Content type · 3,594 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€30,000 H&M Hennes & Mauritz GBC AB: Insufficient fulfilment of data subjects rights The Swedish DPA has imposed a fine of EUR 30,000 on H&M for sending out marketing messages, despite the fact that data subjects had exercised their right to objection. Six data… SWEDEN ·Art. 12, 21 ·Insufficient fulfilment of data subjects rights Oct 17, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 600 for installing a video surveillance camera that captured parts of a commonly shared garage. The DPA considered this a… SPAIN · ·Art. 5, 13 Oct 15, 2023
€70,000 Scionti Selezioni Superiori S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 70,000 on Scionti Selezioni Superiori S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were… ITALY · ·Art. 5, 6, 7 +7 Oct 12, 2023
€40,000 Azienda socio sanitaria territoriale di Lodi CF: Non-compliance with general data processing principles The Italian DPA has imposed a fine of ERU 40,000 on the health authority Azienda socio sanitaria territoriale di Lodi CF. Employees of the health authority had accessed the file… ITALY · ·Art. 5, 9, 32 Oct 12, 2023
€600,000 GROUPE CANAL +: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 600,000 on GROUPE CANAL+ for multiple violations of the GDPR. The DPA determined that the data controller failed to demonstrate that it… FRANCE · ·Art. 7, 12, 13 +5 Oct 12, 2023
€1,000 GREECE DPA: Non-compliance with general data processing principles Unlawful disclosure of health data. ·Art. 5 ·Non-compliance with general data processing principles Oct 11, 2023
€500 ALBEN AIRPORT FACILITIES S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined ALBEN AIRPORT FACILITIES S.L. EUR 500 for failing to provide information requested by the DPA during an investigation. SPAIN · ·Art. 58 Oct 11, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 300. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN · ·Art. 5 Oct 11, 2023
€5,300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. An individual had rented a room from the controller and filed a complaint due to the fact that the… SPAIN · ·Art. 6, 13 Oct 11, 2023
€1,500 NORDETIA CLINICS MÓSTOLES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on NORDETIA CLINICS MÓSTOLES S.L.. The controller had sent an e-mail without using the blind copy option, revealing the email… SPAIN · ·Art. 5, 32 Oct 10, 2023
€15,000 ILUNION SEGURIDAD, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 15,000 on ILUNION SEGURIDAD, S.A. The controller had sent labor communications by e-mail without using the blind copy option, revealing… SPAIN · ·Art. 5, 32 Oct 10, 2023
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 500. The individual had installed video surveillance cameras on their property which covered, among other things, the public… SPAIN · ·Art. 5 Oct 9, 2023
€4,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 4,000 for installing a video surveillance camera that captured parts of a commonly shared garage. The DPA considered this a… SPAIN · ·Art. 5 Oct 9, 2023
€24,000 Link4 Towarzystwo Ubezpieczeń S. A.: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined Link4 Towarzystwo Ubezpieczeń S. A. EUR 24,000 for failing to report a data breach to the DPA in a timely manner. POLAND · ·Art. 33 Oct 8, 2023
DSB-D124.5337 In August 2021, an unprotected Excel file containing the names and PCR test results of several thousand individuals was sent from the compromised email account of the first data… 2023-0.273.912 ·Austria ·Art. 5, 6, 12 +3 Oct 6, 2023
€5.5M Debt collection company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed of fine of EUR 5,470,000 to a debt collection company. The investigation was triggered by an anonymous complaint stating that controller… CROATIA · ·Art. 5, 6, 12 +2 Oct 5, 2023
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Oct 5, 2023
€70,000 Schockholm School borard: Non-compliance with general data processing principles The Swedish DPA has fined the Stockholm School Board EUR 70,000 for excessive video surveillance in a school. A school had installed extensive video surveillance due to past… SWEDEN · ·Art. 5, 6, 13 Oct 3, 2023
€1,000 Cez Vânzare S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Cez Vânzare S.A.. The controller had accidentally sent emails containing personal customer data to the wrong recipients. The… ROMANIA · ·Art. 32 Oct 2, 2023
€10M Axpo Italia Spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10 million on electricity and gas supplier Axpo Italia Spa. The DPA had received numerous complaints from data subjects who complained… ITALY · ·Art. 5, 24 Sep 28, 2023
€3,000 Palombaro s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has fined Palombaro s.r.l. EUR 3,000. The controller had installed video surveillance cameras in its premises without properly informing the data subjects about… ITALY · ·Art. 5, 13 Sep 28, 2023
€5,000 Ministero dell'Ambiente e della Sicurezza Energetica: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Ministero dell'Ambiente e della Sicurezza Energetica. The controller had published a document on its website that contained… ITALY · ·Art. 2, 5, 6 +1 Sep 28, 2023
€30,000 Asl Napoli 3 Sud: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Asl Napoli 3 Sud EUR 30,000. The healthcare facility had suffered a ransomware attack that used a virus to restrict access to the healthcare facility's… ITALY · ·Art. 5, 25, 32 Sep 28, 2023
€60,000 Salvator Mundi International Hospital s.r.l: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on Salvator Mundi International Hospital s.r.l. The hospital had restricted access to its services to people with a Covid-19 Green… ITALY · ·Art. 5, 9 Sep 28, 2023
€5,000 Physician: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on a physician for unlawfully disclosing patient data. ITALY · ·Art. 5, 9 Sep 28, 2023
€50,000 Azienda Usl Toscana centro: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 50,000 on Azienda Usl Toscana centro. A person had reported that medical records containing sensitive patient data were still being… ITALY · ·Art. 5, 32 Sep 28, 2023
€420 CHINA CENTER LLEIDA: Insufficient fulfilment of information obligations The Spanish DPA has fined CHINA CENTER LLEIDA due to a lack of sufficient data processing information in relation to video surveillance in their premises. The original fine of EUR… SPAIN · ·Art. 13 Sep 27, 2023
€25,000 RESTART ENERGY ONE S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 25,000 on RESTART ENERGY ONE S.A.. During its investigation, the DPA found that there existed a publicly accessible file on the… ROMANIA · ·Art. 32 Sep 26, 2023
€10,000 Phyisician: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 10,000 on a physician. The physician had responded to an online review regarding their practice, disclosing personal health data of a… AUSTRIA · ·Art. 5, 9 Sep 26, 2023
€1,040 Self Employed Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 1,040 on a self employed person. The accused's website did not comply with GDPR requirements for cookies, as it processed data before… CZECH REPUBLIC · ·Art. 5, 13 Sep 26, 2023
€30,000 EUROPA PRESS DE CATALUNYA, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 30,000 on EUROPA PRESS DE CATALUNYA, S.A.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Sep 26, 2023
€15,000 Hotel: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed of fine of EUR 15,000 to a hotel. The hotel was collecting personal data from guests in excess of what would have been necessary for the… CROATIA · ·Art. 6, 13, 32 +1 Sep 26, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Sep 26, 2023
€50,000 Athens Urban Transport Organization: Non-compliance with general data processing principles The Hellenic DPA imposed a fine of EUR 50,000 on the Athens Urban Transport Organization. As part of its investigation, the DPA found that the controller had failed to comply with… GREECE · ·Art. 5, 25, 35 Sep 25, 2023
€2,000 UAT Comuna Albeni: Insufficient cooperation with supervisory authority The Romanian DPA has fined UAT Comuna Albeni EUR 2,000 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Sep 25, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 25, 2023
€17,000 FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 17,000 on FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA. Athletes were required to upload the vaccination certificate against COVID with… SPAIN · ·Art. 9, 13 Sep 25, 2023
€12,000 CHATWITH.IO WORLDWIDE, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 12,000 on the website operator CHATWITH.IO WORLDWIDE, S.L. During its investigation, the DPA found that the controller had failed to… SPAIN · ·Art. 5, 13, 22 Sep 23, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered neighbour… SPAIN · ·Art. 5 Sep 21, 2023
€2,500 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA of Luxembourg has imposed a fine of EUR 2,500 on a controller. The controller had used location systems on his service vehicles and construction machinery. During its… ·Art. 5, 13 ·Non-compliance with general data processing principles Sep 21, 2023
€4,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 4,000 on a private individual. An individual had rented a room from the controller and filed a complaint against them due to the fact… SPAIN · ·Art. 6 Sep 21, 2023
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Sep 19, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered… SPAIN · ·Art. 5 Sep 19, 2023
€1,000 NN Asigurări de Viață S.A.: Insufficient fulfilment of data subjects rights The Romanian DPA has fined NN Asigurări de Viață S.A. EUR 1,000. A person had filed a complaint for receiving advertising messages, although they had objected to receiving… ROMANIA · ·Art. 21 Sep 18, 2023
€200,000 SAF LOGISTICS: Non-compliance with general data processing principles The French DPA has fined SAF LOGISTICS EUR 200,000. An employee reported to the DPA that the controller had collected data on the private lives of its employees. During its… FRANCE · ·Art. 5, 9, 10 +1 Sep 18, 2023
€90,000 GFB One s.r.l.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 90,000 on GFB One s.r.l.. An individual had filed a complaint with the DPA because SIM cards were registered in their name, although they… ITALY · ·Art. 5, 6, 13 +1 Sep 14, 2023
€10,000 San Severo municipality: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 10,000 on San Severo municipality. The municipality had published a document containing personal data of employees on its website without a… ITALY · ·Art. 2, 5, 6 Sep 14, 2023
€42,000 Intesa Sanpaolo Spa: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. ITALY · ·Art. 15 Sep 14, 2023
€30,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 30,000 on a company engaged in gambling and betting activities due to three identified violations of the GDPR. As noted by AZOP,… CROATIA · ·Art. 6, 7, 13 Sep 14, 2023
€10,000 Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb for failing to adequately comply with its obligation to comply… ITALY · ·Art. 12 Sep 14, 2023