Content type · 2,802 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€30,000 Verizon Connect Italy S.p.A.: Insufficient legal basis for data processing The Italian DPA has fined Verizon Connect Italy S.p.A. EUR 30,000. An individual who worked for a Verizon customer had filed a complaint with the DPA. Verizon had installed GPS… ·Art. 5, 6, 28 ·Insufficient legal basis for data processing Dec 15, 2022
€8,000 Comune di Vicchio: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 8,000 on Comune di Vicchio. The municipality processed biometric data of employees for the purpose of registering their attendance.… ITALY · ·Art. 5, 6, 9 Dec 15, 2022
€3,000 Scuola Statale Secondaria di I^ grado 'Bianco-Pascol': Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on the school 'Scuola Statale Secondaria di I^ grado 'Bianco-Pascoli', di Fasano (BR)'. The educational institution had published a… ITALY · ·Art. 2, 5, 6 +2 Dec 15, 2022
€4.9M Edison Energia S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Edison Energia S.p.A. EUR 4.9 million. Several person had filed complaints with the DPA regarding unlawful marketing activities of the company. During… ITALY · ·Art. 5, 6, 7 +4 Dec 15, 2022
€6,000 Comune di Bracciano: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on Comune di Bracciano. A former employee had filed a complaint with the DPA due to the fact, that the municipality had published a… ITALY · ·Art. 2, 5, 6 +1 Dec 15, 2022
€16,000 HOSPITAL RECOLETAS PONFERRADA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on the healthcare facility HOSPITAL RECOLETAS PONFERRADA, S.L.. A patient had filed a complaint with the DPA. The patient had filled out a… SPAIN · ·Art. 6, 15 Dec 15, 2022
€55,000 Azienda Universitaria Giuliano Isontina: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Giuliano Isontina . The health authority has created patient profiles using algorithms and personal… ITALY · ·Art. 2, 5, 9 +2 Dec 15, 2022
€55,000 Azienda Universitaria Friuli Centrale: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 55,000 on Azienda Universitaria Friuli Centrale. The health authority has created patient profiles using algorithms and personal patient… ITALY · ·Art. 2, 5, 9 +2 Dec 15, 2022
€5,000 Societatea Energetică Electrica S.A.: Insufficient data processing agreement The Romanian DPA has fined Societatea Energetică Electrica S.A. EUR 5,000 for a violation of Art. 28 (3) a) GDPR. ROMANIA · ·Art. 28 Dec 15, 2022
€120,000 Eurosanità S.P.A.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 120,000 on Eurosanità S.P.A.. The controller operates various healthcare facilities. An individual had filed a complaint with the DPA for… ITALY · ·Art. 5, 9, 32 Dec 15, 2022
€5,000 Comune di Borgia: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 5,000 on Comune di Borgia. The municipality processed biometric data of employees for the purpose of registering their attendance.… ITALY · ·Art. 5, 6, 9 +1 Dec 15, 2022
€30,000 ORANGE ESPAGNE, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine ORANGE ESPAGNE, S.A.U. due to insufficient legal basis for data processing. The data subject had filed a complaint against the data… SPAIN · ·Art. 6 Dec 15, 2022
€1,000 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 1,000 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12 Dec 13, 2022
€1,500 Manager of a real estate co-ownership: Insufficient legal basis for data processing The DPA of Luxembourg has imposed a fine of EUR 1,500 on a manager of a real estate co-ownership. The controller had disclosed personal data to unauthorized third parties without… LUXEMBOURG · ·Art. 5, 6, 12 +1 Dec 13, 2022
€2,100 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 2,100 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12, 13 Dec 13, 2022
€700 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 700 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12, 13 Dec 13, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Dec 13, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Dec 13, 2022
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Dec 13, 2022
€2,500 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 2,500 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12 Dec 13, 2022
€1,400 Company: Insufficient fulfilment of information obligations The DPA of Luxembourg has imposed a fine of EUR 1,400 on a company that provides online services to citizens. During its investigation, the DPA found that the company had not… LUXEMBOURG · ·Art. 12, 13 Dec 13, 2022
€750,000 Alektum Oy: Insufficient fulfilment of data subjects rights The Finnish DPA has fined the debt collection company Alektum Oy EUR 750 000. The DPA opened an investigation against the controller after three people filed complaints against… FINLAND · ·Art. 12, 15 Dec 13, 2022
€230,000 Viking Line Oy Abp: Non-compliance with general data processing principles The Finnish DPA has imposed a fine of EUR 230,000 on Viking Line Oy Abp. A former employee had filed a complaint with the DPA. During its investigation, the DPA found that the… FINLAND · ·Art. 5, 12, 13 +2 Dec 9, 2022
€8,000 Notary: Insufficient legal basis for data processing The Spanish DPA has fined a notary. The controller had consulted the land register of a property belonging to the data subject without an order requiring the consultation of this… SPAIN · ·Art. 6 Dec 9, 2022
€480 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual. The individual had installed video surveillance cameras in a residential complex that also covered common areas. During its… SPAIN · ·Art. 6, 13 Dec 9, 2022
€120 Private individual: Insufficient fulfilment of information obligations The Spanish DPA has fined a private individual. The controller had installed a video surveillance system in a multi-party residential building that they own. However, the… SPAIN · ·Art. 13 Dec 9, 2022
€2,000 Casa Rusu S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Casa Rusu S.R.L. . The controller had reported a data breach to the DPA pursuant to Art. 33 GDPR. The controller had used an… ROMANIA · ·Art. 25, 32 Dec 9, 2022
€300,000 FREE SAS: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 300,000 on FREE SAS. The DPA had received several complaints from individuals experiencing difficulties in exercising their rights to… FRANCE · ·Art. 12, 15, 17 +2 Dec 8, 2022
€2,654 Jewelry manufacturer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a jewelry manufacturer. The controller had installed a video surveillance system in its premises, however the DPA found… CROATIA · ·Art. 27 Dec 8, 2022
€2,654 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 8, 2022
€2,654 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 2,654 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 7, 2022
€1,991 Fish market: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a fish market. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 7, 2022
€3,185 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 3,185 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 6, 2022
€1,991 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a retailer. The controller had installed a video surveillance system in its premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 6, 2022
€1,991 Betting place: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 1,991 on a betting place. The controller had installed a video surveillance system in its premises, however the DPA found that… CROATIA · ·Art. 27 Dec 5, 2022
€3,583 Retailer: Insufficient fulfilment of information obligations The Croation DPA (azop) has imposed a fine of EUR 3,583 on a retailer. The controller had installed a video surveillance system in their premises, however the DPA found that the… CROATIA · ·Art. 27 Dec 5, 2022
€600 LORENT 2013, S.L: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on LORENT 2013, S.L.. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Dec 3, 2022
€3,000 INDECEMI, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3,000 on INDECEMI, S.L.. A person had filed a complaint with the DPA against the controller after receiving an email from the controller… SPAIN · ·Art. 5 Dec 3, 2022
€300 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a Homeowners Association. The association had installed several video surveillance cameras across the residential area which, among… SPAIN · ·Art. 5 Dec 3, 2022
€3,600 Federation of Sports for People with Intellectual Disabilities of Castilla la Mancha-FECAM: Insufficient legal basis for data processing The Spanish DPA has fined the Federation of Sports for People with Intellectual Disabilities of Castilla la Mancha-FECAM. The controller processed medical data from Covid-19… SPAIN · ·Art. 9, 13 Dec 2, 2022
€3,500 CASA 7 PERSONAL SHOPPER, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 3,500 on CASA 7 PERSONAL SHOPPER, S.L. The controller sent an e-mail with personal data to several recipients in an open distribution… SPAIN · ·Art. 5, 32 Dec 2, 2022
€6,000 A.R.N.A.S. Civico: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 6,000 on A.R.N.A.S. Civico. Two employees of the controller had filed a complaint with the DPA. During its investigation, the DPA found… ITALY · ·Art. 2, 5, 6 +1 Dec 1, 2022
€20,000 Amazon Italia Logistica s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Amazon Italia Logistica s.r.l. EUR 20,000. A former employee had requested documents from the controller, which however they did not receive in time.… ITALY · ·Art. 12, 15 Dec 1, 2022
€6,000 Store owner (Joy Unique Collection): Insufficient fulfilment of information obligations The Italian DPA has fined the owner of the store 'Joy Unique Collection' EUR 6,000 . The controller had operated video surveillance cameras in its premises without the required… ITALY · ·Art. 5, 13, 114 Dec 1, 2022
€2,000 Store owner: Insufficient fulfilment of information obligations The Italian DPA has fined a store owner EUR 2,000 for failing to provide sufficient information pursuant to Art. 13 GDPR about CCTV surveillance in their premises. ITALY · ·Art. 5, 13 Dec 1, 2022
€3,000 Store owner (Woolen): Insufficient fulfilment of information obligations The Italian DPA has fined the owner of the store 'Woolen' EUR 3,000 . The controller had operated video surveillance cameras in its premises without the required authorization.… ITALY · ·Art. 5, 13, 114 Dec 1, 2022
€100,000 Lazio Region: Insufficient legal basis for data processing The Italian DPA has fined Lazio Region EUR 100,000. A trade union had filed a complaint with the DPA alleging that the Region had monitored the e-mail accounts of employees of the… ITALY · ·Art. 5, 6, 113 +1 Dec 1, 2022
€9,600 PIONIER (law firm): Insufficient legal basis for data processing The Polish DPA has imposed a fine of EUR 9,600 on the law firm PIONIER. The law firm mainly represents victims of traffic accidents in proceedings against insurance companies and… POLAND · ·Art. 5, 6, 9 Nov 30, 2022
€3,000 Company: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 3,000 on a company. The controller had installed a video surveillance system that also recorded the voices of both employees and… SPAIN · ·Art. 6, 13 Nov 29, 2022
€500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Nov 29, 2022