Content type · 508 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€2,000 SINDICATO LIBRE DE TRANSPORTES: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on SINDICATO LIBRE DE TRANSPORTES. A member of the union had shared the data subject's payslip in a WhatsApp group without the data subject's… SPAIN · ·Art. 5, 32 Nov 3, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual for publishing intimate images of the data subject on YouTube without their consent. SPAIN · ·Art. 6 Oct 28, 2023
€1,000 SC Spark Car Sharing SRL: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 1,000 on SC Spark Car Sharing SRL. An individual had filed a complaint with the DPA because the controller had processed their email… ROMANIA · ·Art. 5, 6, 7 Oct 25, 2023
€600,000 GROUPE CANAL +: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 600,000 on GROUPE CANAL+ for multiple violations of the GDPR. The DPA determined that the data controller failed to demonstrate that it… FRANCE · ·Art. 7, 12, 13 +5 Oct 12, 2023
€70,000 Scionti Selezioni Superiori S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 70,000 on Scionti Selezioni Superiori S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were… ITALY · ·Art. 5, 6, 7 +7 Oct 12, 2023
€5,300 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 5,300 on a private individual. An individual had rented a room from the controller and filed a complaint due to the fact that the… SPAIN · ·Art. 6, 13 Oct 11, 2023
€1,040 Self Employed Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 1,040 on a self employed person. The accused's website did not comply with GDPR requirements for cookies, as it processed data before… CZECH REPUBLIC · ·Art. 5, 13 Sep 26, 2023
€15,000 Hotel: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed of fine of EUR 15,000 to a hotel. The hotel was collecting personal data from guests in excess of what would have been necessary for the… CROATIA · ·Art. 6, 13, 32 +1 Sep 26, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Sep 26, 2023
€12,000 CHATWITH.IO WORLDWIDE, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 12,000 on the website operator CHATWITH.IO WORLDWIDE, S.L. During its investigation, the DPA found that the controller had failed to… SPAIN · ·Art. 5, 13, 22 Sep 23, 2023
€4,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 4,000 on a private individual. An individual had rented a room from the controller and filed a complaint against them due to the fact… SPAIN · ·Art. 6 Sep 21, 2023
€20,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 20,000 on a company engaged in gambling and betting activities due to three identified violations of the GDPR. As noted by AZOP,… CROATIA · ·Art. 6, 7, 13 Sep 14, 2023
€30,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 30,000 on a company engaged in gambling and betting activities due to three identified violations of the GDPR. As noted by AZOP,… CROATIA · ·Art. 6, 7, 13 Sep 14, 2023
€5,000 Nimbus s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Nimbus s.r.l.. The controller had introduced a biometric attendance system at the workplace without adequately informing the… ITALY · ·Art. 5, 9, 13 Sep 14, 2023
€70,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.. A customer had filed a complaint with the DPA due to the fact that the controller… SPAIN · ·Art. 6 Sep 7, 2023
€80,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Sep 5, 2023
€ 2,000M Decision 14-09-2023 The two companies in question, as controllers, made use of cookies on their websites, but failed to inform data subjects visiting their web pages about the legal basis for… Croatia · ·Art. 6, 7, 13 Sep 1, 2023
€1,500 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 1,500 on a private individual. The individual had installed video surveillance cameras in a residential complex, which also covered… SPAIN · ·Art. 6, 13 Aug 30, 2023
€140,000 GENERAL LOGISTICS SYSTEMS SPAIN, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR EUR 140,000 against GENERAL LOGISTICS SYSTEMS SPAIN, S.A.. Two individuals had filed a complaint with the DPA about parcels intended for… ·Art. 6 ·Insufficient legal basis for data processing Aug 30, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The person had published on his Facebook profile a video of another person being clearly drunk without… SPAIN · ·Art. 6 Aug 28, 2023
€6,000 ODRIA COSTAS INTERNACIONAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on ODRIA COSTAS INTERNACIONAL, S.L. A data subject had filed a complaint with the DPA because the controller had published a picture of their… SPAIN · ·Art. 5 Aug 8, 2023
€10,000 GYMOOGIMNASIOS S.L.: Non-compliance with general data processing principles The Spanish DPA has fined GYMOOGIMNASIOS S.L. EUR 10,000. The controller had installed a reservation system where data subjects had to consent to the processing of health-related… SPAIN · ·Art. 5, 7 Aug 2, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Aug 1, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. Fraudulent third parties had pretended to be the data subject and asked the controller to change their phone number… SPAIN · ·Art. 6 Aug 1, 2023
€70,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on TELEFÓNICA MÓVILES ESPAÑA, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of… SPAIN · ·Art. 6 Jul 31, 2023
€5,000 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 5,000 on a private individual. The controller was both employer and landlord of the data subject. The controller had used the bank… SPAIN · ·Art. 5 Jul 27, 2023
€600 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual. An individual had filed a complaint with the DPA because another individual had written reviews on the internet using a photo of… SPAIN · ·Art. 6 Jul 26, 2023
€40,000 Compara Facile S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on Compara Facile S.r.l.. The controller had made unsolicited marketing calls, in some cases to individuals who were registered in… ITALY · ·Art. 5, 6, 7 +8 Jul 18, 2023
€100,000 Tiscali Italia SpA: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Tiscali Italia SpA. The controller had sent advertising messages to more than 160,000 customers within four months, even… ITALY · ·Art. 5, 12, 13 +2 Jul 18, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jul 18, 2023
€75,000 Università Telematica E-Campus: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 75,000 on Università Telematica E-Campus. The controller had sent advertising messages and made advertising calls without the consent of… ITALY · ·Art. 5, 6, 7 +6 Jul 18, 2023
€10,000 NANDIVALE, S.L: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on NANDIVALE, S.L.. The controller had uploaded images on social media of a party at its premises showing minors. The mother of a… SPAIN · ·Art. 6 Jul 17, 2023
€90M CNIL closes Google cookies enforcement after SAN-2021-023 compliance This decision follows from a previous decision of the French DPA (SAN 2021-023 of 31 December 2021), in which said DPA fined Google LLC €90,000,000 and Google Ireland Limited… France ·Art. 5, 82 Jul 13, 2023
€1,200 LISMARTSA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on LISMARTSA, S.L.. A data subject had filed a complaint with the DPA because the controller had added them to a WhatsGroup without their… SPAIN · ·Art. 5, 32 Jul 5, 2023
€56,000 ODAFONE SERVICIOS, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on VODAFONE SERVICIOS, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… SPAIN · ·Art. 6 Jul 3, 2023
€1.1M Bonnier News AB: Insufficient legal basis for data processing The Swedish DPA has imposed a fine of EUR 1.1 million on Bonnier News AB. During its investigation, the DPA found that Bonnier News collects customer data, for example, through… SWEDEN ·Art. 6 ·Insufficient legal basis for data processing Jun 26, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Jun 21, 2023
€40,000 Dante International SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 40,000 on Dante International SA. During its investigation, the DPA found that the controller had failed to properly comply with a… ROMANIA · ·Art. 12, 17 Jun 20, 2023
€40M CRITEO: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 40 million on CRITEO. The controller is specialized in 'retargeting advertising'. This involves the company tracking the surfing behavior… Jun 15, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 9, 2023
€150,000 KG COM: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 150,000 on the company KG COM. The company operates several websites and offers fortune-telling consultations to customers via chat or… FRANCE · ·Art. 5, 6, 9 +6 Jun 8, 2023
€300,000 Rinascente S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Rinascente S.p.A. EUR 300,000. The DPA acted on a complaint from a customer who, following an incident with a store employee, had her long-standing… ITALY · ·Art. 5, 12, 32 +1 Jun 8, 2023
€84,000 UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC: Insufficient technical and organisational measures to ensure information security The Spanish DPA has imposed a fine on UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC a fine. A person had filed a complaint against the controller because a package addressed to them… SPAIN · ·Art. 5, 32 Jun 7, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 6, 2023
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual EUR 10,000 for publishing a picture and address of another person on a website without their consent. SPAIN · ·Art. 6 May 24, 2023
€1,000 Global Baby Brand SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on Global Baby Brand SRL. A person had filed a complaint with the DPA alleging that the controller had sent commercial SMS… ROMANIA · ·Art. 7 May 23, 2023