Content type · 2,273 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€64,000 EVERIS SPAIN S.L: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on EVERIS SPAIN S.L.. Everis had published information on sold data of users of an insurance company as well as records with personal data of… ·Art. 5, 32 ·Non-compliance with general data processing principles Oct 9, 2022
€24,000 CAJA DE SEGUROS REUNIDOS, COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on CAJA DE SEGUROS REUNIDOS, COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A.. A data subject filed a complaint with the DPA. The data subject had taken… SPAIN · ·Art. 6 Oct 9, 2022
€10,000 Poste Italiane S.p.a.: Insufficient fulfilment of data subjects rights The Italian DPA (Garante) fined Poste Italiane S.p.a. EUR 10,000 for failing to respond to the data subject's request for access to their data in a timely manner. ITALY · ·Art. 12 Oct 6, 2022
€15,000 Servizio Idrico Integrato S.c.p.a.: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Servizio Idrico Integrato S.c.p.a. EUR 15,000. The controller had operated a website where personal data was being processed without using an SSL form.… ITALY · ·Art. 5, 32 Oct 6, 2022
€3,000 Associazione Rescue Drones Network ODV: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 3,000 on Associazione Rescue Drones Network ODV. A founding member of the association had filed a complaint with the DPA. The member… ITALY · ·Art. 12, 15 Oct 6, 2022
€2M Alpha Exploration: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 2 million on Alpha Exploration. Alpha Exploration operates the social network Clubhouse. In the course of its investigation, the DPA… ITALY · ·Art. 5, 6, 7 +7 Oct 6, 2022
€10,000 Codess Sociale, Soc. Coop. sociale.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Codess Sociale, Soc. Coop. sociale. A former voluntary member had filed a complaint with the DPA. The data subject states that… ITALY · ·Art. 12, 17 Oct 6, 2022
€6,000 Club Náutico el Estacio: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on Club Náutico el Estacio. A data subject filed a complaint against the controller with the AEPD. The complaint is based on… SPAIN · ·Art. 5, 32 Oct 4, 2022
€1.5M Easylife Ltd.: Insufficient legal basis for data processing The UK DPA has imposed a fine of EUR 1,547,000 on Easylife Ltd. Easylife is a retailer that sells household items as well as services and products under its health, motor,… UNITED KINGDOM · ·Art. 5, 6, 9 +1 Oct 4, 2022
€150 Website operator: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 150 on a website operator. The controller had published unauthorized personal data such as telephone number, ID number and series,… ROMANIA · ·Art. 5, 6 Oct 3, 2022
€900 LfD (Lower Saxony) - Fine EUR 900,000 against bank A commercial bank (controller) used personal data of current and former customers (data subjects) to identify customers with an affinity for digital media usage, in order to… Germany ·Art. 6 Sep 28, 2022
Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 4) This is the Danish DPA's fourth decision in the case relating to Helsingor municipality's processing of personal data in primary and lower secondary school. Helsingor… 2020-431-0061 (Helsingor decision no. 4) ·Art. 28, 36, 58 Sep 28, 2022
Datatilsynet (Denmark) - 2020-422-0026 The Danish DPA had decided to investigate three research projects of Region Syddanmark (the controller) with regards to its processing activities, the use of processors, data… 2020-422-0026 ·Art. 5 Sep 28, 2022
€180 Y OTRO MAS C.B.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on Y OTRO MAS C.B.. The controller had installed a video surveillance system in a residential complex. During its investigation, the DPA found… SPAIN · ·Art. 13 Sep 28, 2022
€26,700 TV2 Média Csoport Zrt.: Non-compliance with general data processing principles The Hungarian DPA has fined TV2 Média Csoport Zrt. EUR 26,700. In the course of its investigation, the DPA found that the controller had operated two websites without providing… HUNGARY · ·Art. 5, 6, 12 +1 Sep 26, 2022
€1,200 Health insurance provider: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 1,200 on a health insurance provider. The insurer had published the result of a Covid-19 test of the data subject on its website. This… HUNGARY · ·Art. 5, 12, 31 Sep 25, 2022
€3,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 23, 2022
€2,000 Bitfactor SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Bitfactor SRL. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. Due to a malfunction of an… ROMANIA · ·Art. 25, 32 Sep 22, 2022
€3,000 Gas station: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 3,000 on a gas station operator. A person had filed a complaint with the DPA due to the controller's failure to grant them access to… GREECE · ·Art. 12, 14 Sep 22, 2022
NAIH (Hungary) - NAIH-4667-10/2022 A minor student (the data subject) alleged that his grade had been amended before the semester grading meeting without notification. The parent of the data subject requested… NAIH-4667-10/2022 ·Art. |, 10, 28 +1 Sep 22, 2022
€5,000 Curtea Veche Publishing SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Curtea Veche Publishing SRL. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR. In the first… ROMANIA · ·Art. 32 Sep 21, 2022
€525,000 Company: Insufficient involvement of data protection officer The DPA of Berlin has imposed a fine of EUR 525,000 on the subsidiary of a Berlin-based e-commerce group. The company had appointed a data protection officer, who however was also… GERMANY ·Art. 38 ·Insufficient involvement of data protection officer Sep 20, 2022
€2,000 Banca Comercială Română SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Banca Comercială Română SA. The bank had notified the DPA of a data breach pursuant to Art. 33 GDPR. Due to an error in the IT… ROMANIA · ·Art. 25, 32 Sep 19, 2022
€10,000 SOPHIE ET VOILA, S.L: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on SOPHIE ET VOILA, S.L..The wedding dress company had published a picture of a customer in a wedding dress on its Instagram… SPAIN · ·Art. 6 Sep 16, 2022
€2,000 Agent of the real estate agency BARCELONA DREAM HOUSE AGENCY: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on an agent of the real estate agency BARCELONA DREAM HOUSE AGENCY. An individual had filed a complaint with the DPA because the… SPAIN · ·Art. 13 Sep 16, 2022
€10,000 Bper Banca S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Bper Banca S.p.A.. An individual had filed a complaint with the DPA regarding the failure to fulfill their right to erasure of… ITALY · ·Art. 12 Sep 15, 2022
€100,000 Lazio Region: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Lazio Region. An individual had filed a complaint with the DPA because she had received an invitation from the regional health… ITALY · ·Art. 5, 6, 9 +4 Sep 15, 2022
€40,000 FCA Italy S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on FCA Italy S.p.A.. An employee of the controller had requested access to personal data processed in the context of their… ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Sep 15, 2022
€3,000 Thiene municipality: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 3,000 on Thiene municipality. A former employee of the municipality filed a complaint with the DPA because a document containing… ITALY · ·Art. 2, 5, 6 Sep 15, 2022
€2,000 Immobiliare Riscostruzione Meloria s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has imposed a fine of EUR 2,000 on Immobiliare Riscostruzione Meloria s.r.l.. The controller had installed a video surveillance system at its office which covered… ITALY · ·Art. 5, 13 Sep 15, 2022
€250,000 GIE INFOGREFFE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 250,000 on GIE INFOGREFFE. The portal operates a website where people can access legal information about companies and order documents… FRANCE · ·Art. 5, 32 Sep 13, 2022
€6,700 Hørsholm municipality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 6,700 on Hørsholm municipality. The municipality had reported a data breach to the DPA pursuant to Art. 33 GDPR. An employee's work… DENMARK · ·Art. 32 Sep 12, 2022
€80,700 Coin dealer: Non-compliance with general data processing principles The Hungarian DPA imposed a fine of EUR 80,700 on a coin dealer. During its investigation, the DPA found that the privacy policy did not contain sufficient information about the… HUNGARY · ·Art. 5, 6, 7 +2 Sep 12, 2022
€180 EURO DONER KEBAB: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on EURO DONER KEBAB. The controller had installed video surveillance cameras which, among other things, also covered the public space.… SPAIN · ·Art. 5, 13 Sep 9, 2022
€15,000 School: Non-compliance with general data processing principles The Hellenic DPA has fined a school EUR 15,000. The school had installed several video surveillance cameras on the building, which permanently recorded students, teachers and… GREECE · ·Art. 5, 6, 12 +2 Sep 9, 2022
€2,000 SC Raiffeisen Bank SA: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 2,000 on SC Raiffeisen Bank SA. An individual had filed a complaint with the DPA for receiving text messages about money transfers to… ROMANIA · ·Art. 5 Sep 9, 2022
€15 HDPA (Greece) - 50/2022 A former teacher (the data subject) at a private primary school (the controller) submitted a complaint to the Greek DPA regarding a video surveillance system in the classrooms,… Art. 5, 6, 12 +2 Sep 9, 2022
€8,000 Realmedia Network SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined Realmedia Network SA EUR 8,000. The company had suffered security breaches on a website it operates. This allowed it to leak and access unauthorized… ROMANIA · ·Art. 32 Sep 8, 2022
€530 Sułkowice Cultural Center: Insufficient data processing agreement The Polish DPA has imposed a fine of EUR 530 on the Sułkowice Cultural Center. During its investigation, the DPA found that the controller had transferred the processing of… POLAND · ·Art. 28 Sep 7, 2022
€20,000 MUXERS CONCEPT, S.L.: Insufficient legal basis for data processing The Spanish DPA has fined MUXERS CONCEPT, S.L. EUR 20,000. The company had installed video surveillance cameras and microphones in the employee changing room in one of the… SPAIN · ·Art. 6 Sep 6, 2022
€5,000 EDYTE SA: Insufficient legal basis for data processing The Hellenic DPA has imposed a fine of EUR 5,000 on EDYTE SA. EDYTE, as a processor, had unlawfully disclosed personal data to third parties without the authorization of the data… GREECE · ·Art. 29 Sep 6, 2022
€360 Store owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a store owner. The controller had installed video surveillance cameras which, among other things, also covered the public space. The… SPAIN · ·Art. 5, 13 Sep 4, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR on a private individual. The data subject had filed a complaint against his ex-wife with the DPA. The ex-wife had installed video… SPAIN · ·Art. 5 Sep 4, 2022
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The individual had published personal data of another person on a blog without their consent and in a… SPAIN · ·Art. 6 Sep 1, 2022
€1,450 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA (UODO) has fined a data controller EUR 1,450 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Aug 31, 2022
€3,000 COLEGIO VILLAEUROPA, S.C.L: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on COLEGIO VILLAEUROPA, S.C.L. The school did not provide sufficient information on the video surveillence, as required by Art. 13 GDPR. The… SPAIN · ·Art. 13 Aug 30, 2022
€6,800 TIMSHEL Sp. z o.o.: Insufficient cooperation with supervisory authority The Polish DPA (UODO) has fined TIMSHEL Sp. z o.o. EUR 6,800 for failing to provide information requested by the DPA during an investigation POLAND · ·Art. 58 Aug 30, 2022
€1,000 Alpha Bank Romania SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Alpha Bank Romania SA. The bank had accidentally sent a document to the wrong recipient via WhatsApp. The document contained… ·Art. 29, 32 ·Insufficient technical and organisational measures to ensure information security Aug 29, 2022
€5,600 SOLIVESA MASTER FRANCHISE S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 5,600 on SOLIVESA MASTER FRANCHISE S.L.. The data subject had received an advertising call from the controller made on behalf of… SPAIN · ·Art. 28, 48 Aug 28, 2022
€480 SERVICIOS PROFESIONALES LA PARADA S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on SERVICIOS PROFESIONALES LA PARADA S.L.. The company had installed video surveillance cameras which, among other things, also covered… SPAIN · ·Art. 5, 13 Aug 25, 2022