Content type · 1,941 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€5,000 CÍTRICOS TANTA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,000 on CÍTRICOS TANTA, S.L.. The controller had entered personal data of an employee in the Social Security General Employee Register… SPAIN · ·Art. 6 Nov 2, 2022
DKK 500,000 Datatilsynet (Denmark) - 2022-63-0003 A law firm was exposed to a hacker attack. Thereby, hackers received access to the firm's servers that contained personal data and encrypted them. This posed a serious risk that… Art. 5, 9, 24 +2 Oct 28, 2022
€6,400 AIO E-COMMERCE, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on AIO E-COMMERCE, S.L.. The controller had suffered a data breach resulting in personal data such as bank details being siphoned off and… SPAIN · ·Art. 5 Oct 26, 2022
€10,000 ACKERMANN & SCHWARTZ ATTORNEYS AT LAW SLP: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on ACKERMANN & SCHWARTZ ATTORNEYS AT LAW SLP. The law firm had collected personal data from website users without obtaining their… SPAIN · ·Art. 6, 13 Oct 26, 2022
€9,000 EL RACO DEL PIS INVERSIONES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 9,000 on EL RACO DEL PIS INVERSIONES S.L.. The controller had sent an e-mail in an open distribution list, making the email addresses of… SPAIN · ·Art. 5, 32 Oct 25, 2022
€240 Company: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a company. The controller had installed video surveillance cameras which, among other things, also covered the public space. The DPA… SPAIN · ·Art. 5 Oct 24, 2022
€8,000 ADSL HOUSE, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 8,000 on ADSL HOUSE, S.L.. The data subject had received advertising calls from the controller, although the data subject was… SPAIN · ·Art. 21, 23, 48 Oct 24, 2022
€400 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 400 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Oct 24, 2022
€9,000 Azienda Ospedaliero-Universitaria Careggi di Firenze: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 9,000 on Azienda Ospedaliero-Universitaria Careggi di Firenze. The controller had mistakenly sent a patient medical record to the wrong… ITALY · ·Art. 5, 9, 32 Oct 20, 2022
€1,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Oct 20, 2022
€5,000 RESTEXPERIENCE, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined RESTEXPERIENCE, S.L. EUR 5,000. The controller had accidentally sent an email containing tax information of 36 individuals to 11 unauthorized… SPAIN · ·Art. 5, 32 Oct 19, 2022
€5M Interserve Group Limited: Insufficient technical and organisational measures to ensure information security The British DPA has fined the construction group Interserve Group Limited EUR 5,033,000. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. Interserve… UNITED KINGDOM · ·Art. 5, 32 Oct 19, 2022
€6,000 Company: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 6,000 on a company. The data controller had installed video surveillance cameras which also recorded sound. However, the DPA found that… SPAIN · ·Art. 6 Oct 17, 2022
€180 INMUR JOYEROS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on INMUR JOYEROS, S.L.. The controller had failed to provide a notice with information about video surveillance in its premises. The original… SPAIN · ·Art. 13 Oct 17, 2022
€35,000 OES GLOBAL ENERGY S.L.: Non-compliance with general data processing principles The Spanish DPA imposed a fine of EUR 35,000 on OES GLOBAL ENERGY S.L.. A customer of the controller had filed a complaint with the DPA after receiving an e-mail from the… SPAIN · ·Art. 5, 32 Oct 17, 2022
€12,000 SEAN SERIOS S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 12,000 on SEAN SERIOS S.L. The controller had published the results of a selection procedure on a website. This included, among other… SPAIN · ·Art. 6 Oct 14, 2022
€24,000 CAJA DE SEGUROS REUNIDOS, COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on CAJA DE SEGUROS REUNIDOS, COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A.. A data subject filed a complaint with the DPA. The data subject had taken… SPAIN · ·Art. 6 Oct 9, 2022
€6,000 UNION DE OFICIALES DE LA GUARDIA CIVIL PROFESIONAL: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 6,000 on the association UNION DE OFICIALES DE LA GUARDIA CIVIL PROFESIONAL. A person had filed a complaint with the DPA because the… SPAIN · ·Art. 6 Oct 9, 2022
€800 Company: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 800 on a company. The controller had installed video surveillance cameras without obtaining authorization for the installation. In… SPAIN · ·Art. 6, 13 Oct 9, 2022
€4,000 PUNTO BADAL-BCN S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on the real estate agency PUNTO BADAL-BCN S.L.. The controller had sent marketing e-mails to several people in an open distribution list, making… SPAIN · ·Art. 5, 32 Oct 9, 2022
€10,000 Codess Sociale, Soc. Coop. sociale.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Codess Sociale, Soc. Coop. sociale. A former voluntary member had filed a complaint with the DPA. The data subject states that… ITALY · ·Art. 12, 17 Oct 6, 2022
€3,000 Associazione Rescue Drones Network ODV: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 3,000 on Associazione Rescue Drones Network ODV. A founding member of the association had filed a complaint with the DPA. The member… ITALY · ·Art. 12, 15 Oct 6, 2022
€15,000 Servizio Idrico Integrato S.c.p.a.: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Servizio Idrico Integrato S.c.p.a. EUR 15,000. The controller had operated a website where personal data was being processed without using an SSL form.… ITALY · ·Art. 5, 32 Oct 6, 2022
€600 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a homeowners' association. The controller had installed a video surveillance system that recorded both images and sound. During… SPAIN · ·Art. 5, 13 Oct 4, 2022
€6,000 Club Náutico el Estacio: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on Club Náutico el Estacio. A data subject filed a complaint against the controller with the AEPD. The complaint is based on… SPAIN · ·Art. 5, 32 Oct 4, 2022
€150 Website operator: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 150 on a website operator. The controller had published unauthorized personal data such as telephone number, ID number and series,… ROMANIA · ·Art. 5, 6 Oct 3, 2022
€900 LfD (Lower Saxony) - Fine EUR 900,000 against bank A commercial bank (controller) used personal data of current and former customers (data subjects) to identify customers with an affinity for digital media usage, in order to… Germany ·Art. 6 Sep 28, 2022
Datatilsynet (Denmark) - 2020-431-0061 (Helsingor decision no. 4) This is the Danish DPA's fourth decision in the case relating to Helsingor municipality's processing of personal data in primary and lower secondary school. Helsingor… 2020-431-0061 (Helsingor decision no. 4) ·Art. 28, 36, 58 Sep 28, 2022
Datatilsynet (Denmark) - 2020-422-0026 The Danish DPA had decided to investigate three research projects of Region Syddanmark (the controller) with regards to its processing activities, the use of processors, data… 2020-422-0026 ·Art. 5 Sep 28, 2022
€31,200 BAYARD REVISTAS, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on Bayard Revistas S.A.. Unauthorized persons had accessed the Bayard database and thus unauthorizedly siphoned off location and contact data of… SPAIN · ·Art. 5, 32, 33 Sep 28, 2022
€720 CLUB NATACIO LLEIDA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CLUB NATACIO LLEIDA. The controller had installed a video surveillance system that recorded the cashier areas of the facility. The DPA… SPAIN · ·Art. 5 Sep 28, 2022
€180 Y OTRO MAS C.B.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on Y OTRO MAS C.B.. The controller had installed a video surveillance system in a residential complex. During its investigation, the DPA found… SPAIN · ·Art. 13 Sep 28, 2022
€26,700 TV2 Média Csoport Zrt.: Non-compliance with general data processing principles The Hungarian DPA has fined TV2 Média Csoport Zrt. EUR 26,700. In the course of its investigation, the DPA found that the controller had operated two websites without providing… HUNGARY · ·Art. 5, 6, 12 +1 Sep 26, 2022
€3,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 23, 2022
€1,200 URBANO DIVERTIA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on URBANO DIVERTIA S.L.. A customer had filed a complaint with the DPA, for having received a document from the controller with data relating to… SPAIN · ·Art. 5 Sep 23, 2022
€2,000 Bitfactor SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Bitfactor SRL. The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. Due to a malfunction of an… ROMANIA · ·Art. 25, 32 Sep 22, 2022
€3,000 Gas station: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 3,000 on a gas station operator. A person had filed a complaint with the DPA due to the controller's failure to grant them access to… GREECE · ·Art. 12, 14 Sep 22, 2022
NAIH (Hungary) - NAIH-4667-10/2022 A minor student (the data subject) alleged that his grade had been amended before the semester grading meeting without notification. The parent of the data subject requested… NAIH-4667-10/2022 ·Art. |, 10, 28 +1 Sep 22, 2022
€5,000 Curtea Veche Publishing SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Curtea Veche Publishing SRL. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR. In the first… ROMANIA · ·Art. 32 Sep 21, 2022
€1,800 Union Sindical Obrera: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on the trade union Union Sindical Obrera. An individual had filed a complaint with the DPA for repeatedly receiving emails from the controller… SPAIN · ·Art. 6 Sep 20, 2022
€2,000 Banca Comercială Română SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Banca Comercială Română SA. The bank had notified the DPA of a data breach pursuant to Art. 33 GDPR. Due to an error in the IT… ROMANIA · ·Art. 25, 32 Sep 19, 2022
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public… SPAIN · ·Art. 5 Sep 16, 2022
€2,000 Agent of the real estate agency BARCELONA DREAM HOUSE AGENCY: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on an agent of the real estate agency BARCELONA DREAM HOUSE AGENCY. An individual had filed a complaint with the DPA because the… SPAIN · ·Art. 13 Sep 16, 2022
€10,000 SOPHIE ET VOILA, S.L: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on SOPHIE ET VOILA, S.L..The wedding dress company had published a picture of a customer in a wedding dress on its Instagram… SPAIN · ·Art. 6 Sep 16, 2022
€40,000 FCA Italy S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on FCA Italy S.p.A.. An employee of the controller had requested access to personal data processed in the context of their… ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Sep 15, 2022
€2,000 Immobiliare Riscostruzione Meloria s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has imposed a fine of EUR 2,000 on Immobiliare Riscostruzione Meloria s.r.l.. The controller had installed a video surveillance system at its office which covered… ITALY · ·Art. 5, 13 Sep 15, 2022
€2,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Sep 13, 2022
€180 EURO DONER KEBAB: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on EURO DONER KEBAB. The controller had installed video surveillance cameras which, among other things, also covered the public space.… SPAIN · ·Art. 5, 13 Sep 9, 2022
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Sep 9, 2022
€15 HDPA (Greece) - 50/2022 A former teacher (the data subject) at a private primary school (the controller) submitted a complaint to the Greek DPA regarding a video surveillance system in the classrooms,… Art. 5, 6, 12 +2 Sep 9, 2022