Content type · 2,802 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public space.… SPAIN · ·Art. 5 Jun 14, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€210,000 Piraeus Bank: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 210,000 on Piraeus Bank. During its investigation, the DPA found that the bank had processed personal data of customers in violation of… GREECE · ·Art. 5, 6, 15 +1 Jun 12, 2023
€4.9M Spotify: Insufficient fulfilment of data subjects rights The Swedish Data Protection Authority (DPA) has imposed a fine of EUR 4.9 million on the music streaming provider Spotify. The DPA had launched an investigation after receiving a… SWEDEN ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Jun 12, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 9, 2023
€150,000 KG COM: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 150,000 on the company KG COM. The company operates several websites and offers fortune-telling consultations to customers via chat or… FRANCE · ·Art. 5, 6, 9 +6 Jun 8, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 Jun 8, 2023
€300,000 Rinascente S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Rinascente S.p.A. EUR 300,000. The DPA acted on a complaint from a customer who, following an incident with a store employee, had her long-standing… ITALY · ·Art. 5, 12, 32 +1 Jun 8, 2023
€40,000 RCS Mediagroup S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on RCS Mediagroup S.p.a. for publishing images of an individual without a valid legal basis. ITALY · ·Art. 5 Jun 8, 2023
€84,000 UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC a fine. A person had filed a complaint against the controller because a package addressed to them… SPAIN · ·Art. 5, 32 Jun 7, 2023
€5,000 Azienda Tutela della Salute della Sardegna: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Azienda Tutela della Salute della Sardegna. The health authority had placed a sign at the gate of a physician's practice… ITALY · ·Art. 2, 5, 9 Jun 7, 2023
€400 LEADDESK, S.L: Insufficient cooperation with supervisory authority The Spanish DPA has fined LEADDESK, S.L for failing to provide information requested by the DPA during an investigation. The original fine of EUR 500 was reduced to EUR 400 due to… SPAIN · ·Art. 58 Jun 7, 2023
€1,200 CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L.. During its investigation, the DPA found that the controller had failed to properly and… SPAIN · ·Art. 21 Jun 7, 2023
€20,000 RCI BANQUE, S.A. SUCURSAL EN ESPAÑA: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine of EUR 20,000 RCI BANQUE, S.A. SUCURSAL EN ESPAÑA. A data subject complained that she was receiving text messages from the controller,… SPAIN · ·Art. 17 Jun 7, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 6, 2023
€3,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 3,000. An individual had filed a complaint with the DPA against the controller due to the fact that the controller had provided… SPAIN · ·Art. 5, 32 Jun 6, 2023
€56,000 VODAFONE ONO, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on VODAFONE ONO, S.A.U.. The controller had carried out a credit check on an individual without there being a customer relationship or other… SPAIN · ·Art. 6 Jun 6, 2023
€3,000 S.C. Apollo Salon S.R.L.: Insufficient cooperation with supervisory authority The Romanian DPA imposed a fine of EUR 3,000 on S.C. Apollo Salon S.R.L. for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Jun 6, 2023
€10,000 ALPA 57 PRODUCCIONES: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on ALPA 57 PRODUCCIONES. A data subject had filed a complaint with the DPA because the controller had unlawfully transmitted their… SPAIN · ·Art. 6 Jun 5, 2023
€20,000 QUALITY-PROVIDER S.A.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 20,000 on QUALITY-PROVIDER S.A.. A data subject had filed a complaint with the DPA because the controller had continued to use their data… SPAIN · ·Art. 6, 17 Jun 2, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which also recorded a neighbor property. The DPA… SPAIN · ·Art. 5 Jun 2, 2023
€4,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 Jun 2, 2023
€10,000 Camedi s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Camedi s.r.l. Medical Center. A person had filed a complaint with the DPA because they had received invoices as well as… ITALY · ·Art. 5, 9, 32 Jun 1, 2023
€20,000 Ew Business Machines S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on Ew Business Machines S.p.A.. The controller had installed a video surveillance system that not only recorded images in real… ITALY · ·Art. 5, 9, 13 +1 Jun 1, 2023
€42,000 PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA. An individual had filed a complaint with the DPA because the controller had disclosed… SPAIN · ·Art. 5, 32 Jun 1, 2023
€3,000 Comune di Napoli: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Napoli. The municipality had sent three former employees, after termination of their employment an e-mail containing… ITALY · ·Art. 2, 5, 6 Jun 1, 2023
€20,000 Azienda Usl Toscana Sud Est.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 against Azienda Usl Toscana Sud Est. The controller had put up an information poster in the emergency room showing a healthcare… ITALY · ·Art. 2, 5, 9 +1 Jun 1, 2023
€15,000 Thin Srl: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection… ITALY · ·Art. 5, 9, 13 Jun 1, 2023
€300,000 Deutsche Kreditbank: Insufficient fulfilment of data subjects rights The DPA of Berlin has imposed a fine of EUR 300,000 on Deutsche Kreditbank. A customer had filed a complaint with the DPA. The customer had submitted an application for a credit… GERMANY ·Art. 5, 15, 22 ·Insufficient fulfilment of data subjects rights May 31, 2023
€500 Website operator: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 5,000 on a website operator for failing to ensure that the privacy policy on its website complied with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 May 31, 2023
€10,600 Company: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 10,600 on a company. The company had suffered a ransomware attack on their systems which resulted in the loss of personal data. During its… POLAND · ·Art. 5, 25, 32 +2 May 31, 2023
€2,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 2,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 May 31, 2023
€300 CBHNOS S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CBHNOS S.L.. The controller had installed video surveillance cameras which, among other things, also covered a public road. The DPA… SPAIN · ·Art. 5 May 29, 2023
€180 CARROZADOS TECAI, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on CARROZADOS TECAI, S.L.. The controller had installed a video surveillance system but had not added all the required information on the… SPAIN · ·Art. 13 May 29, 2023
€150,000 NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ
Α.Ε.,: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 150,000 on NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ. Α.Ε., imposed a fine of EUR 150,000. A customer had filed a complaint with the… GREECE · ·Art. 12, 15, 21 +1 May 29, 2023
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed a video surveillance camera which also covered the public space and a neighbour property.… SPAIN · ·Art. 5, 13 May 25, 2023
€600 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 600 on a private individual for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 May 25, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 10,000 for publishing a picture and address of another person on a website without their consent. SPAIN · ·Art. 6 May 24, 2023
€3,000 NORDETIA CLINICS IBERIA, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined NORDETIA CLINICS IBERIA, S.L. EUR 3,000 for failing to provide information requested by the DPA during an investigation. SPAIN · ·Art. 58 May 24, 2023
€1,000 Global Baby Brand SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on Global Baby Brand SRL. A person had filed a complaint with the DPA alleging that the controller had sent commercial SMS… ROMANIA · ·Art. 7 May 23, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing May 23, 2023
€380,000 Sports betting operator: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 380,000 on a sports betting operator. AZOP had received a complaint from a data subject, stating that the controller had obtained… CROATIA · ·Art. 6, 13, 25 +1 May 18, 2023
€18,000 AUTOMOBILE BAVARIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 18,000 on AUTOMOBILE BAVARIA SRL. The data controller had notified the authority of a data breach pursuant to Art. 33 GDPR. Unknown… ROMANIA · ·Art. 25, 32 May 18, 2023
€10,000 Grizzaffi Management Srl: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Grizzaffi Management Srl for sending out marketing messages, despite the fact that the data subjects had exercised their right… ITALY · ·Art. 5, 17, 21 May 17, 2023
€10,000 Azienda ULSS 6 Euganea: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Azienda ULSS 6 Euganea. The controller had mistakenly sent documents containing personal data to the wrong patients. The DPA… ITALY · ·Art. 5, 6, 32 May 17, 2023
€10,000 Santander Consumer Bank S.p.a.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Santander Consumer Bank S.p.a. EUR 10,000 for not sufficiently fulfilling its obligation to comply with a data subject's request for access to their data. ITALY · ·Art. 12 May 17, 2023
€50,000 FUSIONA SOLUCIONES ENERGÉTICAS, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on FUSIONA SOLUCIONES ENERGÉTICAS, S.A.. The controller had submitted data from the data subject to a credit information system… SPAIN · ·Art. 6 May 17, 2023
€10,000 La Gazzetta di Parma S.r.l.: Non-compliance with general data processing principles The Italian DPA has fined La Gazzetta di Parma S.r.l. EUR 10,000. The controller had published photos in its newspaper of an individual accused of murder. The photos showed the… ITALY · ·Art. 5 May 17, 2023