Content type · 2,644 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€1,000 Dante Internațional SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Dante Internațional SA. A data subject had filed a complaint with the DPA against the controller due to the fact that the… ROMANIA · ·Art. 17 Jan 18, 2023
€1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient technical and organisational measures to ensure… BULGARIA · ·Art. 5, 6 Jan 17, 2023
€7,000 Πολίτης newspaper: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 7,000 on the newspaper 'Πολίτης'. The controller had unlawfully published the names and pictures of two police officers. CYPRUS · ·Art. 5, 6 Jan 16, 2023
€50,000 DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance This case involves an own-volition investigation conducted by the Irish DPA (DPC) into Kildare County Council, the controller. In June 2018, Officers from the Special… Art. 2, 5, 6 +5 Jan 16, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jan 16, 2023
€40,000 Thomas International Systems, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Thomas International Systems, S.A.. Thomas International performs psychological tests on behalf of other companies. Thomas International had… SPAIN · ·Art. 9 Jan 16, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Jan 16, 2023
€2,000 BRISTOL LOGISTICS SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on BRISTOL LOGISTICS SA. The DPA received a notification from BRISTOL LOGISTICS SA of a personal data breach under Art. 33 GDPR.… ROMANIA · ·Art. 32 Jan 12, 2023
€3,000 SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.. A former employee had filed a complaint with the DPA due to the controller's unauthorized… SPAIN · ·Art. 6 Jan 12, 2023
€5,000 Azienda Ospedale-Università Padova: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Azienda Ospedale-Università Padova. The controller had sent an email containing consent forms for participation in a clinical… ITALY · ·Art. 5, 9 Jan 11, 2023
€6,000 Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia. The school board had published a… ITALY · ·Art. 2, 5, 6 +1 Jan 11, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, a… SPAIN · ·Art. 5 Jan 10, 2023
€6,000 Praktiškas UAB: Insufficient legal basis for data processing The Lithuanian DPA has fined Praktiškas UAB, the operator of SportGates sports clubs, EUR 6,000. The controller had processed biometric data of customers in the context of their… LITHUANIA · ·Art. 5, 9, 13 +2 Jan 9, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, a… SPAIN · ·Art. 5 Jan 9, 2023
€390M Meta Platforms Ireland Limited: Non-compliance with general data processing principles The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 390 million. The DPA has imposed a fine of EUR 210 million for violations related to the provision of its Facebook… Jan 4, 2023
€3,000 Apă Canal Ilfov SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Apă Canal Ilfov SA. The controller sent an e-mail with personal data to several recipients in an open distribution list. This… ROMANIA · ·Art. 32 Jan 4, 2023
€500 Homeowners Association: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 500 on a homeowners' association. The controller had publicly posted a list with the first and last names of all members of the… ROMANIA · ·Art. 5 Jan 3, 2023
€3,000 Transport Workers' Union of Aragon: Non-compliance with general data processing principles The Spanish DPA has fined the Transport Workers' Union of Aragon EUR 3,000. The union had published a document with personal data (surname, first name and identity card number) of… SPAIN · ·Art. 5, 32 Jan 3, 2023
€24,000 FACTOR ENERGÍA,
S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a FACTOR ENERGÍA, S.A.. A data subject had filed a complaint with the DPA because they had received advertising messages from the controller… SPAIN · ·Art. 6 Jan 2, 2023
€8,000 Cypriot Ministry of the Interior: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 8,000 on the Cypriot Ministry of the Interior. The Ministry of Interior had unlawfully transmitted personal data of employees to the… CYPRUS · ·Art. 5 Jan 1, 2023
Private individual: Non-compliance with general data processing principles The DPA of Bavaria has imposed a four-figure fine on a private individual who had attached an AirTag to another person's car in order to track their location. GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Private individual: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine on a private individual. The individual, who was employed in a store, had contacted a customer, who had provided their contact details for… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Real estate agency: Insufficient legal basis for data processing The DPA of Bremen has imposed five fines on a real estate agency. The controller had repeatedly sent advertising messages to a former prospect and tried to contact them by… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Police officers: Insufficient legal basis for data processing The DPA of Bremen has imposed ten fines between EUR 100 and EUR 1,000 on police officers for unlawfully accessing police databases. GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Physician: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine in the four figure range on a physician. The physician had responded to an online review regarding their practice, disclosing personal health… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Website operator: Insufficient legal basis for data processing The DPA of Bremen has imposed five fines on website operators for using the tracking tool 'Google Analytics' without the prior consent of website users. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Police officer: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a three-figure fine on a police officer. The police officer had used the telephone number of a person who had filed a criminal complaint for… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Private individual: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a three-figure fine on six private individuals. The individuals, who worked in a hospital, had accessed the medical records of a colleague who… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Company: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a company. The controller had installed video cameras in the offices and monitored employees before, during and after their working hours… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Fishing club: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a three-figure fine on a fishing club due to the fact that lists of members' personal data such as first and last names, full addresses with… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Private individual: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine on an individual. The individual had been pulled over by a police officer and afterwards managed to obtain their telephone number in order to… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Private individual: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine on a private individual for installing a video surveillance camera in a bush at a naturist beach and capturing video and audio recordings of… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
€2,000 Private individual: Insufficient legal basis for data processing The DPA of Baden-Wuerttemberg has imposed a fine of EUR 2,000 on a clinic employee. The employee had unlawfully accessed a patient administration system in order to find out more… GERMANY ·Art. 6, 9 ·Insufficient legal basis for data processing Jan 1, 2023
Private individual: Insufficient legal basis for data processing The DPA in Baden-Wuerttemberg imposed a fine on a private individual for installing a motion tracker on the data subject's car without their consent. GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
€5,000 MALTA DPA: Non-compliance with general data processing principles The controller unlawfully gained access to audio recordings from a surveillance camera. Art. 5, 6 ·Non-compliance with general data processing principles Jan 1, 2023
Company: Insufficient legal basis for data processing The DPA in Bremen has imposed a fine on a company. The controller had stored an applicant's application documents after the application process for the purpose of further… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
€8,000 Bank of Cyprus Public Company Ltd.: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 8,000 on Bank of Cyprus Public Company Ltd.. The controller had stored inaccurate data about a data subject in its system. ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2023
Clinic: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a clinic for transmitting an unredacted treatment report on the psychiatric treatment of the data subject to an accident insurance fund… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Company: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a company. The controller had stored the contact details of former employees without their prior consent in order to contact them in the… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Pizza delivery service: Non-compliance with general data processing principles The DPA of Baden-Wuerttemberg has imposed a four-digit fine on a pizza delivery service. The controller had disposed of receipts containing customers' personal data at a public… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2023
€3,000 Breikot Management Ltd: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 3,000 on Breikot Management Ltd. The DPA found that the company had violated the principle of minimization by processing excessive… CYPRUS · ·Art. 5, 6 Jan 1, 2023
Private individual: Insufficient legal basis for data processing Unlawful use of a dashcam GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2023
Store detective: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine on a store detective. The detective had collected the contact details of a person accused of shoplifting in their professional function.… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Private individual: Non-compliance with general data processing principles The DPA of Hamburg has imposed a mid-four-figure fine on a private individual for improper use of the personal data of an opponent in a video game. The case occurred on the live… GERMANY · ·Non-compliance with general data processing principles Jan 1, 2023
€1,200 Police officer: Insufficient legal basis for data processing The DPA of Baden-Wuerttemberg has imposed a fine of EUR 1,200 on a police officer. The officer had accessed data in police databases for private research purposes without a valid… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
€215,000 Humboldt Forum Service GmbH: Insufficient legal basis for data processing The DPA of Berlin has imposed fines totaling EUR 215,000 on Humboldt Forum Service GmbH. Humboldt Forum had improperly documented sensitive information about individual employees… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Supermarket: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a five-figure fine on a company. The controller had posted a list of employees' sickness-related absences for the year 2022 in the employee… GERMANY ·Art. 6, 9 ·Insufficient legal basis for data processing Jan 1, 2023
€3M VOODOO ('provider') was a mobile game developer The investigation service of the French DPA (the investigation service) carried out several checks on voodoo.io and on several of the provider's mobile applications on iOS, in… SAN-2022-026 ·France · Dec 29, 2022
€24,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller carried out a… SPAIN · ·Art. 6 Dec 29, 2022
€600 Homeowners Association: Insufficient legal basis for data processing The Spanish DPA has fined a homeowners association EUR 600. The controller had installed an unauthorized CCTV system in the residential area. In addition, the DPA found that the… SPAIN · ·Art. 6, 13 Dec 28, 2022