Content type · 3,594 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€300 COMANDANCIA DE LLEIDA: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 300 on COMANDANCIA DE LLEIDA. The controller had failed to provide a notice with information about video surveillance in its premises. SPAIN · ·Art. 13 Feb 21, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded a neighbor… SPAIN · ·Art. 5 Feb 21, 2023
€180 SUPER 24H LOS ROSALES, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on SUPER 24H LOS ROSALES, S.L.. The controller had failed to provide a notice with information about video surveillance in its premises. The… SPAIN · ·Art. 13 Feb 21, 2023
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,500 on a private individual. The controller sent an e-mail with personal data to several recipients in an open distribution list. This… SPAIN · ·Art. 5, 32 Feb 21, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Feb 21, 2023
€300 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a private individual EUR 300 for failing to provide sufficient information about a video surveillance system installed at their property. SPAIN · ·Art. 13 Feb 21, 2023
€300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on a private individual. The individual had shared a document containing personal data of the data subject in a WhatsApp group without the data… SPAIN · ·Art. 6 Feb 21, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded the public… SPAIN · ·Art. 5 Feb 21, 2023
€300 PLANET COSTA DORADA SOCIEDAD LIMITADA: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 300 on PLANET COSTA DORADA SOCIEDAD LIMITADA. The controller had failed to provide a notice with information about video surveillance at… SPAIN · ·Art. 13 Feb 21, 2023
€40,000 Vodafone: Insufficient fulfilment of data breach notification obligations The Hellenic DPA has imposed a fine of EUR 40,000 on Vodafone. An individual had filed a complaint with the DPA because, following a request for access to records of conversations… GREECE · ·Art. 15, 33 Feb 20, 2023
€440,000 Suomen Asiakastieto Oy: Insufficient cooperation with supervisory authority The Finnish DPA has imposed a fine of EUR 440,000 on Suomen Asiakastieto Oy for failing to comply with an order issued by the DPA. During an investigation, the DPA found that the… FINLAND · ·Art. 58 Feb 17, 2023
€5,100 BULGARIA DPA: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 5,100 on a data controller. An employee of the controller had lodged a complaint with the DPA. The employee had received a ticket for a… ·Art. 5, 6 ·Non-compliance with general data processing principles Feb 9, 2023
€5,000 Medijobs Platform SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Medijobs Platform SRL. The controller had informed the DPA about a data breach according to Art. 33 GDPR. Unauthorized third… ROMANIA · ·Art. 32 Feb 8, 2023
€500 Hiper Store S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 500 on Hiper Store S.L.. The controller had installed a video surveillance system in its premises without sufficiently informing data… SPAIN · ·Art. 13 Feb 8, 2023
€7,200 Company: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 7,200 on a company. The controller had suffered a data breach that resulted in the loss of personal data. During its investigation, the… POLAND · ·Art. 5, 24, 25 +1 Feb 8, 2023
€321 Housing association: Insufficient fulfilment of data breach notification obligations The Polish DPA has imposed a fine of EUR 321 on a housing association. The controller had suffered a data breach involving the theft of documents, including a copy of a notarial… POLAND · ·Art. 5, 28, 33 +1 Feb 7, 2023
€900,000 Sats ASA: Insufficient fulfilment of data subjects rights The Norwegian DPA has imposed a fine of EUR 900,000 on the fitness chain 'Sats'. The DPA had received several complaints from customers who had submitted requests for information… NORWAY · ·Art. 5, 6, 12 +3 Feb 6, 2023
€80,500 I&S Limited Kft: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 80,500 on the spa operator, 'I&S Limited Kft'. During its investigation, the DPA found that the controller had installed video… HUNGARY · ·Art. 5, 6, 9 +3 Feb 6, 2023
€600 HOTEL VILLA SORO, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on HOTEL VILLA SORO, S.L.. The controller had installed a video surveillance system without providing the required information according to Art.… SPAIN · ·Art. 13 Feb 3, 2023
€500 MIRACLE IBIZA S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 500 on MIRACLE IBIZA S.L.. The controller had installed a video surveillance system that captured the front door of an individual's… SPAIN · ·Art. 5 Feb 3, 2023
€3,250 Epic Ltd.: Insufficient legal basis for data processing The Cypriot DPA has imposed a fine of EUR 3,250 on Epic Ltd. The contoller had made unsolicited calls to 332 former customers without a valid legal basis. The DPA also found that… CYPRUS · ·Art. 6, 24, 32 Feb 3, 2023
€30,000 Piraeus Bank: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 30,000 on Piraeus Bank. A customer had filed a complaint with the DPA because the bank had disclosed transaction and account balance… GREECE · ·Art. 5, 33, 34 Feb 2, 2023
€10,000 Vodafone: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on Vodafone. An individual had filed a complaint with the DPA because they had received a package containing promotional gifts… GREECE · ·Art. 5, 6, 13 Feb 2, 2023
€1,000 Tensa Art Design SA: Insufficient fulfilment of data subjects rights The Romanian data protection authority (AEPD) has imposed a fine of EUR 1,000 on Tensa Art Design SA. A data subject had objected to a further newsletter subscription and however… ROMANIA · ·Art. 21 Feb 1, 2023
€1,000 Dentist: Insufficient legal basis for data processing The Romanian DPA has fined a dentist EUR 1,000. The controller had published medical information of a patient, such as photos and X-rays, in an article on a medical blog. However,… ROMANIA · ·Art. 6, 9 Jan 31, 2023
€180 SPAIN DPA: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on a data controller. The data controller had failed to provide a notice with information about video surveillance in its premises. The original… ·Art. 13 ·Insufficient fulfilment of information obligations Jan 31, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 600 on a private individual. The individual had installed a video surveillance camera at their home that recorded, among other things,… SPAIN · ·Art. 5 Jan 31, 2023
€1,000 Dent Estet Clinic SA: Insufficient fulfilment of data breach notification obligations The Romanian DPA has fined Dent Estet Clinic SA (dental practice) EUR 1,000. An employed dentist at the practice had published medical information of a patient, such as photos and… ROMANIA · ·Art. 33 Jan 31, 2023
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jan 31, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded a neighbor… SPAIN · ·Art. 5 Jan 27, 2023
€5,000 Azienda ULSS n.5 Polesana: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 5,000 on Azienda ULSS n.5 Polesana. The healthcare facility had mistakenly sent a patient medical record to the wrong patient. The DPA… ITALY · ·Art. 5, 9, 32 Jan 26, 2023
€12,800 Political Party: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 12,800 on a political party. In preparation for an upcoming election, the controller submitted a list of supporters to the Central… BULGARIA · ·Art. 6 Jan 26, 2023
€5,000 Misterbianco municipality: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 5,000 on Misterbianco municipality. An employee had filed a complaint with the DPA due to the fact, that the municipality had published a… ITALY · ·Art. 2, 5, 6 Jan 26, 2023
€7,000 Azienda Ospedaliera Bianchi Melacrino Morelli: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 7,000 on Azienda Ospedaliera Bianchi Melacrino Morelli. The controller had mistakenly sent a document containing health data of the data… ITALY · ·Art. 5, 32, 75 Jan 26, 2023
€180 SPAIN DPA: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on a data controller. The data controller had failed to provide a notice with information about video surveillance in its premises. The original… ·Art. 13 ·Insufficient fulfilment of information obligations Jan 25, 2023
€4,100 Company: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,100 for failing to provide information requested by the DPA during an investigation. POLAND · ·Art. 31, 58 Jan 25, 2023
€3,000 CASAL DE L'ESPLUGA DE FRANCOLÍ: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on CASAL DE L'ESPLUGA DE FRANCOLÍ. A club managed by the controller had uploaded pictures of a competition showing minors on social media . The… SPAIN · ·Art. 6 Jan 25, 2023
€8,000 Company: Insufficient fulfilment of data subjects rights The Lithuanian DPA has fined a company EUR 8, 000. The controller failed ot properly fulfil the data subject's right to access their personal data processed by the company. The… LITHUANIA · ·Art. 5, 15 Jan 24, 2023
€460,000 Centric Health Ltd.: Non-compliance with general data processing principles The Irish DPA has imposed a fine of EUR 460,000 on Centric Health Ltd.. The controller suffered a ransomware attack in which personal data such as name, date of birth and contact… IRELAND · ·Art. 5, 32 Jan 23, 2023
€360 TECNO MOTOR LA MUELA, S.L.L: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on TECNO MOTOR LA MUELA, S.L.L.. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jan 20, 2023
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things recorded a neighbor… SPAIN · ·Art. 5 Jan 20, 2023
€56,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on BANCO BILBAO VIZCAYA ARGENTARIA, S.A.. An individual had filed a complaint with the DPA because the controller had disclosed their personal… SPAIN · ·Art. 5, 32 Jan 19, 2023
€5.5M WhatsApp Ireland Ltd.: Insufficient legal basis for data processing The Irish DPA (DPC) has fined WhatsApp Ireland Ltd. EUR 5.5 million. The Austrian organization 'None of Your Business' (NOYB) had filed a complaint with the DPA on behalf of an… ·Art. 6, 12, 13 ·Insufficient legal basis for data processing Jan 19, 2023
€6,400 Szczecin-Centrum District Court: Insufficient technical and organisational measures to ensure information security The Polish DPA has imposed a fine of EUR 6,400 on the Szczecin-Centrum District Court. The court had reported a data breach to the DPA involving the loss of three data carriers.… POLAND · ·Art. 5, 24, 25 +1 Jan 19, 2023
€150,000 Dutch Social Insurance Institution (SVB): Insufficient technical and organisational measures to ensure information security The Dutch DPA has imposed a fine of EUR 150,000 on the Dutch Social Insurance Institution (SVB). The controller had suffered a data breach in which a client's data had been leaked… THE NETHERLANDS · ·Art. 32 Jan 19, 2023
€1,000 Dante Internațional SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Dante Internațional SA. A data subject had filed a complaint with the DPA against the controller due to the fact that the… ROMANIA · ·Art. 17 Jan 18, 2023
€2,000 Private investigator: Insufficient fulfilment of information obligations The Spanish DPA has fined a private investigator EUR 2,000. An individual who had hired the investigator filed a complaint with the DPA. They stated that the controller had failed… SPAIN · ·Art. 13 Jan 18, 2023
€17,900 Dalarna Region: Insufficient technical and organisational measures to ensure information security The Swedish DPA has imposed a fine of EUR 17,900 on Dalarna Region. The region had sent out invitations for patient visits where the respective healthcare facility, such as a… SWEDEN · ·Art. 32 Jan 17, 2023
€1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient technical and organisational measures to ensure… BULGARIA · ·Art. 5, 6 Jan 17, 2023
€50,000 DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance This case involves an own-volition investigation conducted by the Irish DPA (DPC) into Kildare County Council, the controller. In June 2018, Officers from the Special… Art. 2, 5, 6 +5 Jan 16, 2023