Content type · 2,663 documents in this view · 3,873 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3649 Processing 2663 Personal Data 2442 Controllers 2048 Processing Agreement 1116 Security 1027 Supervision 881 Healthcare 624 Public Authority 579 Law Enforcement 577 Monitoring 556 Consent 513
€700,000 Orange Espagne S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined Orange Espagne S.A.U. EUR 700,000. Two Orange Espagne customers had filed complaints with the DPA. In the course of its investigation, the DPA found that… SPAIN · ·Art. 5 Feb 1, 2022
€1,000 SC Grupex 2000 SRL: Insufficient legal basis for data processing The Romanian DPA (ANSPDCP) has fined SC Grupex 2000 SRL EUR 1,000. The controller unlawfully uploaded videos of patients on its website. ROMANIA · ·Art. 6, 9 Feb 1, 2022
€900,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has fined TELEFÓNICA MÓVILES ESPAÑA, S.A.U. EUR 900,000. Four Telefónica customers had filed complaints with the DPA. In the course of its investigation, the DPA… SPAIN · ·Art. 5 Feb 1, 2022
€70,000 ORANGE ESPAÑA VIRTUAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined ORANGE ESPAÑA VIRTUAL, S.L. EUR 70,000. Two Orange España Virtual customers had filed complaints with the DPA. In the course of its investigation, the… SPAIN · ·Art. 5 Feb 1, 2022
€5,000 Cyrana España General S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Cyrana España General S.L. EUR 5,000. The controller had sent an invoice to the data subject although no contractual relationship existed. SPAIN · ·Art. 6 Jan 31, 2022
€5,000 INCOPROSOL, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined INCOPROSOL, S.L. EUR 5,000. The controller had recorded a telephone conversation with a customer without obtaining the customer's consent. SPAIN · ·Art. 5 Jan 31, 2022
€1,500 Property Owner Community: Insufficient legal basis for data processing Use of CCTV cameras in building complex without obtaining the consent of all the property owners. SPAIN · ·Art. 6 Jan 31, 2022
€1,200 Researcher: Non-compliance with general data processing principles The Belgian DPA has fined a researcher EUR 1,200. The fine was issued in connection with another fine against the NGO EU DisinfoLab. The researcher was employed at the NGO. In… BELGIUM · ·Art. 5, 6, 9 +3 Jan 27, 2022
€40,000 T.S.M. s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on T.S.M. s.r.l.. A data subject had filed a complaint with the DPA against the company for failing to comply with their requests… ITALY · ·Art. 13, 15, 21 +2 Jan 27, 2022
€6M Cosmote Mobile Telecommunications S.A.: Insufficient technical and organisational measures to ensure information security The Hellenic DPA has imposed a fine of EUR 6 million on Cosmote Mobile Telecommunications S.A.. Cosmote had reported a data breach to the DPA pursuant to Art. 33 GDPR. A hacker… GREECE · ·Art. 5, 13, 14 +4 Jan 27, 2022
€2,000 Private club 'Ruian': Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 2,000 on the private club 'Ruian'. The controller had installed video surveillance cameras which, among other things, also… ITALY · ·Art. 5, 13 Jan 27, 2022
€2,800 EU DisinfoLab: Non-compliance with general data processing principles The Belgian DPA has fined the NGO EU DisinfoLab EUR 2,700. In 2018, the NGO published an analysis to identify the possible political origin of tweets circulating on a particularly… BELGIUM · ·Art. 5, 6, 9 +5 Jan 27, 2022
€1,200 Property Owner Community: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a property owners' community EUR 1,200. A property manager had sent a copy of the general meeting minutes to the director of the security company… SPAIN · ·Art. 5 Jan 21, 2022
APD/GBA · 11/2022 The respondent owns a website 'YourOnlineChoices', through which data subjects can control their ad experience online. When browsing the web and visiting different websites, they… 11/2022 ·Belgium ·Art. 4, 5, 7 +2 Jan 21, 2022
€3,000 Kaufland România SCS: Insufficient fulfilment of data subjects rights The Romanian DPA (ANSPDCP) has imposed a fine of EUR 3,000 on Kaufland Romania SCS. The DPA initiated an investigation based on a complaint from an individual stating that the… ROMANIA · ·Art. 15 Jan 20, 2022
€1M Fortum Marketing and Sales Polska S.A.: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 1 million on Fortum Marketing and Sales Polska S.A.. The company had reported a data breach to the DPA in accordance with Art. 33 GDPR.… POLAND · ·Art. 5, 24, 25 +2 Jan 19, 2022
€15,000 GARLEX SOLUTIONS, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 15,000 on GARLEX SOLUTIONS, S.L.. The data subject had received a call from the company to renew their electricity supply… SPAIN · ·Art. 6 Jan 18, 2022
€56,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on VODAFONE ESPAÑA, S.A.U. due to insufficient legal basis for data processing. The data subject states that two telephone connections were… SPAIN · ·Art. 6 Jan 18, 2022
€65,000 C-Planet (IT Solutions) Limited: Insufficient technical and organisational measures to ensure information security The DPA of Malta has imposed a fine of EUR 65,000 on C-Planet (IT Solutions) Limited. The DPA had initiated an investigation against C-Planet in April 2020 after being informed of… MALTA ·Art. 5, 6, 9 +4 ·Insufficient technical and organisational measures to ensure information security Jan 17, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on a private individual. The person had installed video cameras in the apartment building where he lives, which recorded, among… SPAIN · ·Art. 5 Jan 17, 2022
€2,000 MEETING PUERTO C.B.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on MEETING PUERTO C.B.. The data controller had unlawfully published a picture of the complainant with his partner on Facebook and… SPAIN · ·Art. 6 Jan 17, 2022
€525,000 DPG Media Magazines B.V.: Insufficient fulfilment of data subjects rights The Dutch DPA has imposed a fine of EUR 525,000 on DPG Media Magazines B.V. The DPA had received several complaints regarding the way the controller handled requests from… THE NETHERLANDS · ·Art. 12 Jan 14, 2022
€1,500 Private individual: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour. SPAIN · ·Art. 5 Jan 14, 2022
€7,500 Azienda Sanitaria Locale Frosinone: Insufficient fulfilment of information obligations The Italian DPA has fined Azienda Sanitaria Locale Frosinone EUR 7,500. In the course of its investigation against the medical facility, the Garante found that their privacy… ITALY · ·Art. 5, 12, 13 Jan 13, 2022
€1,000 A.S.L. Napoli 1 Centro: Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 1,000 on A.S.L. Napoli 1 Centro. An employee at the health authority had filed a complaint with the DPA against the… ITALY · ·Art. 2, 5, 6 Jan 13, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jan 13, 2022
€9,000 EDUCANDO JUNTOS SL: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 9,000 on EDUCANDO JUNTOS SL. The controller had published photos of an employee on some of its channels on social networks and its… SPAIN · ·Art. 6, 17 Jan 11, 2022
€3,000 Property Owner Community: Non-compliance with general data processing principles Usage of CCTV camera which also captured the public roads outside in a violation of the so called principle of data minimisation. SPAIN · ·Art. 5 Jan 11, 2022
EDPS: European Parliament is sole controller for COVID testing website and failed In January 2021, noyb filed a complaint against the European Parliament on behalf of six Members of the European Parliament over an internal coronavirus testing website. The… 2020-1013 ·European Union ·Art. 6, 13 Jan 5, 2022
€3,400 Company: Insufficient legal basis for data processing The Czech DPA imposed a fine of EUR 3,400 on a company. The data subject had concluded an energy supply contract with the controller in the past, but then duly terminated it.… CZECH REPUBLIC · ·Insufficient legal basis for data processing Jan 1, 2022
GERMANY DPA: Insufficient legal basis for data processing Nine fines between EUR 200 and EUR 1000 for unlawful use of a dashcam. Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
Private individual: Insufficient legal basis for data processing The DPA of Bremen imposed a fine on a private individual. The individual who worked in a restaurant, had contacted a restaurant visitor privately using the contact information… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
Medical care center: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a medical care center for having scanned a customer's ID card against their will and stored the copy. Once the customer complained, they… GERMANY ·Insufficient legal basis for data processing Jan 1, 2022
€2,700 Credit institution: Insufficient legal basis for data processing The Hungarian DPA has imposed a fine of EUR 2,700 on a credit institution. Several individuals had filed a complaint with the DPA due to the fact that the controller had… HUNGARY · ·Art. 5, 6 Jan 1, 2022
Private individual: Insufficient legal basis for data processing The DPA of Berlin imposed a fine on a private individual. The individual, who worked in a store, had contacted a customer privately using the contact information they had… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
Aid organization: Insufficient technical and organisational measures to ensure information security The DPA of Brandenburg has imposed a five-figure fine on an aid organization. The aid organization provides transportation for people with illnesses. The organization had reported… GERMANY ·Art. 28, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2022
Job center employee: Insufficient legal basis for data processing A job center employee had accessed data in the job center database systems for private research purposes GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
Restaurant operator: Insufficient legal basis for data processing The DPA of Berlin has imposed a fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their personal data… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
Company: Insufficient fulfilment of information obligations The DPA of Bremen has imposed a three-digit fine on a company. The company offered its applicants an online application procedure on its website without informing users about the… GERMANY ·Art. 12, 13 ·Insufficient fulfilment of information obligations Jan 1, 2022
€1,400 Dentist: Non-compliance with general data processing principles The Hungarian DPA has fined a dentist EUR 1,300. The controller had installed several surveillance cameras in their practice, which permanently recorded employees and patients.… HUNGARY · ·Non-compliance with general data processing principles Jan 1, 2022
Data protection officer: Insufficient legal basis for data processing The DPA of Thüringen has imposed a three-digit fine on the data protection officer of a company. The controller had posted a photo in a WhatsApp group of the company which showed… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
Bank: Insufficient technical and organisational measures to ensure information security The DPA of Brandenburg has imposed a five-digit fine on a bank. The bank had installed a video surveillance system that covered parts of the foyer of the branch with ATMs, the… GERMANY ·Art. 28, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2022
Physician: Insufficient legal basis for data processing The DPA of Bremen imposed a fine on a physician for using a patient's contact details to contact them privately without their consent. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
GERMANY DPA: Insufficient legal basis for data processing The DPA of Thüringen has imposed a fine on a controller. The controller had installed a video surveillance camera in the public entrance area of an apartment building without a… Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
€1,400 Covid-19 test center: Insufficient legal basis for data processing The DPA from Hamburg has imposed a fine of EUR 1,400 on a Covid-19 test center. The controller intended to fulfill its statutory documentation obligations and scanned the front… GERMANY · ·Art. 6 Jan 1, 2022
€1,800 Covid-19 test center: Non-compliance with general data processing principles The DPA of Hessen imposed a fine of EUR 1,800 on a Covid-19 test center. An employee had taken an adhesive label from the trash, written the test center's e-mail address on it and… GERMANY ·Art. 5, 6 ·Non-compliance with general data processing principles Jan 1, 2022
Supermarket: Insufficient legal basis for data processing The DPA of Bremen has imposed a fine on a supermarket. A store detective had taken a photo of the data subject on the occasion of an alleged theft and transmitted it via the… GERMANY ·Insufficient legal basis for data processing Jan 1, 2022
€500 Private individual: Insufficient legal basis for data processing The DPA of Niedersachsen imposed a fine of EUR 5,00 on a private individual. The individual had taken pictures of numerous young women in public. In the course of its… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
Physician: Insufficient legal basis for data processing The DPA of Bremen imposed a fine on a physician for transmitting patient's data to a billing office without their consent. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
Private individual: Insufficient legal basis for data processing The DPA of Bremen imposed a fine on a private individual. The individual, who worked at a Covid19 testing center, had contacted a patient privately using the contact details the… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022