DPA of Bremen has imposed a fine on the operator of an online dating platform. The controller had not provided an email verification procedure for registration on its dating… GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2023