Content type · 3,651 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€200 Civic Association: Insufficient legal basis for data processing The Slovak DPA has imposed a fine of EUR 200 on a civic association. The controller violated the principle of lawfulness of processing. SLOVAKIA · ·Insufficient legal basis for data processing Jan 1, 2024
€496,000 Company: Non-compliance with general data processing principles The DPA of Hessen has imposed a fine of EUR 496,000 on a company. The DPA identified several GDPR violations, including transmitting customer data to the incorrect recipient and… GERMANY ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Jan 1, 2024
€16,000 Hotel: Insufficient legal basis for data processing The DPA of Hamburg has imposed a fine of EUR 16,000 on a hotel for processing ID card data without a legal basis. GERMANY ·Insufficient legal basis for data processing Jan 1, 2024
€120,000 Company: Insufficient cooperation with supervisory authority The DPA from Saxony has fined a company EUR 120,000 for failing to provide information requested by the DPA during an investigation. GERMANY ·Art. 31 ·Insufficient cooperation with supervisory authority Jan 1, 2024
€3,700 Doctor´s Office: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 3,700 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2024
€11,500 Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg imposed a fine of EUR 11,500 on a company operating in the advertising industry for failing to comply with its deletion obligations. In addition, it was found… GERMANY ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€12,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has imposed a fine of EUR 12,000 on a company providing vehicle history check services. The controller refused a data subject's request to rectify personal data… LITHUANIA · ·Art. 5, 15, 16 Jan 1, 2024
€7,500 SLOVAKIA DPA: Non-compliance with general data processing principles The Slovak DPA has imposed a fine of EUR 7,500 on an unknown controller. The controller violated the principle of lawfulness, the principle of transparency and the principle of… ·Non-compliance with general data processing principles Jan 1, 2024
€6.5M THE PHONE HOUSE SPAIN, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 6.5 million on THE PHONE HOUSE SPAIN, S.L. The controller had suffered a ransomware attack affecting personal data of 13 million… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Dec 27, 2023
€3,500 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. The private individual had installed a camera in their apartment, where they also rented out a room,… SPAIN · ·Art. 6, 13 Dec 23, 2023
Candidate for parliamentary elections: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine on a candidate for parliamentary elections. The candidate had sent the data subject election advertising by email despite the data subject's… FRANCE · ·Art. 21 Dec 22, 2023
Municipality: Non-compliance with general data processing principles Fine against municipality for lack of security measures (insufficient passwords) FRANCE · ·Non-compliance with general data processing principles Dec 22, 2023
Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company. The controller had collected data from applicants, even though the processing of the specific data was not necessary for the job… FRANCE · ·Art. 5 Dec 22, 2023
FRANCE DPA: Insufficient cooperation with supervisory authority The French DPA has imposed a fine on a data controller for lack of cooperation. ·Insufficient cooperation with supervisory authority Dec 22, 2023
€2,000 Company: Insufficient fulfilment of information obligations The Italian DPA has fined a company s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… ITALY · ·Art. 5, 13 Dec 21, 2023
€4,300 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,400 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Dec 21, 2023
€23,000 Polish Minister of Health: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 23,000 on the Polish Minister of Health. The controller had accessed information via a database relating to a physician who had prescribed… POLAND · ·Art. 25, 32, 34 Dec 20, 2023
€2,300 District Court Krakow: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined the District Court in Krakow EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. POLAND · ·Art. 33, 34 Dec 19, 2023
€600 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed a video surveillance camera in a residential building which recorded a communal… SPAIN · ·Art. 6, 13 Dec 17, 2023
€400 TITAN STRONG, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on TITAN STRONG, S.L.. The controller had installed video surveillance cameras which, among other things, also covered the public space… SPAIN · ·Art. 5 Dec 17, 2023
€200 Private individual: Insufficient cooperation with supervisory authority The Romanian DPA has fined a private individual EUR 200 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Dec 15, 2023
€5,500 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 5,500 for failing to sufficiently cooperate with the DPA during an investigation. POLAND · ·Insufficient cooperation with supervisory authority Dec 13, 2023
€400,000 UK Ministry of Defense: Insufficient technical and organisational measures to ensure information security The UK DPA has fined the Ministry of Defense EUR 400,000 for disclosing personal data of individuals who were to be relocated to the UK after the Taliban took control of… UNITED KINGDOM · ·Insufficient technical and organisational measures to ensure information security Dec 13, 2023
€5,900 AUSTRIA DPA: Insufficient fulfilment of data breach notification obligations The Austrian DPA fined a controller EUR 5,900 for failing to report a data breach in a timely manner and for not cooperating with the DPA. ·Art. 31, 33 ·Insufficient fulfilment of data breach notification obligations Dec 12, 2023
€5,000 Kourou municipality: Insufficient cooperation with supervisory authority The French DPA has imposed a fine of EUR 5,000 on Kourou municipality for failing to appoint a data protection officer and to sufficiently cooperate with the DPA. FRANCE · ·Art. 31, 37 Dec 12, 2023
€10,000 VACACIONES EDREAMS, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 10,000 on VACACIONES EDREAMS, S.L.. A data subject had filed a complaint against the controller with the DPA due to the controller's… SPAIN · ·Art. 15 Dec 12, 2023
€3,000 Veranda Obor S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Veranda Obor S.A.. The controller had disclosed personal data (e.g. name, e-mail adress etc.) of lottery participants on its… ROMANIA · ·Art. 32 Dec 11, 2023
€10M Uber Technologies Inc.
Uber B.V.: Insufficient fulfilment of information obligations The Dutch DPA has fined Uber Technologies Inc. and Uber B.V. EUR 10 million for failing to provide sufficient information about the storage period of European drivers' data and… THE NETHERLANDS · ·Art. 12, 13 Dec 11, 2023
€40,000 Azienda socio sanitaria territoriale nord Milano, C.F.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on Azienda socio sanitaria territoriale nord Milano, C.F.. During its investigation, the DPA found that a patient's spouse had… ITALY · ·Art. 5, 9, 25 +1 Dec 7, 2023
€2,000 Mushtaq Rubina Kebabish: Insufficient fulfilment of information obligations The Italian DPA has fined Mushtaq Rubina Kebabish EUR 2,000. The controller had operated video surveillance cameras in one of their premises without properly informing about the… ITALY · ·Art. 5, 13 Dec 7, 2023
€2,700 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 2,700 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Dec 7, 2023
€1,000 Sirio S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,000 on Sirio S.p.A.. An employee filed a complaint with the DPA because the controller had passed on their personal data to a bank… ITALY · ·Art. 5, 6, 13 Dec 7, 2023
€1,500 Physician: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 1,500 on a physician. An individual had filed a complaint with the DPA because the physician had accessed their personal data in a… CYPRUS ·Art. 5 ·Non-compliance with general data processing principles Dec 7, 2023
€3,200 SOLAR PROGRESS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on SOLAR PROGRESS, S.L.. The controller had published a screenshot with an email from a former employee who had a professional question in a… SPAIN · ·Art. 5 Dec 7, 2023
€24,000 Hora Credit IFN SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA imposed a fine of EUR 24,000 on Hora Credit IFN SA. The controller had accidentally sent documents containing the personal data of another person to a customer by… ROMANIA · ·Art. 12, 15, 32 +1 Dec 7, 2023
€16,600 Garðabær municipality: Non-compliance with general data processing principles The Icelandic DPA has imposed a fine of EUR 16,600 on the municipality of Garðabær. The municipality had used the Google Education system without sufficiently complying with data… ICELAND ·Art. 5, 24, 28 ·Non-compliance with general data processing principles Dec 6, 2023
€16,600 Reykjanesbær municipality: Non-compliance with general data processing principles The Icelandic DPA has imposed a fine of EUR 16,600 on the municipality of Reykjanesbær. The municipality had used the Google Education system without sufficiently complying with… ICELAND ·Art. 5, 24, 28 ·Non-compliance with general data processing principles Dec 6, 2023
€13,300 City of Reykjavik: Non-compliance with general data processing principles The Icelandic DPA has imposed a fine of EUR 13,300 on the city of Reykjavik. The city had used the Google Education system in schools without sufficiently complying with data… ICELAND ·Art. 5, 24, 28 ·Non-compliance with general data processing principles Dec 6, 2023
€20,000 City of Kópavogur: Non-compliance with general data processing principles The Icelandic DPA has imposed a fine of EUR 20,000 on the city of Kópavogur. The city had used the Google Education system without sufficiently complying with data protection… ICELAND ·Art. 5, 24, 28 ·Non-compliance with general data processing principles Dec 6, 2023
€18,600 City of Hafnarfjörður: Non-compliance with general data processing principles The Icelandic DPA has imposed a fine of EUR 18,600 on the city of Hafnarfjörður. The city had used the Google Education system without sufficiently complying with data protection… ICELAND ·Art. 5, 24, 28 ·Non-compliance with general data processing principles Dec 6, 2023
€30,000 UNIPREX, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on UNIPREX, S.A.. The controller had published a video of a violent incident on the internet without anonymizing the faces of the individuals… SPAIN · ·Art. 5 Dec 1, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5, 13 Nov 30, 2023
€1,000 Techno Security s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,000 on Techno Security s.r.l.. A data subject had filed a complaint with the DPA due to the controller's failure to respond to a… ITALY · ·Art. 12, 15 Nov 30, 2023
€60,000 Limit Call S.r.l.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 60,000 on Limit Call S.r.l.s. for unauthorized telemarketing. The controller had acquired lists of personal data without checking the… ITALY · ·Art. 5, 6, 7 +6 Nov 30, 2023
€3,000 A R.L Spartan Gym: Non-compliance with general data processing principles The Italian DPA has fined A R.L Spartan Gym EUR 3,000. The controller had operated video surveillance cameras in one of their premises without the required authorization.… ITALY · ·Art. 5, 13, 114 Nov 30, 2023
€26,500 Östersund Municipality's Department for Children and Education: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 26,500 on the Östersund Municipality's Department for Children and Education. The authority had failed to carry out a data protection… SWEDEN ·Art. 35 ·Insufficient technical and organisational measures to ensure information security Nov 28, 2023
€50,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller had… SPAIN · ·Art. 6 Nov 27, 2023
€1.7M Norwegian Labor and Welfare Administration: Insufficient technical and organisational measures to ensure information security The Norwegian DPA has imposed a fine of EUR 1.7 million on Arbeids- og velferdsetaten, the Norwegian Labor and Welfare Administration (NAV). During its investigation, the DPA… NORWAY · ·Art. 5, 24, 25 +1 Nov 27, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered a neighbour… SPAIN · ·Art. 5 Nov 24, 2023
Belgian DPA settles with Mediafin: De Tijd cookie banner must add equal "refuse all" On 19 July 2023, a data subject, represented by noyb (European Centre for Digital Rights), filed a complaint against Mediafin, a Belgian media group, with the Belgian DPA. The… 159/2023 ·Belgium · Nov 24, 2023