Content type · 2,802 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€200,000 Mas s.r.l.s.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 200,000 on Mas s.r.l.s.. During its investigation, the DPA found that the controller had acquired illegally created lists containing… ITALY · ·Art. 5, 6, 7 +4 Apr 13, 2023
€3,000 Comune di Cogollo del Cengio: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Cogollo del Cengio. A former employee had filed a complaint with the DPA due to the fact, that the municipality had… ITALY · ·Art. 2, 5, 6 +1 Apr 13, 2023
€253,000 Aldi: Non-compliance with general data processing principles The Hungarian DPA imposed a fine of EUR 253,000 on the supermarket chain Aldi. Aldi had entered and stored the date of birth of many customers in the checkout system when… HUNGARY · ·Non-compliance with general data processing principles Apr 12, 2023
€3,000 REGENCY COMPANY SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 3,000 on REGENCY COMPANY SRL. The controller had installed video surveillance cameras in its premises for the purpose of monitoring… ROMANIA · ·Art. 5, 6 Apr 7, 2023
€770 Secretary of the Central Election Commission Konstantin Ninov: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 770 on Konstantin Ninov, a secretary of the central election commission. The controller forwarded personal data, including voter lists,… BULGARIA · ·Art. 6 Apr 6, 2023
€300 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a private individual EUR 300 for failing to provide sufficient information about a video surveillance system installed at their property. SPAIN · ·Art. 13 Apr 5, 2023
€13,300 Company: Insufficient fulfilment of information obligations The Hungarian DPA has imposed a fine of EUR 13,300 on a company. A customer had filed a complaint with the DPA because a conversation, which they had with a sales representative… HUNGARY · ·Art. 12, 13 Apr 4, 2023
€15M TikTok: Non-compliance with general data processing principles The UK DPA (ICO) has fined TikTok EUR 14.5 million. The ICO had found that more than one million British children under the age of 13 were using TikTok without the consent of… UNITED KINGDOM · ·Art. 5, 12, 13 Apr 4, 2023
€3,000 Tensa Art Design SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 3,000 on Tensa Art Design SRL. An individual had filed a complaint for receiving promotional messages despite having filed an objection… ROMANIA · ·Art. 21 Apr 4, 2023
€18,000 ENFOKA SISTEMAS GLOBALES, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on ENFOKA SISTEMAS GLOBALES, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller carried out a change of… SPAIN · ·Art. 6 Apr 4, 2023
€84,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on BANCO BILBAO VIZCAYA ARGENTARIA, S.A.. During its investigation, the DPA found that the controller had registered alleged debts of a former… SPAIN · ·Art. 6, 15 Apr 4, 2023
€10,000 Real Federación Española de Tenis de Mesa: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 10,000 on Real Federación Española de Tenis de Mesa. A participant in an examination to become a table tennis coach had filed a complaint… SPAIN · ·Art. 9 Apr 4, 2023
€50,000 ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.. Several media outlets, including the controller had published an audio… SPAIN · ·Art. 5 Apr 3, 2023
€300 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a private individual EUR 300 for failing to provide sufficient information about a video surveillance system installed at their property. SPAIN · ·Art. 13 Apr 3, 2023
€50,000 20 MINUTOS EDITORA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on 20 MINUTOS EDITORA, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Apr 3, 2023
€1,800 LISMARTSA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on LISMARTSA, S.L.. The controller had sent an email containing personal data of 74 people to all recipients. The DPA considered this to be a… SPAIN · ·Art. 5 Mar 30, 2023
€450 Private individual: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 450 on an private individual. The individual had published personal data of numerous people on a social network without their consent. ROMANIA · ·Art. 5, 6 Mar 27, 2023
€360 ALI MARKET: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 360 on ALI MARKET. The controller had failed to provide a notice with information about video surveillance in its premises. In addition,… SPAIN · ·Art. 13, 30 Mar 24, 2023
€1,000 INMARAN ASESORES S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1,000 on INMARAN ASESORES S.L. for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 Mar 24, 2023
€70,000 Orange Espagne S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Orange Espagne S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card… SPAIN · ·Art. 6 Mar 23, 2023
€4,000 Azienda socio-sanitaria locale n. 1 di Sassari: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 4,000 on Azienda socio-sanitaria locale n. 1 di Sassari. The controller had mistakenly sent a document containing health data of the data… ITALY · ·Art. 5, 9, 32 Mar 23, 2023
€180 Private individual: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on a private individual. The data controller had failed to provide a notice with information about video surveillance in its premises. The… SPAIN · ·Art. 13 Mar 23, 2023
€10,000 Informatica Alto Adige Spa: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Informatica Alto Adige Spa EUR 10,000. The municipality of Bolzano had reported a data protection breach to the DPA involving unauthorized access to the… ITALY · ·Art. 5, 32 Mar 23, 2023
€30,000 Bolzano municipality: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 30,000 on Bolzano municipality. The Bolzano health authority had reported a data breach to the DPA involving unauthorized access to the… ITALY · ·Art. 5, 25, 32 +1 Mar 23, 2023
€5,000 Tehnoplus Industry SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 5,000 on Tehnoplus Industry SRL. An employee of the company had filed a complaint with the DPA because the controller had installed a… ROMANIA · ·Art. 5, 6 Mar 23, 2023
€40,000 La Risorsa Umana.it s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on La Risorsa Umana.it s.r.l. An employee of the controller had filed a complaint against the controller. During its… ITALY · ·Art. 5, 13, 28 Mar 23, 2023
€50,000 CONECTA5 TELECINCO, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on CONECTA5 TELECINCO, S.A.U.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L.. Several media outlets, including the controller had published an audio recording of a… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 DIARIO ABC, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on DIARIO ABC, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 DISPLAY CONNECTORS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on DISPLAY CONNECTORS, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€40,000 EDITORIAL DE PRENSA CANARIA, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on EDITORIAL DE PRENSA CANARIA, S.A.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 EL DIARIO DE PRENSA DIGITAL SL.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on EL DIARIO DE PRENSA DIGITAL SL.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 LA VANGUARDIA EDICIONES, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on LA VANGUARDIA EDICIONES, S.L.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.. Several media outlets, including the controller had published an audio recording… SPAIN · ·Art. 5 Mar 21, 2023
€40,000 TITANIA COMPAÑÍA EDITORIAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on TITANIA COMPAÑÍA EDITORIAL, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€70,000 CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.. The data subject had received a message from a debt collection company on behalf… SPAIN · ·Art. 6 Mar 21, 2023
€10,000 NGENIERÍA Y TELECOM JAÉN, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on INGENIERÍA Y TELECOM JAÉN, S.L.. The controller had extented the data subject's contract without their consent. SPAIN · ·Art. 6 Mar 17, 2023
€100,000 ORANGE ESPAGNE S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 100,000 on ORANGE ESPAGNE S.A.U.. A customer who had purchased a cell phone from ORANGE had filed a complaint with the DPA. As a… SPAIN · ·Art. 5 Mar 16, 2023
€3,000 Med Life S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Centrul Medical dr. Furtună Dan. The controller had sent results of a medical test via WhatsApp to the wrong recipient. As a… ROMANIA · ·Art. 32 Mar 16, 2023
€125,000 CITYSCOOT: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 125,000 on CITYSCOOT, a company that rents out motor scooters for short periods. During its investigation, the DPA found that CITYSCOOT,… FRANCE · ·Art. 5, 28, 82 Mar 16, 2023
€1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient identification methodes, resulting in a customer… BULGARIA · ·Art. 5 Mar 16, 2023
€5,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on a private individual. The controller sent an e-mail with personal data to several recipients in an open distribution list. This… SPAIN · ·Art. 5, 32 Mar 16, 2023
€145,000 AFIANZA ASESORES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 145,000 on AFIANZA ASESORES S.L.. The controller had reported a data breach to the DPA, stating that a backpack containing a USB stick… SPAIN · ·Art. 5, 32 Mar 16, 2023
€1,000 Centrul Medical dr. Furtună Dan: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Centrul Medical dr. Furtună Dan. The controller had sent results of a medical test via WhatsApp to the wrong recipient. As a… ROMANIA · ·Art. 32 Mar 16, 2023
€4,000 Partidul Uniunea Salvați România: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined the Partidul Uniunea Salvați România party EUR 4,000. The controller had suffered a phishing attack in which the attackers gained unauthorized access to… ROMANIA · ·Art. 32 Mar 15, 2023
€136,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U. A data subject had filed a complaint against the data controller as unauthorized fraudsters managed to access… SPAIN · ·Art. 6, 32 Mar 15, 2023
€10,000 Alianța pentru Unirea Românilor: Non-compliance with general data processing principles The Romanian DPA imposed a fine of EUR 10,000 on Alianța pentru Unirea Românilor. During its investigation, the DPA found that the controller collected personal data on its… ROMANIA · ·Art. 5 Mar 15, 2023
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed a video surveillance camera which also covered the public space and a neighbour property.… SPAIN · ·Art. 5, 13 Mar 15, 2023
€240 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. A data subject had filed a complaint against their ex-partner with the DPA. The ex-partner had installed video… SPAIN · ·Art. 5 Mar 14, 2023
€3,000 Tinmar Energy SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined Tinmar Energy SA EUR 3,000. The controller had suffered a data breach in which third parties gained unauthorized access to personal data such as first… ROMANIA · ·Art. 32 Mar 14, 2023