Content type · 3,651 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€5.2M Clearview AI: Insufficient cooperation with supervisory authority The French DPA has fined Clearview AI EUR 5.2 million. The DPA had imposed a fine of EUR 20 million on the company in 2022 for unlawfully collecting personal data. In addition to… FRANCE · ·Insufficient cooperation with supervisory authority May 10, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 May 9, 2023
€5,000 ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has fined ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U. EUR 5,000. An individual had filed a complaint with the DPA because employees of the controller had visted their… SPAIN · ·Art. 6 May 9, 2023
€2,200 Municipality: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 2,200 on a municipality. The controller had reported a data breach to the DPA. An employee had unauthorizedly copied a document containing… POLAND · ·Art. 5, 25, 32 May 5, 2023
€1,200 FUNDACIÓ PRIVADA UNIVERSITARIA EADA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on FUNDACIÓ PRIVADA UNIVERSITARIA EADA. An individual who had participated in a training event filed a complaint against the educational… SPAIN · ·Art. 6 May 5, 2023
€2,000 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An owner had filed a complaint with the DPA due to the fact that members of the association had… SPAIN · ·Art. 5 May 5, 2023
€3,810 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 3,810 on a legal person. The accused unlawfully processed the personal data of an unspecified number of creditors to purchase their claims… CZECH REPUBLIC · ·Art. 6, 14 May 4, 2023
€2.3M Debt collection agency: Insufficient technical and organisational measures to ensure information security The Croatian DPA (AZOP) has imposed a fine of EUR 2,265,000 on a debt collection agency. The fine is the highest ever imposed by AZOP. AZOP had received an anonymous complaint in… CROATIA · ·Art. 6, 13, 28 +1 May 4, 2023
€200,000 GSMA LTD.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 200,000 against GSMA LTD.. An individual had filed a complaint with the DPA because they had to transfer special categories of personal… SPAIN · ·Art. 35 May 3, 2023
€5,000 BANQUETES SANTA ANA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on BANQUETES SANTA ANA, S.L.. The controller had asked a couple celebrating their wedding at its premises to provide the personal… SPAIN · ·Art. 5 May 3, 2023
€9,000 NAGA Markets Europe Ltd: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 9,000 on NAGA Markets Europe Ltd. The controller had suffered a data breach in which an unknown person accessed the company's database,… CYPRUS ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security May 2, 2023
€5,000 INFINITY ECOM S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 5,000 on INFINITY ECOM S.L. for failing to ensure that the privacy policy on its website complied with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 Apr 28, 2023
€2,000 ASSOCIACIO DE CAÇADORS D'ALZIRA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on ASSOCIACIO DE CAÇADORS D'ALZIRA. A member of the association had filed a complaint with the DPA because the chairman had… SPAIN · ·Art. 5 Apr 28, 2023
€12,000 ALBERO FORTE COMPOSITE, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine on ALBERO FORTE COMPOSITE, S.L.. The company had taken pictures of employees at the entrance for the purpose of recording their working… SPAIN · ·Art. 35 Apr 28, 2023
€15,000 Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 15,000 on Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce. The school board had published a… ITALY · ·Art. 2, 5, 6 +1 Apr 27, 2023
€239,000 Ama S.p.a.: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 239,000 on Ama S.p.a.. Ama is in charge of the administration of certain cemeteries in Rome. The city of Rome had provided data of women who… ITALY · ·Art. 2, 28, 29 +1 Apr 27, 2023
€2,000 Store owner: Insufficient fulfilment of information obligations The Italian DPA has fined a store owner EUR 2,000 for failing to provide sufficient information pursuant to Art. 13 GDPR about CCTV surveillance in their premises. ITALY · ·Art. 5, 13 Apr 27, 2023
€400 Private individual: Non-compliance with general data processing principles The Italian DPA has fined a private individual EUR 400 for unlawfully operating video surveillance cameras on their property. ITALY · ·Art. 5, 6 Apr 27, 2023
€240,000 Benetton Group S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 240,000 on Benetton Group S.r.l.. The controller had stored a large amount of customer data indefinitely. The DPA also found that the… ITALY · ·Art. 5, 32 Apr 27, 2023
€4,000 Università degli studi di Cassino e del Lazio Meridionale: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR on Università degli studi di Cassino e del Lazio Meridionale. A professor at the university had filed a complaint against the university… ITALY · ·Art. 2, 5, 6 +1 Apr 27, 2023
€176,000 Roma Capitale: Non-compliance with general data processing principles The Italian DPA imposed a fine of EUR 176,000 on Roma Capitale. The city had provided data of women who had abortions to the company in charge of the funeral, which included the… ITALY · ·Art. 2, 5, 9 +3 Apr 27, 2023
€1,000 Website operator: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 1,000 on a website operator for failing to ensure that the privacy policy on its website complied with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 Apr 26, 2023
€17,600 Skåne region: Insufficient technical and organisational measures to ensure information security The Swedish DPA has fined Skåne region EUR 17,600. An employee of the region had lost an unencrypted USB stick containing the social security numbers and sensitive personal data… SWEDEN ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Apr 26, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which also recorded a neighbor property. The DPA… SPAIN · ·Art. 5 Apr 25, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Apr 25, 2023
€70,000 Telefónica Móviles España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Telefónica Móviles España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of… SPAIN · ·Art. 6 Apr 24, 2023
€1,000 Tensa Art Design SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Tensa Art Design SA. The controller failed to comply with a data subject's right to object. ROMANIA · ·Art. 12 Apr 24, 2023
€25,000 SECURITAS DIREC ESPAÑA, S.A.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 25,000 on SECURITAS DIREC ESPAÑA, S.A. for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 Apr 21, 2023
€5,400 Disciplinary officer: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 5,400 on a disciplinary officer of the Polish Bar Association after an unencrypted USB stick containing personal data was lost. POLAND · ·Art. 5, 25, 32 Apr 20, 2023
€25,000 KFC RESTAURANTS SPAIN, S.L.: Insufficient involvement of data protection officer The Spanish DPA has fined KFC RESTAURANTS SPAIN, S.L EUR 25,000. During its investigation, the DPA found that the controller had failed to appoint a data protection officer. In… ·Art. 13, 37 ·Insufficient involvement of data protection officer Apr 20, 2023
€20,000 Company: Non-compliance with general data processing principles The Lithuanian DPA has fined a company EUR 20,000. The company had suffered a data breach in which personal data of 50,000 data subjects were compromised. During its… LITHUANIA · ·Art. 5, 32 Apr 20, 2023
€3,000 Partidul Uniunea Salvați România: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 3,000 on the party 'Partidul Uniunea Salvați România'. The controller had published personal data of persons with different degrees of… ROMANIA · ·Art. 5, 6 Apr 19, 2023
€600 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 600 on a legal person. The order was issued based on the carried out inspection. The accused did not provide information on its website… CZECH REPUBLIC · ·Art. 12 Apr 17, 2023
€15,000 Citynews S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Citynews S.p.A. EUR 15,000. The controller had published an article in a newspaper reporting on the arrest of an individual, including health data of the… ITALY · ·Art. 5, 9 Apr 14, 2023
€237,800 Green Network S.p.A.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 237,800 against Green Network S.p.A.. The DPA had received several complaints from data subjects regarding unauthorized telemarketing.… ITALY · ·Art. 5, 25 Apr 14, 2023
€676,956 Sorgenia S.p.a.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 676,956 against Sorgenia S.p.a.. The DPA had received several complaints from data subjects regarding unauthorized telemarketing. During… ITALY · ·Art. 5, 12, 25 Apr 14, 2023
€200,000 Mas s.r.l.s.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 200,000 on Mas s.r.l.s.. During its investigation, the DPA found that the controller had acquired illegally created lists containing… ITALY · ·Art. 5, 6, 7 +4 Apr 13, 2023
€13,000 Azienda socio sanitaria locale n. 3 di Nuoro: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 13,000 on Azienda socio sanitaria locale n. 3 di Nuoro. An individual had filed a complaint with the DPA because the health authority had… ITALY · ·Art. 2, 5, 6 +1 Apr 13, 2023
€500,000 Mas s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 500,000 on Mas s.r.l.. As part of its investigation, the DPA found that the controller had acquired illegally created lists containing… ITALY · ·Art. 5, 6, 7 +4 Apr 13, 2023
€3,000 Comune di Cogollo del Cengio: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Cogollo del Cengio. A former employee had filed a complaint with the DPA due to the fact, that the municipality had… ITALY · ·Art. 2, 5, 6 +1 Apr 13, 2023
€112,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Apr 13, 2023
€7.6M TIM S.p.A.: Insufficient legal basis for data processing The Italian DPA has fined TIM S.p.A. EUR 7,631,175. The DPA had received numerous complaints about the telecommunications provider, mainly for unauthorized telemarketing… ITALY · ·Art. 5, 6, 7 +5 Apr 13, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public… SPAIN · ·Art. 5 Apr 13, 2023
€253,000 Aldi: Non-compliance with general data processing principles The Hungarian DPA imposed a fine of EUR 253,000 on the supermarket chain Aldi. Aldi had entered and stored the date of birth of many customers in the checkout system when… HUNGARY · ·Non-compliance with general data processing principles Apr 12, 2023
€3,000 REGENCY COMPANY SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 3,000 on REGENCY COMPANY SRL. The controller had installed video surveillance cameras in its premises for the purpose of monitoring… ROMANIA · ·Art. 5, 6 Apr 7, 2023
€770 Secretary of the Central Election Commission Konstantin Ninov: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 770 on Konstantin Ninov, a secretary of the central election commission. The controller forwarded personal data, including voter lists,… BULGARIA · ·Art. 6 Apr 6, 2023
€300 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a private individual EUR 300 for failing to provide sufficient information about a video surveillance system installed at their property. SPAIN · ·Art. 13 Apr 5, 2023
€15M TikTok: Non-compliance with general data processing principles The UK DPA (ICO) has fined TikTok EUR 14.5 million. The ICO had found that more than one million British children under the age of 13 were using TikTok without the consent of… UNITED KINGDOM · ·Art. 5, 12, 13 Apr 4, 2023
€18,000 ENFOKA SISTEMAS GLOBALES, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on ENFOKA SISTEMAS GLOBALES, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller carried out a change of… SPAIN · ·Art. 6 Apr 4, 2023
€3,000 Tensa Art Design SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 3,000 on Tensa Art Design SRL. An individual had filed a complaint for receiving promotional messages despite having filed an objection… ROMANIA · ·Art. 21 Apr 4, 2023