Content type · 2,661 documents in this view · 3,871 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3645 Processing 2661 Personal Data 2436 Controllers 2044 Processing Agreement 1116 Security 1027 Supervision 877 Healthcare 624 Public Authority 579 Law Enforcement 576 Monitoring 553 Consent 512
€1,000 Private individual: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 1,000 on a private individual. The controller had sent data subjects electoral advertising without a valid legal basis. AUSTRIA · ·Art. 6 Jun 16, 2023
€22,500 Irish Departement of Health: Non-compliance with general data processing principles The Irish DPA (DPC) has fined the Irish Department of Health EUR 22,500. The DPA launched an investigation into the department following public allegations that the department… IRELAND · ·Art. 5, 6, 9 Jun 16, 2023
€40M CRITEO: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 40 million on CRITEO. The controller is specialized in 'retargeting advertising'. This involves the company tracking the surfing behavior… Jun 15, 2023
€8,000 Artima S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 8,000 on Artima S.A.. The controller had reported a data breach to the DPA. During its investigation, the DPA found that employees of… ROMANIA · ·Art. 32 Jun 15, 2023
€2,000 BRD-Groupe Société Générale S.A.: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 2,000 on BRD-Groupe Société Générale S.A.. The controller had reported a data breach to the DPA. During its investigation, the DPA found… ROMANIA · ·Art. 5 Jun 15, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public space.… SPAIN · ·Art. 5 Jun 14, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€210,000 Piraeus Bank: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 210,000 on Piraeus Bank. During its investigation, the DPA found that the bank had processed personal data of customers in violation of… GREECE · ·Art. 5, 6, 15 +1 Jun 12, 2023
DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR On 03 May 2021, the data subject sent a request to the controller for the erasure of their financial asset information. The controller did not respond to their erasure request. On… 2021-0.909.100 ·Art. 55, 77 Jun 12, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 9, 2023
€300,000 Rinascente S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Rinascente S.p.A. EUR 300,000. The DPA acted on a complaint from a customer who, following an incident with a store employee, had her long-standing… ITALY · ·Art. 5, 12, 32 +1 Jun 8, 2023
€40,000 RCS Mediagroup S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on RCS Mediagroup S.p.a. for publishing images of an individual without a valid legal basis. ITALY · ·Art. 5 Jun 8, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 Jun 8, 2023
€150,000 KG COM: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 150,000 on the company KG COM. The company operates several websites and offers fortune-telling consultations to customers via chat or… FRANCE · ·Art. 5, 6, 9 +6 Jun 8, 2023
€5,000 Azienda Tutela della Salute della Sardegna: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Azienda Tutela della Salute della Sardegna. The health authority had placed a sign at the gate of a physician's practice… ITALY · ·Art. 2, 5, 9 Jun 7, 2023
€3,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 3,000. An individual had filed a complaint with the DPA against the controller due to the fact that the controller had provided… SPAIN · ·Art. 5, 32 Jun 6, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 6, 2023
€3,000 S.C. Apollo Salon S.R.L.: Insufficient cooperation with supervisory authority The Romanian DPA imposed a fine of EUR 3,000 on S.C. Apollo Salon S.R.L. for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Jun 6, 2023
€56,000 VODAFONE ONO, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on VODAFONE ONO, S.A.U.. The controller had carried out a credit check on an individual without there being a customer relationship or other… SPAIN · ·Art. 6 Jun 6, 2023
€10,000 ALPA 57 PRODUCCIONES: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on ALPA 57 PRODUCCIONES. A data subject had filed a complaint with the DPA because the controller had unlawfully transmitted their… SPAIN · ·Art. 6 Jun 5, 2023
€4,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 Jun 2, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which also recorded a neighbor property. The DPA… SPAIN · ·Art. 5 Jun 2, 2023
€15,000 Thin Srl: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection… ITALY · ·Art. 5, 9, 13 Jun 1, 2023
€42,000 PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA. An individual had filed a complaint with the DPA because the controller had disclosed… SPAIN · ·Art. 5, 32 Jun 1, 2023
€20,000 Ew Business Machines S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on Ew Business Machines S.p.A.. The controller had installed a video surveillance system that not only recorded images in real… ITALY · ·Art. 5, 9, 13 +1 Jun 1, 2023
€3,000 Comune di Napoli: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Napoli. The municipality had sent three former employees, after termination of their employment an e-mail containing… ITALY · ·Art. 2, 5, 6 Jun 1, 2023
€20,000 Azienda Usl Toscana Sud Est.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 against Azienda Usl Toscana Sud Est. The controller had put up an information poster in the emergency room showing a healthcare… ITALY · ·Art. 2, 5, 9 +1 Jun 1, 2023
€2,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 2,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 May 31, 2023
€300 CBHNOS S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CBHNOS S.L.. The controller had installed video surveillance cameras which, among other things, also covered a public road. The DPA… SPAIN · ·Art. 5 May 29, 2023
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed a video surveillance camera which also covered the public space and a neighbour property.… SPAIN · ·Art. 5, 13 May 25, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 10,000 for publishing a picture and address of another person on a website without their consent. SPAIN · ·Art. 6 May 24, 2023
€1,000 Global Baby Brand SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on Global Baby Brand SRL. A person had filed a complaint with the DPA alleging that the controller had sent commercial SMS… ROMANIA · ·Art. 7 May 23, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing May 23, 2023
€380,000 Sports betting operator: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 380,000 on a sports betting operator. AZOP had received a complaint from a data subject, stating that the controller had obtained… CROATIA · ·Art. 6, 13, 25 +1 May 18, 2023
€18,000 AUTOMOBILE BAVARIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 18,000 on AUTOMOBILE BAVARIA SRL. The data controller had notified the authority of a data breach pursuant to Art. 33 GDPR. Unknown… ROMANIA · ·Art. 25, 32 May 18, 2023
€10,000 La Gazzetta di Parma S.r.l.: Non-compliance with general data processing principles The Italian DPA has fined La Gazzetta di Parma S.r.l. EUR 10,000. The controller had published photos in its newspaper of an individual accused of murder. The photos showed the… ITALY · ·Art. 5 May 17, 2023
€50,000 FUSIONA SOLUCIONES ENERGÉTICAS, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on FUSIONA SOLUCIONES ENERGÉTICAS, S.A.. The controller had submitted data from the data subject to a credit information system… SPAIN · ·Art. 6 May 17, 2023
€60,000 Website operator: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on a website operator. The controller had published unauthorized personal data on the website www.trovanumeri.com, which it had… ITALY · ·Art. 5, 6, 12 +6 May 17, 2023
€5,000 Compania Națională Poșta Română S.A.: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 5,000 on the Romanian Post (Compania Națională Poșta Română S.A.). During its investigation, the DPA found that the controller had… ROMANIA · ·Art. 5, 6 May 16, 2023
€1,000 NN Asigurări de Viață S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,00 on the insurance company NN Asigurări de Viață S.A.. The controller had notified the authority of a data breach pursuant to Art. 33… ROMANIA · ·Art. 32 May 12, 2023
€1,200M Meta Platforms Ireland Limited: Insufficient legal basis for data processing The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 1.2 billion. This is the highest fine imposed to date under the GDPR. In its decision, the DPC found that Meta had… ·Art. 46 May 12, 2023
€1,500 NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,500 on the insurance company NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.. The controller had… ROMANIA · ·Art. 32 May 12, 2023
€11,000 Libra Internet Bank SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 11,000 on Libra Internet Bank SA. An individual had filed a complaint against the bank due to the bank's failure to fully comply with… ROMANIA · ·Art. 12, 15 May 11, 2023
€5.2M Clearview AI: Insufficient cooperation with supervisory authority The French DPA has fined Clearview AI EUR 5.2 million. The DPA had imposed a fine of EUR 20 million on the company in 2022 for unlawfully collecting personal data. In addition to… FRANCE · ·Insufficient cooperation with supervisory authority May 10, 2023
€5,000 ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has fined ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U. EUR 5,000. An individual had filed a complaint with the DPA because employees of the controller had visted their… SPAIN · ·Art. 6 May 9, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 May 9, 2023
€2,000 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An owner had filed a complaint with the DPA due to the fact that members of the association had… SPAIN · ·Art. 5 May 5, 2023