Content type · 3,651 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€5,000 Ristorante Francesco srl: Non-compliance with general data processing principles The Italian DPA has fined Ristorante Francesco srl EUR 5,000. The controller had operated video surveillance cameras in its premises without the required authorization.… ITALY · ·Art. 5, 13, 114 Jul 6, 2023
€10,000 AcegasApsAmga SpA: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on AcegasApsAmga SpA. A former employee had filed a complaint with the DPA due to the controller's failure to respond to their… ITALY · ·Art. 5, 12, 15 Jul 6, 2023
€1,200 LISMARTSA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on LISMARTSA, S.L.. A data subject had filed a complaint with the DPA because the controller had added them to a WhatsGroup without their… SPAIN · ·Art. 5, 32 Jul 5, 2023
€500 EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L. EUR 500. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5 Jul 4, 2023
€25,000 CaixaBank, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 25,000 on CaixaBank, S.A.. An individual had filed a complaint with the DPA due to the fact that when they requested information from the… SPAIN · ·Art. 32 Jul 4, 2023
€81,000 Heilsuveru: Insufficient technical and organisational measures to ensure information security The Icelandic DPA has fined Heilsuveru EUR 81,000. The controller had reported a data breach to the DPA, as two unauthorized persons had managed to view personal data. During its… ICELAND ·Art. 5, 25, 32 ·Insufficient technical and organisational measures to ensure information security Jul 3, 2023
€56,000 ODAFONE SERVICIOS, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on VODAFONE SERVICIOS, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN · ·Art. 6 Jul 3, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, covered a neighbor… SPAIN · ·Art. 5, 13 Jun 30, 2023
€25,000 CDON AB: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 25,000 on CDON AB. The Austrian organization None of your Business (NOYB) had filed a complaint against the company in light of the… SWEDEN ·Art. 44 ·Insufficient technical and organisational measures to ensure information security Jun 30, 2023
€1M Tele2 Sverige Aktiebolag: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 1 million on Tele2 Sverige Aktiebolag. The Austrian organization None of your Business (NOYB) had filed a complaint against the company… SWEDEN ·Art. 44 ·Insufficient technical and organisational measures to ensure information security Jun 30, 2023
€1,000 PUNTO ROJO LIBROS, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1,000 on PUNTO ROJO LIBROS, S.L. for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 Jun 29, 2023
Greek DPA: Google breached Art. 17 GDPR erasure right over outdated criminal case links In 2020, the data subject filed a complaint with the DPA against Google LLC (the controller) for failing to fulfill their right to erasure (Article 17 GDPR) concerning links -… 54/2024 ·Greece · Jun 29, 2023
€13,400 Sjúkratyringur Íslands: Insufficient technical and organisational measures to ensure information security The Icelandic DPA has imposed a fine of EUR 13,400 on Sjúkratyringur Íslands. During its investigation, the DPA found that the controller had failed to implement adequate… ICELAND ·Art. 5, 25, 32 ·Insufficient technical and organisational measures to ensure information security Jun 28, 2023
€51,000 eCommerce 2020 ApS: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 51,000 on eCommerce 2020 ApS. The controller had submitted information on loan defaults for registration even though the required… ICELAND ·Art. 5, 6, 8 +1 ·Insufficient legal basis for data processing Jun 27, 2023
€1,000 TRC TRUCKS 2020, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1,000 on TRC TRUCKS 2020, S.L. for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 Jun 27, 2023
€257,000 Creditinfo Lánstraust hf.: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 257,000 on Creditinfo Lánstraust hf.. The controller had registered information on loan defaults even though the required registration… ICELAND ·Art. 5, 6, 8 +1 ·Insufficient legal basis for data processing Jun 27, 2023
€24,000 Almennri innheimtu ehf: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 24,000 on Almennri innheimtu ehf. The controller had submitted information on loan defaults for registration even though the required… ICELAND ·Art. 5, 6, 8 +1 ·Insufficient legal basis for data processing Jun 27, 2023
€2,500 Farmacia Ardealul SRL: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 2,500 on Farmacia Ardealul SRL. The controller had reported a data breach to the DPA. During its investigation, the DPA found that an… ROMANIA · ·Art. 32 Jun 27, 2023
€1.1M Bonnier News AB: Insufficient legal basis for data processing The Swedish DPA has imposed a fine of EUR 1.1 million on Bonnier News AB. During its investigation, the DPA found that Bonnier News collects customer data, for example, through… SWEDEN ·Art. 6 ·Insufficient legal basis for data processing Jun 26, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered a neighbouring… SPAIN · ·Art. 5 Jun 23, 2023
€205,000 Digi Telecommunications and Services Ltd.: Insufficient technical and organisational measures to ensure information security The Hungarian DPA has imposed a fine of EUR 205,000 against Digi Telecommunications and Services Ltd. The controller had suffered a data breach in which an unauthorized party… HUNGARY · ·Art. 5, 32 Jun 22, 2023
€90,000 Corporación de Medios de Extremadura: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on Corporación de Medios de Extremadura. The controller had published a video on its news site that included an Excel spreadsheet with personal… SPAIN · ·Art. 5 Jun 22, 2023
€1M Autostrade per l'Italia spa: Non-compliance with general data processing principles The Italian DPA has fined Autostrade per l'Italia spa ('ASPI') EUR 1 million for unlawfully processing the data of approx. 100,000 registered users of the toll reimbursement app… ITALY · ·Art. 5, 13, 28 Jun 22, 2023
€90,000 Sociedad Vascongada de Publicaciones, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on Sociedad Vascongada de Publicaciones, S.A.. The controller had published a video on its news site that included an Excel spreadsheet with… SPAIN · ·Art. 5 Jun 22, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Jun 21, 2023
€1,000 Vodafone Romania SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Vodafone Romania SA. During its investigation, the DPA found that the controller had failed to sufficiently comply with a data… ·Art. 15 ·Insufficient fulfilment of data subjects rights Jun 21, 2023
€7,500 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a company EUR 7,500 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 58 Jun 21, 2023
€1,560 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 1,560 on a legal person. The accused missed the deadline for the required information on action taken to the data subject when it did not… CZECH REPUBLIC · ·Art. 12 Jun 20, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of 300 euros on a private individual. The controller had installed video surveillance cameras that recorded a neighbor's property, among other… SPAIN · ·Art. 5 Jun 20, 2023
€40,000 Dante International SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 40,000 on Dante International SA. During its investigation, the DPA found that the controller had failed to properly comply with a… ROMANIA · ·Art. 12, 17 Jun 20, 2023
€50,000 GRUPO TRANSAHER, SL.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on GRUPO TRANSAHER, SL. The controller had unlawfully installed video surveillance cameras in employee break areas. SPAIN · ·Art. 6 Jun 20, 2023
€22,500 Irish Departement of Health: Non-compliance with general data processing principles The Irish DPA (DPC) has fined the Irish Department of Health EUR 22,500. The DPA launched an investigation into the department following public allegations that the department… IRELAND ·Art. 5, 6, 9 ·Non-compliance with general data processing principles Jun 16, 2023
€30,000 Belgian Order of Pharmacists: Non-compliance with general data processing principles The Belgian DPA has imposed a fine of EUR 30,000 on the Belgian Order of Pharmacists. The controller had conducted disciplinary proceedings against the data subject (pharmacist).… BELGIUM · ·Art. 5 Jun 16, 2023
€1,000 Private individual: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 1,000 on a private individual. The controller had sent data subjects electoral advertising without a valid legal basis. AUSTRIA · ·Art. 6 Jun 16, 2023
€2,000 SPAIN DPA: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on a controller for failing to provide data subjects with sufficient information to exercise their right to object. ·Art. 13 ·Insufficient fulfilment of information obligations Jun 16, 2023
€2,000 BRD-Groupe Société Générale S.A.: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 2,000 on BRD-Groupe Société Générale S.A.. The controller had reported a data breach to the DPA. During its investigation, the DPA found… ROMANIA · ·Art. 5 Jun 15, 2023
€40M CRITEO: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 40 million on CRITEO. The controller is specialized in 'retargeting advertising'. This involves the company tracking the surfing behavior… Jun 15, 2023
€8,000 Artima S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 8,000 on Artima S.A.. The controller had reported a data breach to the DPA. During its investigation, the DPA found that employees of… ROMANIA · ·Art. 32 Jun 15, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€400 SPAIN DPA: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 600 on a controller for failing to comply with an order issued by the DPA. ·Art. 58 ·Insufficient cooperation with supervisory authority Jun 14, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public space.… SPAIN · ·Art. 5 Jun 14, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€4.9M Spotify: Insufficient fulfilment of data subjects rights The Swedish Data Protection Authority (DPA) has imposed a fine of EUR 4.9 million on the music streaming provider Spotify. The DPA had launched an investigation after receiving a… SWEDEN ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Jun 12, 2023
€210,000 Piraeus Bank: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 210,000 on Piraeus Bank. During its investigation, the DPA found that the bank had processed personal data of customers in violation of… GREECE · ·Art. 5, 6, 15 +1 Jun 12, 2023
DSB (Austria) - DSB-D124.4462 On 03 May 2021, the data subject sent a request to the controller for the erasure of their financial asset information. The controller did not respond to their erasure request. On… DSB-D124.4462 ·Art. 55, 77 Jun 12, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 9, 2023
€40,000 RCS Mediagroup S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on RCS Mediagroup S.p.a. for publishing images of an individual without a valid legal basis. ITALY · ·Art. 5 Jun 8, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 Jun 8, 2023