Content type · 2,663 documents in this view · 3,873 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3649 Processing 2663 Personal Data 2442 Controllers 2048 Processing Agreement 1116 Security 1027 Supervision 881 Healthcare 624 Public Authority 579 Law Enforcement 577 Monitoring 556 Consent 513
Job center employee: Insufficient legal basis for data processing A job center employee had accessed data in the civil register for private research purposes. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
€800 Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes in order to obtain information about a colleague. GERMANY ·Insufficient legal basis for data processing Jan 1, 2022
Company: Insufficient legal basis for data processing The DPA of Bremen has imposed a five-digit fine on a company. The company had transferred the pay slips of its employees without their consent to another company, which was to… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
Sports photography company: Insufficient legal basis for data processing The DPA of Berlin has imposed a fine on a sports photography company. A sports photographer had published over 16,000 photos of minors who had taken part in a swimming competition… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
€16,400 Covid-19 test center: Insufficient legal basis for data processing The DPA of Hessen has fined a Covid-19 test center EUR 16,400. The controller had sent an e-mail containing personal data to several recipients in an open distribution list. The… GERMANY ·Art. 6, 33 ·Insufficient legal basis for data processing Jan 1, 2022
Company: Insufficient legal basis for data processing The Latvian DPA has fined a company for issuing loyalty cards to customers without a valid legal basis. LATVIA · ·Art. 5, 6 Jan 1, 2022
€65,000 MALTA DPA: Non-compliance with general data processing principles The controller has violated numerous GDPR regulations, involving special categories of personal data of numerous individuals. Art. 5, 6, 9 +3 ·Non-compliance with general data processing principles Jan 1, 2022
Restaurant operator: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a five-figure fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
€5,000 Trucking company: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 5,000 on a trucking company. The controller had disclosed personal data of a former employee to third parties without a valid legal… BULGARIA · ·Art. 6 Jan 1, 2022
€7,380 Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes over a period of three years. GERMANY ·Insufficient legal basis for data processing Jan 1, 2022
Operator of a swimming pool: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a five-digit fine on the operator of an outdoor swimming pool. The controller had processed more visitor data than legally required for contact… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
€300 Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes in order to obtain information about their ex-partner's new partner. GERMANY ·Insufficient legal basis for data processing Jan 1, 2022
€80,700 Beauty salon: Insufficient legal basis for data processing The Hungarian DPA has imposed a fine of EUR 80,700 on a beauty salon. The controller had installed video cameras in all its premises, which permanently recorded customers and… HUNGARY · ·Insufficient legal basis for data processing Jan 1, 2022
€3,500 Universal Life Insurance Public Co Ltd.: Insufficient data processing agreement The Cypriot DPA has imposed a fine of EUR 3,500 on Universal Life Insurance Public Co Ltd. The processor of the data controller had suffered a data breach in which personal data… CYPRUS · ·Art. 24, 28 Jan 1, 2022
Physician: Insufficient legal basis for data processing The DPA of Nordrhein-Westfalen has fined a physician. The physician had responded to a negative online reviews regarding their practice, disclosing personal data of a patient. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2022
Company: Insufficient legal basis for data processing The DPA of Bremen has imposed a five-digit fine on a company. The company had sent an unredacted social plan to all affected employees in the context of dismissals due to… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022
Debt collection company: Insufficient legal basis for data processing The DPA from Baden-Württemberg has imposed a fine on a debt collection company. The debt collection company had received investor information from an employee of an insolvent… GERMANY ·Art. 6, 14 ·Insufficient legal basis for data processing Jan 1, 2022
Company: Non-compliance with general data processing principles The DPA of Bremen has imposed a five-digit fine on a company. The controller had unlawfully used GPS software in its company vehicles, allowing unrestricted monitoring of its… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2022
€12,800 Political party: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 12,800 on a political party. Several individuals had filed a complaint with the DPA because their personal data had been added to voter… BULGARIA · ·Art. 6 Jan 1, 2022
€6,500 Pharmacy: Non-compliance with general data processing principles The DPA of Baden-Württemberg imposed a fine of EUR 6,500 on a pharmacy. The pharmacy had disposed of a large number of personal documents, including diagnoses and medical… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2022
Private individual: Non-compliance with general data processing principles Unlawful use of a dashcam GERMANY · ·Art. 5, 6 Jan 1, 2022
€60M Facebook Ireland Ltd.: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 60,000,000 on Facebook Ireland Ltd. The CNIL received several complaints regarding the manner in which cookies… FRANCE · ·Art. 82 Dec 31, 2021
€150M Google LLC is a subsidiary owned wholly by Alphabet Inc Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and Switzerland. In March 2020 the French DPA (CNIL) carried out… SAN-2021-023 ·France · Dec 31, 2021
€60M Google Ireland Ltd.: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 60,000,000 on Google Ireland Ltd. The CNIL received several complaints regarding the manner in which cookies… FRANCE · ·Art. 82 Dec 31, 2021
€90M Google LLC: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 90,000,000 on GOOGLE LLC. The CNIL received several complaints regarding the manner in which cookies could be… FRANCE · ·Art. 82 Dec 31, 2021
€25,000 PLUS REAL ADVERTISEMENT: Insufficient fulfilment of information obligations The Hellenic DPA has imposed a fine of EUR 25,000 on PLUS REAL ADVERTISEMENT. The controller had conducted advertising calls without the consent of the data subjects. In addition,… GREECE · ·Art. 11, 13, 14 Dec 31, 2021
€30,000 INFO COMMUNICATION SERVICES: Insufficient fulfilment of information obligations The Hellenic DPA has imposed a fine of EUR 30,000 on INFO COMMUNICATION SERVICES. The controller had conducted advertising calls without the consent of the data subjects. In… GREECE · ·Art. 11, 13, 14 Dec 31, 2021
€6,000 REAL CLUB NÁUTICO DE RIBADEO: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on REAL CLUB NÁUTICO DE RIBADEO. The controller had uploaded links to court decisions containing personal data of the data… SPAIN · ·Art. 6 Dec 28, 2021
€2,000 Call shop manager: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on the manager of a call shop. In the context of a job vacancy, the manager had set up a stand where applicants could submit their… SPAIN · ·Art. 13 Dec 28, 2021
€5,000 Medical clinic: Insufficient fulfilment of information obligations The Finnish DPA has fined a medical clinic EUR 5,000. A customer of the clinic had complained to the DPA that he had not received access to his medical records from the clinic… FINLAND · ·Art. 5, 12, 13 +2 Dec 26, 2021
€1,500 LA OFICINA BAR: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined LA OFICINA BAR. The bar operated a video surveillance system in which the observation angle of the cameras extended into the public traffic area. The… SPAIN · ·Art. 5 Dec 23, 2021
€5,000 HUBSIDE IBÉRICA S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 HUBSIDE IBÉRICA S.L.. A data subject had filed a complaint with the DPA against the controller for charging her several… SPAIN · ·Art. 6 Dec 22, 2021
€5,000 Sfam España General s.l.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on Sfam España General s.l.. A data subject had filed a complaint with the DPA against the controller for charging her… SPAIN · ·Art. 6 Dec 22, 2021
€1.3M Lisbon City Council: Insufficient legal basis for data processing The Portuguese DPA has imposed a fine of EUR 1.25 million on the Lisbon City Council. The fine is the sum of 225 fines from various violations committed by the municipality since… PORTUGAL · ·Art. 5, 6, 9 +2 Dec 21, 2021
€6,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 6,000 on a private individual. The person had shared a video on Twitter showing images of a sexual assault by a man on a woman. The… SPAIN · ·Art. 6 Dec 21, 2021
€2,000 FUNDACION ESPANOLA DE MEDICINA ESTETICA Y LONGEVIDAD: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on FUNDACION ESPANOLA DE MEDICINA ESTETICA Y LONGEVIDAD. The DPA criticized that the data protection notice of the controller did… SPAIN · ·Art. 7, 13 Dec 21, 2021
€2,000 Online retailer: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on an online retailer. The data subject bought a product from the controller's online store via eBay and paid with Paypal. However,… SPAIN · ·Art. 6 Dec 17, 2021
€2,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 2,000. The data controller had installed video cameras in such a way that they could record images of the public space and… SPAIN · ·Art. 5 Dec 17, 2021
€10,000 ASL Latina: Insufficient legal basis for data processing The Italian DPA (Garante) fined ASL Latina EUR 10,000. The controller had mistakenly sent documents containing health data of the data subject to an uninvolved third party. ITALY · ·Art. 5, 6, 9 Dec 17, 2021
€4,000 CLUB DEPORTIVO RITMO DE ANDALUCÍA: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on CLUB DEPORTIVO RITMO DE ANDALUCÍA. The DPA criticized that the data protection notice of the controller did not comply with the… SPAIN · ·Art. 7, 13 Dec 17, 2021
€6,500 Travel agency: Insufficient technical and organisational measures to ensure information security The Finnish DPA has imposed a fine of EUR 6,500 on a travel agency. A customer of the travel agency informed the DPA to suspect that the company might not process the data of its… FINLAND · ·Art. 5, 17, 25 +1 Dec 16, 2021
Enel Energia S.p.A: Insufficient legal basis for data processing Originial fine summary: The Italian DPA has fined Enel Energia S.p.A EUR 26.5 million for numerous breaches of the GDPR. Following a complex preliminary investigation launched… ITALY · ·Art. 5, 6, 12 +7 Dec 16, 2021
€100,000 Ubi Banca spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Ubi Banca spa (now Intesa Sanpaolo spa). A data subject had filed a complaint with the DPA for receiving a letter from the… ITALY · ·Art. 5 Dec 16, 2021
€52,000 Motor insurance center: Non-compliance with general data processing principles The Finnish DPA has fined a motor insurance center EUR 52,000. The controller had excessively requested patient data from within the healthcare system for the purpose of… FINLAND · ·Art. 5, 25 Dec 16, 2021
€1,000 Università Telematica Internazionale Uninettuno: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1,000 on Università Telematica Internazionale Uninettuno. A professor had filed a complaint with the DPA against the educational… ITALY · ·Art. 5 Dec 16, 2021
€60,000 Banco Bilbao Vizcaya Argentaria S.A.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Banco Bilbao Vizcaya Argentaria S.A.. A data subject filed a complaint with the DPA due to the fact that the controller repeatedly… SPAIN · ·Art. 6 Dec 16, 2021
€20,000 Corradi s.r.l.: Non-compliance with general data processing principles The company had left the e-mail account of the data subject active even after the termination of his employment and had automatically forwarded incoming e-mails. The company did… ITALY · ·Art. 5, 13, 157 Dec 16, 2021
€50,000 IZA OBRAS Y PROMOCIONES, S.A.: Non-compliance with general data processing principles The Spanish DPA has fined IZA OBRAS Y PROMOCIONES, S.A. EUR 50,000. An employee had filed a complaint with the DPA against the company, alleging that the controller had… SPAIN · ·Art. 5 Dec 14, 2021
€6.3M Grindr LLC: Insufficient legal basis for data processing The Norwegian DPA has fined Grindr LLC EUR 6.3 million. Grindr is a location-based social networking app designed for gay, bi, trans and queer people. In 2020, the Norwegian… NORWAY · ·Art. 6, 9 Dec 13, 2021
€2,000 SC Nobiotic Pharma SRL: Insufficient cooperation with supervisory authority Failure to provide requested information to the Romanian DPA within the required timeframe in violation of Art. 58 GDPR. ROMANIA · ·Art. 58 Dec 13, 2021