Content type · 3,446 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€2,000 Immobiliare Riscostruzione Meloria s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has imposed a fine of EUR 2,000 on Immobiliare Riscostruzione Meloria s.r.l.. The controller had installed a video surveillance system at its office which covered… ITALY · ·Art. 5, 13 Sep 15, 2022
€3,000 Thiene municipality: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 3,000 on Thiene municipality. A former employee of the municipality filed a complaint with the DPA because a document containing… ITALY · ·Art. 2, 5, 6 Sep 15, 2022
€100,000 Lazio Region: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Lazio Region. An individual had filed a complaint with the DPA because she had received an invitation from the regional health… ITALY · ·Art. 5, 6, 9 +4 Sep 15, 2022
€40,000 FCA Italy S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA has imposed a fine of EUR 40,000 on FCA Italy S.p.A.. An employee of the controller had requested access to personal data processed in the context of their… ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Sep 15, 2022
€2,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Sep 13, 2022
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The private individual had installed three video surveillance cameras on his property which, among other… SPAIN · ·Art. 5 Sep 13, 2022
€250,000 GIE INFOGREFFE: Insufficient technical and organisational measures to ensure information security The French DPA has imposed a fine of EUR 250,000 on GIE INFOGREFFE. The portal operates a website where people can access legal information about companies and order documents… FRANCE · ·Art. 5, 32 Sep 13, 2022
€80,700 Coin dealer: Non-compliance with general data processing principles The Hungarian DPA imposed a fine of EUR 80,700 on a coin dealer. During its investigation, the DPA found that the privacy policy did not contain sufficient information about the… HUNGARY · ·Art. 5, 6, 7 +2 Sep 12, 2022
€6,700 Hørsholm municipality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 6,700 on Hørsholm municipality. The municipality had reported a data breach to the DPA pursuant to Art. 33 GDPR. An employee's work… DENMARK · ·Art. 32 Sep 12, 2022
€2,000 SC Raiffeisen Bank SA: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 2,000 on SC Raiffeisen Bank SA. An individual had filed a complaint with the DPA for receiving text messages about money transfers to… ROMANIA · ·Art. 5 Sep 9, 2022
€15,000 School: Non-compliance with general data processing principles The Hellenic DPA has fined a school EUR 15,000. The school had installed several video surveillance cameras on the building, which permanently recorded students, teachers and… GREECE · ·Art. 5, 6, 12 +2 Sep 9, 2022
€180 EURO DONER KEBAB: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on EURO DONER KEBAB. The controller had installed video surveillance cameras which, among other things, also covered the public space.… SPAIN · ·Art. 5, 13 Sep 9, 2022
€15 HDPA (Greece) - 50/2022 A former teacher (the data subject) at a private primary school (the controller) submitted a complaint to the Greek DPA regarding a video surveillance system in the classrooms,… Art. 5, 6, 12 +2 Sep 9, 2022
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 300 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Sep 9, 2022
€8,000 Realmedia Network SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined Realmedia Network SA EUR 8,000. The company had suffered security breaches on a website it operates. This allowed it to leak and access unauthorized… ROMANIA · ·Art. 32 Sep 8, 2022
€530 Sułkowice Cultural Center: Insufficient data processing agreement The Polish DPA has imposed a fine of EUR 530 on the Sułkowice Cultural Center. During its investigation, the DPA found that the controller had transferred the processing of… POLAND · ·Art. 28 Sep 7, 2022
€5,000 EDYTE SA: Insufficient legal basis for data processing The Hellenic DPA has imposed a fine of EUR 5,000 on EDYTE SA. EDYTE, as a processor, had unlawfully disclosed personal data to third parties without the authorization of the data… GREECE · ·Art. 29 Sep 6, 2022
€20,000 MUXERS CONCEPT, S.L.: Insufficient legal basis for data processing The Spanish DPA has fined MUXERS CONCEPT, S.L. EUR 20,000. The company had installed video surveillance cameras and microphones in the employee changing room in one of the… SPAIN · ·Art. 6 Sep 6, 2022
€405M Meta Platforms, Inc.: Non-compliance with general data processing principles The Irish DPA (DPC) has imposed a fine of EUR 405,000,000 on Meta Platforms, Inc. (Instagram). Following the investigation, the DPC submitted a draft decision under Art. 60 GDPR… IRELAND ·Art. 5, 6, 12 +3 ·Non-compliance with general data processing principles Sep 5, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR on a private individual. The data subject had filed a complaint against his ex-wife with the DPA. The ex-wife had installed video… SPAIN · ·Art. 5 Sep 4, 2022
€360 Store owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on a store owner. The controller had installed video surveillance cameras which, among other things, also covered the public space. The… SPAIN · ·Art. 5, 13 Sep 4, 2022
€4,000 Liceo Statale 'Edoardo Amaldi”: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 4,000 on the school 'Edoardo Amaldi'. The school had published a circular on the school website about the summer vacations which… ITALY · ·Art. 2, 5, 6 +1 Sep 1, 2022
€240 MH VILASECA S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on MH VILASECA S.L.. The controller had failed to provide a notice with information about video surveillance in its premises. The original fine… SPAIN · ·Art. 13 Sep 1, 2022
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The individual had published personal data of another person on a blog without their consent and in a… SPAIN · ·Art. 6 Sep 1, 2022
€1,450 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA (UODO) has fined a data controller EUR 1,450 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Aug 31, 2022
€1,700 Bazar Pekin: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 1,700 on Bazar Pekin. The controller had failed to provide a notice with information about video surveillance in its premises. In… SPAIN · ·Art. 13, 30 Aug 30, 2022
€6,800 TIMSHEL Sp. z o.o.: Insufficient cooperation with supervisory authority The Polish DPA (UODO) has fined TIMSHEL Sp. z o.o. EUR 6,800 for failing to provide information requested by the DPA during an investigation POLAND · ·Art. 58 Aug 30, 2022
€3,000 COLEGIO VILLAEUROPA, S.C.L: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on COLEGIO VILLAEUROPA, S.C.L. The school did not provide sufficient information on the video surveillence, as required by Art. 13 GDPR. The… SPAIN · ·Art. 13 Aug 30, 2022
€2,000 Sindicato Intersectorial Trabajadores/as Provincia de Alicante: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on the Sindicato Intersectorial Trabajadores/as Provincia de Alicante union. The union published the protocols of a works council… SPAIN · ·Art. 5 Aug 30, 2022
€1,000 Alpha Bank Romania SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Alpha Bank Romania SA. The bank had accidentally sent a document to the wrong recipient via WhatsApp. The document contained… ·Art. 29, 32 ·Insufficient technical and organisational measures to ensure information security Aug 29, 2022
€5,600 SOLIVESA MASTER FRANCHISE S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 5,600 on SOLIVESA MASTER FRANCHISE S.L.. The data subject had received an advertising call from the controller made on behalf of… SPAIN · ·Art. 28, 48 Aug 28, 2022
€48,000 NATURGY ENERGY GROUP, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on NATURGY ENERGY GROUP, S.A.. A person had contacted the energy company pretending to be a relative of a customer. The person requested to… SPAIN · ·Art. 5, 32 Aug 28, 2022
€1,200 DIGITECNIA SOLUTIONS, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on DIGITECNIA SOLUTIONS, S.L.. An individual had filed a complaint with the DPA due to the fact that the company had published a picture of… SPAIN · ·Art. 6 Aug 28, 2022
€20,000 Recover AS: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) has fined Recover AS EUR 20,000. The controller had carried out a credit check on the data subject without any valid legal basis for doing so. NORWAY · ·Art. 6 Aug 25, 2022
€480 SERVICIOS PROFESIONALES LA PARADA S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on SERVICIOS PROFESIONALES LA PARADA S.L.. The company had installed video surveillance cameras which, among other things, also covered… SPAIN · ·Art. 5, 13 Aug 25, 2022
€2,500 Company: Insufficient technical and organisational measures to ensure information security The Belgian DPA has imposed a fine of EUR 2,500 on a company. The company operates a digital management platform where suppliers and customers can communicate and upload… BELGIUM · ·Art. 5, 24, 32 Aug 23, 2022
€25,000 Operator of a public toilet: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 25,000 on an operator of a public toilet. The controller had installed a video surveillance camera on the restrooms and secretly… AUSTRIA · ·Art. 5, 6, 13 Aug 23, 2022
€10,000 Enel Energie Muntenia S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined Enel Energie Muntenia S.A. EUR 10,000. A customer had mistakenly received an email addressed to another customer containing documents with personal data… ROMANIA · ·Art. 32 Aug 22, 2022
€900 UNONO NET 3.0, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on UNONO NET 3.0, S.L.. The company had forwarded an email to numerous recipients without using the blind copy function, making it possible for… SPAIN · ·Art. 5, 32 Aug 22, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 22, 2022
€600,000 ACCOR SA: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has imposed a fine of EUR 600,000 on ACCOR SA. Both CNIL and other European DPAS had received complaints against ACCOR from several individuals. In the… FRANCE · ·Art. 12, 13, 15 +2 Aug 19, 2022
€20,000 Medical laboratory: Insufficient technical and organisational measures to ensure information security The Belgian DPA imposed a fine of EUR 20,000 on a medical laboratory. During its investigation, the DPA found that the laboratory had failed to conduct a data protection impact… BELGIUM · ·Art. 5, 12, 13 +3 Aug 19, 2022
€5,000 RODALI GESTIÓN INMOBILIARIA, S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 5,000 on RODALI GESTIÓN INMOBILIARIA, S.L.. An individual had filed a complaint with the DPA due to the fact that the controller had not… SPAIN · ·Art. 13 Aug 16, 2022
€180 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 180 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5 Aug 12, 2022
€6,700 Lolland municipiality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 6,700 on Lolland municipiality. The municipality had reported a data breach to the DPA in accordance with Art. 33 GDPR. One of the… DENMARK · ·Art. 32 Aug 11, 2022
€197,000 AMPLIFON Hungary Trade and Service Provider LLC: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 197,000 on AMPLIFON Hungary Trade and Service Provider LLC. The DPA had received complaints from several data subjects for having… ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Aug 11, 2022
€1,000 Wabag Water Services SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on SC Wabag Water Services SRL. An employee of the company had filed a complaint with the DPA due to the fact that their employer… ROMANIA · ·Art. 5, 6 Aug 9, 2022
€7,000 CDI Transport Intern și Internațional SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 7,000 on CDI Transport Intern și Internațional SRL. During its investigation, the DPA found that the company's website did not provide… ROMANIA · ·Art. 12, 58 Aug 9, 2022
€5,000 IDIKA SA: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on IDIKA SA. IDIKA was operating in the context of providing free COVID-19 tests. The DPA found that IDIKA, in the course of its… GREECE · ·Art. 5, 25 Aug 8, 2022
€735 Company: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 735 on a company. An individual had filed a complaint against the company with the DPA. An employee of the company had made sound… HUNGARY · ·Art. 5, 6, 13 Aug 8, 2022