Content type · 3,594 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€42,000 PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA. An individual had filed a complaint with the DPA because the controller had disclosed… SPAIN · ·Art. 5, 32 Jun 1, 2023
€10,000 Camedi s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Camedi s.r.l. Medical Center. A person had filed a complaint with the DPA because they had received invoices as well as… ITALY · ·Art. 5, 9, 32 Jun 1, 2023
€15,000 Thin Srl: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 15,000 on Thin Srl. The authority took action following a complaint from a GP who alleged that the company had breached data protection… ITALY · ·Art. 5, 9, 13 Jun 1, 2023
€2,300 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 2,300 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 May 31, 2023
€10,600 Company: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 10,600 on a company. The company had suffered a ransomware attack on their systems which resulted in the loss of personal data. During its… POLAND · ·Art. 5, 25, 32 +2 May 31, 2023
€300,000 Deutsche Kreditbank: Insufficient fulfilment of data subjects rights The DPA of Berlin has imposed a fine of EUR 300,000 on Deutsche Kreditbank. A customer had filed a complaint with the DPA. The customer had submitted an application for a credit… GERMANY ·Art. 5, 15, 22 ·Insufficient fulfilment of data subjects rights May 31, 2023
€500 Website operator: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 5,000 on a website operator for failing to ensure that the privacy policy on its website complied with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 May 31, 2023
€300 CBHNOS S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CBHNOS S.L.. The controller had installed video surveillance cameras which, among other things, also covered a public road. The DPA… SPAIN · ·Art. 5 May 29, 2023
€180 CARROZADOS TECAI, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on CARROZADOS TECAI, S.L.. The controller had installed a video surveillance system but had not added all the required information on the… SPAIN · ·Art. 13 May 29, 2023
€150,000 NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ
Α.Ε.,: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 150,000 on NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ. Α.Ε., imposed a fine of EUR 150,000. A customer had filed a complaint with the… GREECE · ·Art. 12, 15, 21 +1 May 29, 2023
€600 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 600 on a private individual for failing to comply with an order issued by the DPA. SPAIN · ·Art. 58 May 25, 2023
€480 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed a video surveillance camera which also covered the public space and a neighbour property.… SPAIN · ·Art. 5, 13 May 25, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 10,000 for publishing a picture and address of another person on a website without their consent. SPAIN · ·Art. 6 May 24, 2023
€3,000 NORDETIA CLINICS IBERIA, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined NORDETIA CLINICS IBERIA, S.L. EUR 3,000 for failing to provide information requested by the DPA during an investigation. SPAIN · ·Art. 58 May 24, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing May 23, 2023
€1,000 Global Baby Brand SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on Global Baby Brand SRL. A person had filed a complaint with the DPA alleging that the controller had sent commercial SMS… ROMANIA · ·Art. 7 May 23, 2023
€18,000 AUTOMOBILE BAVARIA SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 18,000 on AUTOMOBILE BAVARIA SRL. The data controller had notified the authority of a data breach pursuant to Art. 33 GDPR. Unknown… ROMANIA · ·Art. 25, 32 May 18, 2023
€380,000 Sports betting operator: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 380,000 on a sports betting operator. AZOP had received a complaint from a data subject, stating that the controller had obtained… CROATIA · ·Art. 6, 13, 25 +1 May 18, 2023
€60,000 Website operator: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 60,000 on a website operator. The controller had published unauthorized personal data on the website www.trovanumeri.com, which it had… ITALY · ·Art. 5, 6, 12 +6 May 17, 2023
€10,000 La Gazzetta di Parma S.r.l.: Non-compliance with general data processing principles The Italian DPA has fined La Gazzetta di Parma S.r.l. EUR 10,000. The controller had published photos in its newspaper of an individual accused of murder. The photos showed the… ITALY · ·Art. 5 May 17, 2023
€50,000 FUSIONA SOLUCIONES ENERGÉTICAS, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 50,000 on FUSIONA SOLUCIONES ENERGÉTICAS, S.A.. The controller had submitted data from the data subject to a credit information system… SPAIN · ·Art. 6 May 17, 2023
€10,000 Grizzaffi Management Srl: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 10,000 on Grizzaffi Management Srl for sending out marketing messages, despite the fact that the data subjects had exercised their right… ITALY · ·Art. 5, 17, 21 May 17, 2023
€40,000 Volkswagen Leasing GmbH: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on Volkswagen Leasing. A customer had filed a complaint with the DPA because the controller had not provided them with information… ITALY · ·Art. 12, 15 May 17, 2023
€10,000 Azienda ULSS 6 Euganea: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 10,000 on Azienda ULSS 6 Euganea. The controller had mistakenly sent documents containing personal data to the wrong patients. The DPA… ITALY · ·Art. 5, 6, 32 May 17, 2023
€10,000 Santander Consumer Bank S.p.a.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Santander Consumer Bank S.p.a. EUR 10,000 for not sufficiently fulfilling its obligation to comply with a data subject's request for access to their data. ITALY · ·Art. 12 May 17, 2023
€900 WILLOUGHBY COLLEGE, S.A: Insufficient cooperation with supervisory authority The Spanish DPA has fined WILLOUGHBY COLLEGE, S.A. for failing to provide information requested by the DPA during an investigation. The original fine of EUR 1,500 was reduced to… SPAIN · ·Art. 58 May 17, 2023
€6,700 Municipality: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 6,700 on a municipality. The controller had reported a data breach to the DPA. During its investigation, the DPA found that the controller… POLAND · ·Art. 5, 24, 25 +1 May 16, 2023
€5,000 Compania Națională Poșta Română S.A.: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 5,000 on the Romanian Post (Compania Națională Poșta Română S.A.). During its investigation, the DPA found that the controller had… ROMANIA · ·Art. 5, 6 May 16, 2023
€1,200M Meta Platforms Ireland Limited: Insufficient legal basis for data processing The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 1.2 billion. This is the highest fine imposed to date under the GDPR. In its decision, the DPC found that Meta had… ·Art. 46 May 12, 2023
€1,000 NN Asigurări de Viață S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,00 on the insurance company NN Asigurări de Viață S.A.. The controller had notified the authority of a data breach pursuant to Art. 33… ROMANIA · ·Art. 32 May 12, 2023
€1,500 NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,500 on the insurance company NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.. The controller had… ROMANIA · ·Art. 32 May 12, 2023
€11,000 Libra Internet Bank SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 11,000 on Libra Internet Bank SA. An individual had filed a complaint against the bank due to the bank's failure to fully comply with… ROMANIA · ·Art. 12, 15 May 11, 2023
€5.2M Clearview AI: Insufficient cooperation with supervisory authority The French DPA has fined Clearview AI EUR 5.2 million. The DPA had imposed a fine of EUR 20 million on the company in 2022 for unlawfully collecting personal data. In addition to… FRANCE · ·Insufficient cooperation with supervisory authority May 10, 2023
€5,000 ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has fined ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U. EUR 5,000. An individual had filed a complaint with the DPA because employees of the controller had visted their… SPAIN · ·Art. 6 May 9, 2023
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space and a… SPAIN · ·Art. 5 May 9, 2023
€2,200 Municipality: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 2,200 on a municipality. The controller had reported a data breach to the DPA. An employee had unauthorizedly copied a document containing… POLAND · ·Art. 5, 25, 32 May 5, 2023
€2,000 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on a homeowners' association. An owner had filed a complaint with the DPA due to the fact that members of the association had… SPAIN · ·Art. 5 May 5, 2023
€1,200 FUNDACIÓ PRIVADA UNIVERSITARIA EADA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on FUNDACIÓ PRIVADA UNIVERSITARIA EADA. An individual who had participated in a training event filed a complaint against the educational… SPAIN · ·Art. 6 May 5, 2023
€3,810 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 3,810 on a legal person. The accused unlawfully processed the personal data of an unspecified number of creditors to purchase their claims… CZECH REPUBLIC · ·Art. 6, 14 May 4, 2023
€2.3M Debt collection agency: Insufficient technical and organisational measures to ensure information security The Croatian DPA (AZOP) has imposed a fine of EUR 2,265,000 on a debt collection agency. The fine is the highest ever imposed by AZOP. AZOP had received an anonymous complaint in… CROATIA · ·Art. 6, 13, 28 +1 May 4, 2023
€200,000 GSMA LTD.: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine of EUR 200,000 against GSMA LTD.. An individual had filed a complaint with the DPA because they had to transfer special categories of personal… SPAIN · ·Art. 35 May 3, 2023
€5,000 BANQUETES SANTA ANA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on BANQUETES SANTA ANA, S.L.. The controller had asked a couple celebrating their wedding at its premises to provide the personal… SPAIN · ·Art. 5 May 3, 2023
€9,000 NAGA Markets Europe Ltd: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 9,000 on NAGA Markets Europe Ltd. The controller had suffered a data breach in which an unknown person accessed the company's database,… CYPRUS · ·Art. 5, 32 May 2, 2023
€5,000 INFINITY ECOM S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 5,000 on INFINITY ECOM S.L. for failing to ensure that the privacy policy on its website complied with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 Apr 28, 2023
€2,000 ASSOCIACIO DE CAÇADORS D'ALZIRA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on ASSOCIACIO DE CAÇADORS D'ALZIRA. A member of the association had filed a complaint with the DPA because the chairman had… SPAIN · ·Art. 5 Apr 28, 2023
€12,000 ALBERO FORTE COMPOSITE, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine on ALBERO FORTE COMPOSITE, S.L.. The company had taken pictures of employees at the entrance for the purpose of recording their working… SPAIN · ·Art. 35 Apr 28, 2023
€4,000 Università degli studi di Cassino e del Lazio Meridionale: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR on Università degli studi di Cassino e del Lazio Meridionale. A professor at the university had filed a complaint against the university… ITALY · ·Art. 2, 5, 6 +1 Apr 27, 2023
€2,000 Store owner: Insufficient fulfilment of information obligations The Italian DPA has fined a store owner EUR 2,000 for failing to provide sufficient information pursuant to Art. 13 GDPR about CCTV surveillance in their premises. ITALY · ·Art. 5, 13 Apr 27, 2023
€239,000 Ama S.p.a.: Insufficient legal basis for data processing The Italian DPA imposed a fine of EUR 239,000 on Ama S.p.a.. Ama is in charge of the administration of certain cemeteries in Rome. The city of Rome had provided data of women who… ITALY · ·Art. 2, 28, 29 +1 Apr 27, 2023
€240,000 Benetton Group S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 240,000 on Benetton Group S.r.l.. The controller had stored a large amount of customer data indefinitely. The DPA also found that the… ITALY · ·Art. 5, 32 Apr 27, 2023