Content type · 3,651 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€300,000 Rinascente S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Rinascente S.p.A. EUR 300,000. The DPA acted on a complaint from a customer who, following an incident with a store employee, had her long-standing… ITALY · ·Art. 5, 12, 32 +1 Jun 8, 2023
€150,000 KG COM: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 150,000 on the company KG COM. The company operates several websites and offers fortune-telling consultations to customers via chat or… FRANCE · ·Art. 5, 6, 9 +6 Jun 8, 2023
€84,000 UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC a fine. A person had filed a complaint against the controller because a package addressed to them… SPAIN · ·Art. 5, 32 Jun 7, 2023
€5,000 Azienda Tutela della Salute della Sardegna: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Azienda Tutela della Salute della Sardegna. The health authority had placed a sign at the gate of a physician's practice… ITALY · ·Art. 2, 5, 9 Jun 7, 2023
€20,000 RCI BANQUE, S.A. SUCURSAL EN ESPAÑA: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine of EUR 20,000 RCI BANQUE, S.A. SUCURSAL EN ESPAÑA. A data subject complained that she was receiving text messages from the controller,… SPAIN · ·Art. 17 Jun 7, 2023
€1,200 CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L.. During its investigation, the DPA found that the controller had failed to properly and… SPAIN · ·Art. 21 Jun 7, 2023
€400 LEADDESK, S.L: Insufficient cooperation with supervisory authority The Spanish DPA has fined LEADDESK, S.L for failing to provide information requested by the DPA during an investigation. The original fine of EUR 500 was reduced to EUR 400 due to… SPAIN · ·Art. 58 Jun 7, 2023
€3,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has fined a private individual EUR 3,000. An individual had filed a complaint with the DPA against the controller due to the fact that the controller had provided… SPAIN · ·Art. 5, 32 Jun 6, 2023
€56,000 VODAFONE ONO, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on VODAFONE ONO, S.A.U.. The controller had carried out a credit check on an individual without there being a customer relationship or other… SPAIN · ·Art. 6 Jun 6, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 6, 2023
€3,000 S.C. Apollo Salon S.R.L.: Insufficient cooperation with supervisory authority The Romanian DPA imposed a fine of EUR 3,000 on S.C. Apollo Salon S.R.L. for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Jun 6, 2023
€10,000 ALPA 57 PRODUCCIONES: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on ALPA 57 PRODUCCIONES. A data subject had filed a complaint with the DPA because the controller had unlawfully transmitted their… SPAIN · ·Art. 6 Jun 5, 2023
€4,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 Jun 2, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which also recorded a neighbor property. The DPA… SPAIN · ·Art. 5 Jun 2, 2023
€20,000 QUALITY-PROVIDER S.A.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 20,000 on QUALITY-PROVIDER S.A.. A data subject had filed a complaint with the DPA because the controller had continued to use their data… SPAIN · ·Art. 6, 17 Jun 2, 2023
€42,000 PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA. An individual had filed a complaint with the DPA because the controller had disclosed… SPAIN · ·Art. 5, 32 Jun 1, 2023
€3,000 Comune di Napoli: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Napoli. The municipality had sent three former employees, after termination of their employment an e-mail containing… ITALY · ·Art. 2, 5, 6 Jun 1, 2023
€20,000 Azienda Usl Toscana Sud Est.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 against Azienda Usl Toscana Sud Est. The controller had put up an information poster in the emergency room showing a healthcare… ITALY · ·Art. 2, 5, 9 +1 Jun 1, 2023
€20,000 Ew Business Machines S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on Ew Business Machines S.p.A.. The controller had installed a video surveillance system that not only recorded images in real… ITALY · ·Art. 5, 9, 13 +1 Jun 1, 2023
€15,000 Thin Srl: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection… ITALY · ·Art. 5, 9, 13 Jun 1, 2023
€10,000 Camedi s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Camedi s.r.l. Medical Center. A person had filed a complaint with the DPA because they had received invoices as well as… ITALY · ·Art. 5, 9, 32 Jun 1, 2023
€300,000 Deutsche Kreditbank: Insufficient fulfilment of data subjects rights The DPA of Berlin has imposed a fine of EUR 300,000 on Deutsche Kreditbank. A customer had filed a complaint with the DPA. The customer had submitted an application for a credit… GERMANY ·Art. 5, 15, 22 ·Insufficient fulfilment of data subjects rights May 31, 2023
€500 Website operator: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 5,000 on a website operator for failing to ensure that the privacy policy on its website complied with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 May 31, 2023
€2,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 2,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 May 31, 2023
€10,600 Company: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 10,600 on a company. The company had suffered a ransomware attack on their systems which resulted in the loss of personal data. During its… POLAND · ·Art. 5, 25, 32 +2 May 31, 2023
€150,000 NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ
Α.Ε.,: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 150,000 on NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ. Α.Ε., imposed a fine of EUR 150,000. A customer had filed a complaint with the… GREECE · ·Art. 12, 15, 21 +1 May 29, 2023
€180 CARROZADOS TECAI, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on CARROZADOS TECAI, S.L.. The controller had installed a video surveillance system but had not added all the required information on the… SPAIN · ·Art. 13 May 29, 2023
€300 CBHNOS S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CBHNOS S.L.. The controller had installed video surveillance cameras which, among other things, also covered a public road. The DPA… SPAIN · ·Art. 5 May 29, 2023
€600 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 600 on a private individual for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 May 25, 2023
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed a video surveillance camera which also covered the public space and a neighbour property.… SPAIN · ·Art. 5, 13 May 25, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 10,000 for publishing a picture and address of another person on a website without their consent. SPAIN · ·Art. 6 May 24, 2023
€3,000 NORDETIA CLINICS IBERIA, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined NORDETIA CLINICS IBERIA, S.L. EUR 3,000 for failing to provide information requested by the DPA during an investigation. SPAIN · ·Art. 58 May 24, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing May 23, 2023
€1,000 Global Baby Brand SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on Global Baby Brand SRL. A person had filed a complaint with the DPA alleging that the controller had sent commercial SMS… ROMANIA · ·Art. 7 May 23, 2023
€18,000 AUTOMOBILE BAVARIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 18,000 on AUTOMOBILE BAVARIA SRL. The data controller had notified the authority of a data breach pursuant to Art. 33 GDPR. Unknown… ROMANIA · ·Art. 25, 32 May 18, 2023
€380,000 Sports betting operator: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 380,000 on a sports betting operator. AZOP had received a complaint from a data subject, stating that the controller had obtained… CROATIA · ·Art. 6, 13, 25 +1 May 18, 2023
€10,000 Santander Consumer Bank S.p.a.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Santander Consumer Bank S.p.a. EUR 10,000 for not sufficiently fulfilling its obligation to comply with a data subject's request for access to their data. ITALY · ·Art. 12 May 17, 2023
€60,000 Website operator: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on a website operator. The controller had published unauthorized personal data on the website www.trovanumeri.com, which it had… ITALY · ·Art. 5, 6, 12 +6 May 17, 2023
€900 WILLOUGHBY COLLEGE, S.A: Insufficient cooperation with supervisory authority The Spanish DPA has fined WILLOUGHBY COLLEGE, S.A. for failing to provide information requested by the DPA during an investigation. The original fine of EUR 1,500 was reduced to… SPAIN · ·Art. 58 May 17, 2023
€50,000 FUSIONA SOLUCIONES ENERGÉTICAS, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on FUSIONA SOLUCIONES ENERGÉTICAS, S.A.. The controller had submitted data from the data subject to a credit information system… SPAIN · ·Art. 6 May 17, 2023
€10,000 Azienda ULSS 6 Euganea: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Azienda ULSS 6 Euganea. The controller had mistakenly sent documents containing personal data to the wrong patients. The DPA… ITALY · ·Art. 5, 6, 32 May 17, 2023
€10,000 Grizzaffi Management Srl: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Grizzaffi Management Srl for sending out marketing messages, despite the fact that the data subjects had exercised their right… ITALY · ·Art. 5, 17, 21 May 17, 2023
€40,000 Volkswagen Leasing GmbH: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on Volkswagen Leasing. A customer had filed a complaint with the DPA because the controller had not provided them with information… ITALY · ·Art. 12, 15 May 17, 2023
€10,000 La Gazzetta di Parma S.r.l.: Non-compliance with general data processing principles The Italian DPA has fined La Gazzetta di Parma S.r.l. EUR 10,000. The controller had published photos in its newspaper of an individual accused of murder. The photos showed the… ITALY · ·Art. 5 May 17, 2023
€6,700 Municipality: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 6,700 on a municipality. The controller had reported a data breach to the DPA. During its investigation, the DPA found that the controller… POLAND · ·Art. 5, 24, 25 +1 May 16, 2023
€5,000 Compania Națională Poșta Română S.A.: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 5,000 on the Romanian Post (Compania Națională Poșta Română S.A.). During its investigation, the DPA found that the controller had… ROMANIA · ·Art. 5, 6 May 16, 2023
€1,000 NN Asigurări de Viață S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,00 on the insurance company NN Asigurări de Viață S.A.. The controller had notified the authority of a data breach pursuant to Art. 33… ROMANIA · ·Art. 32 May 12, 2023
€1,500 NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,500 on the insurance company NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.. The controller had… ROMANIA · ·Art. 32 May 12, 2023
€1,200M Meta Platforms Ireland Limited: Insufficient legal basis for data processing The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 1.2 billion. This is the highest fine imposed to date under the GDPR. In its decision, the DPC found that Meta had… Art. 46 May 12, 2023
€11,000 Libra Internet Bank SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 11,000 on Libra Internet Bank SA. An individual had filed a complaint against the bank due to the bank's failure to fully comply with… ROMANIA · ·Art. 12, 15 May 11, 2023