Content type · 3,446 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€50,000 EL DIARIO DE PRENSA DIGITAL SL.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on EL DIARIO DE PRENSA DIGITAL SL.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L.. Several media outlets, including the controller had published an audio recording of a… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 CONECTA5 TELECINCO, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on CONECTA5 TELECINCO, S.A.U.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.. Several media outlets, including the controller had published an audio recording… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 LA VANGUARDIA EDICIONES, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on LA VANGUARDIA EDICIONES, S.L.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 DIARIO ABC, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on DIARIO ABC, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's… SPAIN · ·Art. 5 Mar 21, 2023
€40,000 EDITORIAL DE PRENSA CANARIA, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on EDITORIAL DE PRENSA CANARIA, S.A.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€70,000 CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.. The data subject had received a message from a debt collection company on behalf… SPAIN · ·Art. 6 Mar 21, 2023
€40,000 TITANIA COMPAÑÍA EDITORIAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on TITANIA COMPAÑÍA EDITORIAL, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€10,000 NGENIERÍA Y TELECOM JAÉN, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on INGENIERÍA Y TELECOM JAÉN, S.L.. The controller had extented the data subject's contract without their consent. SPAIN · ·Art. 6 Mar 17, 2023
€100,000 ORANGE ESPAGNE S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 100,000 on ORANGE ESPAGNE S.A.U.. A customer who had purchased a cell phone from ORANGE had filed a complaint with the DPA. As a… SPAIN · ·Art. 5 Mar 16, 2023
€145,000 AFIANZA ASESORES S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 145,000 on AFIANZA ASESORES S.L.. The controller had reported a data breach to the DPA, stating that a backpack containing a USB stick… SPAIN · ·Art. 5, 32 Mar 16, 2023
€5,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on a private individual. The controller sent an e-mail with personal data to several recipients in an open distribution list. This… SPAIN · ·Art. 5, 32 Mar 16, 2023
€1,000 Centrul Medical dr. Furtună Dan: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Centrul Medical dr. Furtună Dan. The controller had sent results of a medical test via WhatsApp to the wrong recipient. As a… ROMANIA · ·Art. 32 Mar 16, 2023
€1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient identification methodes, resulting in a customer… BULGARIA · ·Art. 5 Mar 16, 2023
€125,000 CITYSCOOT: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 125,000 on CITYSCOOT, a company that rents out motor scooters for short periods. During its investigation, the DPA found that CITYSCOOT,… FRANCE · ·Art. 5, 28, 82 Mar 16, 2023
€3,000 Med Life S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Centrul Medical dr. Furtună Dan. The controller had sent results of a medical test via WhatsApp to the wrong recipient. As a… ROMANIA · ·Art. 32 Mar 16, 2023
€4,000 Partidul Uniunea Salvați România: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined the Partidul Uniunea Salvați România party EUR 4,000. The controller had suffered a phishing attack in which the attackers gained unauthorized access to… ROMANIA · ·Art. 32 Mar 15, 2023
€10,000 Alianța pentru Unirea Românilor: Non-compliance with general data processing principles The Romanian DPA imposed a fine of EUR 10,000 on Alianța pentru Unirea Românilor. During its investigation, the DPA found that the controller collected personal data on its… ROMANIA · ·Art. 5 Mar 15, 2023
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed a video surveillance camera which also covered the public space and a neighbour property.… SPAIN · ·Art. 5, 13 Mar 15, 2023
€136,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U. A data subject had filed a complaint against the data controller as unauthorized fraudsters managed to access… SPAIN · ·Art. 6, 32 Mar 15, 2023
€240 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. A data subject had filed a complaint against their ex-partner with the DPA. The ex-partner had installed video… SPAIN · ·Art. 5 Mar 14, 2023
€3,000 Tinmar Energy SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined Tinmar Energy SA EUR 3,000. The controller had suffered a data breach in which third parties gained unauthorized access to personal data such as first… ROMANIA · ·Art. 32 Mar 14, 2023
€2,000 Modaone SRL: Insufficient fulfilment of information obligations The Romanian DPA has imposed a fine of EUR 2,000 on Modaone SRL. An individual had filed a complaint with the DPA for having received advertising messages by e-mail, although they… ROMANIA · ·Art. 12, 13 Mar 13, 2023
€40,000 VODAFONE ONO, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on VODAFONE ONO, S.A.U.. The controller had carried out a credit check on an individual without there being a customer relationship or other… SPAIN · ·Art. 6 Mar 10, 2023
€3,000 Aesse S.r.l.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Aesse S.r.l.s.. An individual had filed a complaint with the DPA due to the fact that the controller had made an unsolicited… ITALY · ·Art. 5, 6, 7 +5 Mar 9, 2023
€2,000 Consorzio Concessioni Reti Gas S.c.a.r.l.: Non-compliance with general data processing principles The Italian DPA has fined Consorzio Concessioni Reti Gas S.c.a.r.l. EUR 2,000. The controller continued to leave the business email account of an intern active even after the… ITALY · ·Art. 5, 12, 13 Mar 9, 2023
€3,000 Store owner: Non-compliance with general data processing principles The Italian DPA has fined a store owner EUR 3,000. The controller had operated video surveillance cameras in its premises without the required authorization. Furthermore, the DPA… ITALY · ·Art. 5, 13, 114 Mar 9, 2023
€10,000 Banca Cambiano 1884 S.p.A.: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. ITALY · ·Art. 12, 15 Mar 9, 2023
€1,600 Deca s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 1,600 on Deca s.r.l.. Employees had filed a complaint with the DPA because the controller had not complied with their requests for access… ITALY · ·Art. 12, 15 Mar 9, 2023
€220,000 Argon Medical Devices: Insufficient fulfilment of data breach notification obligations The Norwegian DPA has fined Argon Medical Devices EUR 220,000. The controller failed to notify the DPA of a data breach that involved personal data of all its European employees… NORWAY · ·Art. 33 Mar 8, 2023
€2,250 Finopro IFN SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,250 on Finopro IFN SA. The controller had suffered a ransomware attack in which unauthorized third parties gained access to personal… ROMANIA · ·Art. 32 Mar 6, 2023
€3,000 Integral Collection SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3000 on Integral Collection SRL. The controller had suffered a ransomware attack in which unauthorized third parties gained access to… ROMANIA · ·Art. 32 Mar 6, 2023
€50,000 Azienda sanitaria locale di Bari: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 50,000 on Azienda sanitaria locale di Bari. The healthcare facility had published reviews of former patients on the Internet and provided… ITALY · ·Art. 5, 9, 25 Mar 2, 2023
€50,000 H&M Hennes & Mauritz s.r.l. EUR 50,000: Non-compliance with general data processing principles The Italian DPA has fined H&M Hennes & Mauritz s.r.l. EUR 50,000. H&M had installed numerous video surveillance systems in its Italian stores for the purpose of preventing theft… ITALY · ·Art. 5, 114 Mar 2, 2023
€1,000 Razmataz Live s.r.l..: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1,000 on Razmataz Live s.r.l.. Razmataz had contracted a processor to carry out marketing campaigns, which the processor failed to… ITALY · ·Art. 5, 6, 28 Mar 2, 2023
€5,000 Private individual: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on a private individual. The individual had sent promotional messages to several data subjects without their consent. ITALY · ·Art. 5, 6, 130 Mar 2, 2023
€11,100 Housing cooperative: Insufficient fulfilment of data breach notification obligations The Polish DPA has imposed a fine of EUR 11,100 on a housing cooperative. The controller had disclosed personal data of a member of the cooperative to an unauthorized person. The… POLAND · ·Art. 33, 34 Mar 1, 2023
€15,000 GRUPO NORCONSULTING, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine of EUR 15,000 on GRUPO NORCONSULTING, S.L.. A data subject had filed a complaint against the controller with the DPA due to the controller's… SPAIN · ·Art. 15, 17 Feb 28, 2023
€1,800 WUNSCHURLAUB S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has fined WUNSCHURLAUB S.L. for storing passwords in plain text on its website www.meine-auszeit-jetzt.de. The DPA considered this to be a violation of Art. 32… SPAIN · ·Art. 32 Feb 28, 2023
€3,000 CITIZENGO FOUNDATION: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on CITIZENGO FOUNDATION. A person had filed a complaint with the DPA because the controller had sent them an email with election advertising… SPAIN · ·Art. 7 Feb 28, 2023
€600 ECOMM MOVADGENCY S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine a ECOMM MOVADGENCY S.L. for sending out direct marketing messages, despite the fact that the data subjects had exercised their right to… SPAIN · ·Art. 21 Feb 28, 2023
€800 GUUDJOB WORLDWIDE S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA has imposed a fine on GUUDJOB WORLDWIDE S.L.. An individual filed a complaint with the DPA claiming that the controller had not complied with their request to… SPAIN · ·Art. 12, 17 Feb 28, 2023
€800 EUROPYMES SERVICIOS INTEGRALES S.L.: Insufficient fulfilment of data subjects rights The Spanish Data Protection Authority has imposed a fine on EUROPYMES SERVICIOS INTEGRALES S.L.. The controller has not properly complied with the data subject's request for… SPAIN · ·Art. 17 Feb 28, 2023
€750,000 Bank of Ireland 365: Insufficient technical and organisational measures to ensure information security The Irish DPA has fined Bank of Ireland 365 EUR 750,000. The bank had notified the DPA of 10 data breaches linked to the bank's app. Unauthorized persons had managed to gain… Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Feb 27, 2023
€4,000 Attorney: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 4,000 on an attorney. The attorney had sent a court ruling containing personal data of a data subject to several individuals via WhatsApp… SPAIN · ·Art. 5, 6 Feb 27, 2023
€300,000 Ediscom S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 300,000 on Ediscom S.p.a.. The marketing company had collected data from 21 million individuals via various online portals in order to… ITALY · ·Art. 5, 6, 7 +3 Feb 23, 2023
€30,000 DISPLAY CONNECTORS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on DISPLAY CONNECTORS, S.L.. An individual had filed a complaint with the DPA regarding the controller's publication of information about a… SPAIN · ·Art. 5 Feb 22, 2023
€300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a private individual. The individual had shared a document containing personal data of the data subject in a WhatsApp group without the data… SPAIN · ·Art. 6 Feb 21, 2023
€180 SUPER 24H LOS ROSALES, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on SUPER 24H LOS ROSALES, S.L.. The controller had failed to provide a notice with information about video surveillance in its premises. The… SPAIN · ·Art. 13 Feb 21, 2023