Content type · 3,594 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€20,000 Pharmaceutical wholesaler: €20,000 fine The French DPA has imposed a fine of EUR 20,000 on a pharmaceutical wholesaler due to violations of several regulations, including a lack of data security and insufficient… FRANCE · ·Unknown Jan 24, 2024
€32M AMAZON FRANCE LOGISTIQUE: Non-compliance with general data processing principles The French DPA (CNIL) has imposed a fine of EUR 32 million on AMAZON FRANCE LOGISTIQUE for unlawful surveillance of employees. CNIL found that Amazon France equips its warehouse… ·Art. 5, 6, 12 +2 ·Non-compliance with general data processing principles Jan 23, 2024
€7,500 ROUNDED TECHNOLOGIES, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 7,500 on ROUNDED TECHNOLOGIES, S.L. The company continued to send a customer a newsletter by e-mail, although they had previously… SPAIN · ·Art. 21 Jan 23, 2024
€200,000 ORANGE ESPAGNE S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 200,000 on Orange Espagne S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card… SPAIN · ·Art. 6 Jan 23, 2024
€500 Attorney: Insufficient cooperation with supervisory authority The French DPA has imposed a fine of EUR 500 on an attorney. The fine was imposed due to a lack of cooperation with the DPA. FRANCE · ·Insufficient cooperation with supervisory authority Jan 22, 2024
€2,300 POLAND DPA: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined a data controller EUR 2,300 for failing to report a data breach to the DPA and data subjects in a timely manner. ·Art. 33, 34 ·Insufficient fulfilment of data breach notification obligations Jan 18, 2024
€273,000 Centrum Medyczne Ujastek Sp. z o.o.: Non-compliance with general data processing principles The Polish DPA has imposed two fines on the medical facility “Centrum Medyczne Ujastek” totaling approximately EUR 273,000. The first fine of approximately EUR 163,000 was imposed… POLAND · ·Art. 5, 6, 9 +3 Jan 17, 2024
€174,640 Black Tiger Belgium: Insufficient fulfilment of information obligations The Belgian DPA has imposed a fine of EUR 174,640 on Black Tiger Belgium. An individual had filed a complaint with the DPA due to the controller's failure to properly comply with… ·Art. 5, 6, 12 +5 ·Insufficient fulfilment of information obligations Jan 16, 2024
€5,000 Attorney: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 5000 on an attorney. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of a request of erasure of… FRANCE · ·Insufficient fulfilment of data subjects rights Jan 15, 2024
€3,000 TECHNINK LEB SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on TECHNINK LEB SRL. The controller had suffered a data breach in which personal customer data had been unlawfully disclosed.… ROMANIA · ·Art. 32 Jan 15, 2024
€150,000 International Card Services B.V.: Insufficient technical and organisational measures to ensure information security The Dutch DPA has imposed a fine of EUR 150,000 on International Card Services B.V. (ICS). ICS failed to carry out a data protection impact assessment before starting the digital… THE NETHERLANDS · ·Art. 35 Jan 15, 2024
€17,000 Alior Bank SA: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 17,000 on Alior Bank SA. The investigation was initiated following complaints that the bank continued to send unsolicited electronic… ROMANIA · ·Art. 5, 6 Jan 12, 2024
€1,000 ATLAS ENTERTAINMENT, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1,000 on ATLAS ENTERTAINMENT, S.L. for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 Jan 11, 2024
€1,500 Website operator: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 1,500 on a website operator. The fine was imposed due to a lack of cooperation with the DPA and a lack of fulfillment of data subject… FRANCE · ·Insufficient fulfilment of data subjects rights Jan 9, 2024
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The controller had published a video showing an individual without their consent. SPAIN · ·Art. 6 Jan 8, 2024
€10,000 Website operator: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine in the amount of EUR 11,000 on a website operator. An individual had filed a complaint with the DPA because the controller had failed to comply… AUSTRIA · ·Art. 17, 25, 58 Jan 4, 2024
€15,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 15,200 on a media company. The company failed to react to requests by the DPA. AUSTRIA · ·Art. 58 Jan 2, 2024
€11,500 Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg imposed a fine of EUR 11,500 on a company operating in the advertising industry for failing to comply with its deletion obligations. In addition, it was found… GERMANY · ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine on a company due to technical security vulnerabilities in its support ticket systems. GERMANY · ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€60,000 Company: Insufficient technical and organisational measures to ensure information security The DPA of Berlin imposed a fine of EUR 60,000 on a healthcare company. The company offers practice management software that includes a patient communication portal with… GERMANY ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€120,000 Company: Insufficient cooperation with supervisory authority The DPA from Saxony has fined a company EUR 120,000 for failing to provide information requested by the DPA during an investigation. GERMANY ·Art. 31 ·Insufficient cooperation with supervisory authority Jan 1, 2024
€16,000 Freelancer: Insufficient cooperation with supervisory authority The DPA of Hessen has imposed a fine of EUR 16,000 on a freelancer. The controller operates a website without a privacy policy. The DPA contacted the controller, ordering him to… GERMANY ·Art. 13, 31, 58 ·Insufficient cooperation with supervisory authority Jan 1, 2024
€16,000 Hotel: Insufficient legal basis for data processing The DPA of Hamburg has imposed a fine of EUR 16,000 on a hotel for processing ID card data without a legal basis. GERMANY · ·Insufficient legal basis for data processing Jan 1, 2024
€12,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has imposed a fine of EUR 12,000 on a company providing vehicle history check services. The controller refused a data subject's request to rectify personal data… LITHUANIA · ·Art. 5, 15, 16 Jan 1, 2024
€1,500 SLOVAKIA DPA: Insufficient cooperation with supervisory authority The Slovak DPA has imposed a fine of EUR 1,500 on an unkown controller. The controller obstructed an inspection of the DPA. ·Insufficient cooperation with supervisory authority Jan 1, 2024
Police employees: Insufficient legal basis for data processing The DPA of Hamburg has imposed two fines on members of the police for accessing police databases for private research purposes. GERMANY · ·Insufficient legal basis for data processing Jan 1, 2024
€41 GERMANY DPA: €41 fine The DPA of Hessen has imposed fines totaling EUR 13,486 on 41 data controllers. In its 2024 activity report, the DPA of Hesse reported a total of 47 fines that year. Six of these… Unknown Jan 1, 2024
€22,080 Company: Insufficient cooperation with supervisory authority The DPA from Saxony has fined a company EUR 22,080 for failing to sufficiently cooperate with the DPA during an investigation. GERMANY ·Art. 31 ·Insufficient cooperation with supervisory authority Jan 1, 2024
€10,000 Company: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 10,000 on a company. The controller used data for marketing purposes without a legal basis. The company obtained the data through… GERMANY ·Art. 6, 7 ·Insufficient legal basis for data processing Jan 1, 2024
€6,000 Online retailer: Insufficient fulfilment of data breach notification obligations The DPA of Hamburg has imposed a fine of EUR 6,000 on an online retailer for failing to report a data breach in a timely manner. GERMANY · ·Insufficient fulfilment of data breach notification obligations Jan 1, 2024
€3,300 Doctor´s Office: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 3,300 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2024
Private individual: Insufficient legal basis for data processing The DPA of Hamburg has imposed a fine on a private individual for recording a video of their neighbor in the bathroom without their consent. GERMANY · ·Insufficient legal basis for data processing Jan 1, 2024
€496,000 Company: Non-compliance with general data processing principles The DPA of Hessen has imposed a fine of EUR 496,000 on a company. The DPA identified several GDPR violations, including transmitting customer data to the incorrect recipient and… GERMANY ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Jan 1, 2024
€200 Civic Association: Insufficient legal basis for data processing The Slovak DPA has imposed a fine of EUR 200 on a civic association. The controller violated the principle of lawfulness of processing. SLOVAKIA · ·Insufficient legal basis for data processing Jan 1, 2024
Multiple Police Officers: Data Protection Authority of Berlin The DPA of Berlin imposed fined 23 police officers. The police officers misused their access to the police information system for private purposes. GERMANY ·Unknown Jan 1, 2024
€7,500 SLOVAKIA DPA: Non-compliance with general data processing principles The Slovak DPA has imposed a fine of EUR 7,500 on an unknown controller. The controller violated the principle of lawfulness, the principle of transparency and the principle of… ·Non-compliance with general data processing principles Jan 1, 2024
€32,000 Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine of EUR 32,000 on a logistics company for incorrectly disposing of delivery lists. GERMANY · ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€2,500 Doctor´s Office: Insufficient technical and organisational measures to ensure information security The DPA of Hessen has imposed a fine of EUR 2,500 on a doctor´s office. The controller hired an office manager who worked partly from home. The manager worked with patient files,… GERMANY ·Art. 5, 6, 9 +1 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€3,700 Doctor´s Office: Insufficient legal basis for data processing The DPA of Hessen has imposed a fine of EUR 3,700 on a doctor´s office. While responding to negative Google reviews, the controller revealed health data about the reviewers. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2024
Private individual: Insufficient legal basis for data processing The DPA of Hamburg has imposed five fines of private individuals for taking or storing photos of individuals without their consent. GERMANY · ·Insufficient legal basis for data processing Jan 1, 2024
Company: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine on a company due to technical security vulnerabilities in its support ticket systems. GERMANY · ·Insufficient technical and organisational measures to ensure information security Jan 1, 2024
€6.5M THE PHONE HOUSE SPAIN, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 6.5 million on THE PHONE HOUSE SPAIN, S.L. The controller had suffered a ransomware attack affecting personal data of 13 million… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Dec 27, 2023
€3,500 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. The private individual had installed a camera in their apartment, where they also rented out a room,… SPAIN · ·Art. 6, 13 Dec 23, 2023
FRANCE DPA: Insufficient cooperation with supervisory authority The French DPA has imposed a fine on a data controller for lack of cooperation. ·Insufficient cooperation with supervisory authority Dec 22, 2023
Candidate for parliamentary elections: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine on a candidate for parliamentary elections. The candidate had sent the data subject election advertising by email despite the data subject's… FRANCE · ·Art. 21 Dec 22, 2023
Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company. The controller had collected data from applicants, even though the processing of the specific data was not necessary for the job… FRANCE · ·Art. 5 Dec 22, 2023
Municipality: Non-compliance with general data processing principles Fine against municipality for lack of security measures (insufficient passwords) FRANCE · ·Non-compliance with general data processing principles Dec 22, 2023
€2,000 Company: Insufficient fulfilment of information obligations The Italian DPA has fined a company s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… ITALY · ·Art. 5, 13 Dec 21, 2023
€4,300 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,400 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Dec 21, 2023
€23,000 Polish Minister of Health: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 23,000 on the Polish Minister of Health. The controller had accessed information via a database relating to a physician who had prescribed… POLAND · ·Art. 25, 32, 34 Dec 20, 2023