Content type · 3,594 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€85,000 Otavamedia Oy: Insufficient fulfilment of data subjects rights The Finnish DPA has imposed a fine of EUR 85,000 on Otavamedia Oy. The DPA had received eleven complaints regarding Otavamedia between 2018 and 2021. Namely, the complaints… FINLAND · ·Art. 5, 12, 15 +2 May 9, 2022
€500,000 Bulgarian Post EAD: Insufficient technical and organisational measures to ensure information security The Bulgarian DPA has imposed a fine of EUR 500,000 on Bulgarian Posts EAD. The controller had suffered a hacking attack, during which the attackers managed to access the… BULGARIA · ·Art. 32 May 4, 2022
€4,000 Concordia Capital IFN S.A.: Insufficient legal basis for data processing The Romanian DPA has fined Concordia Capital IFN S.A. EUR 4,000. The controller had unlawfully installed audio and video cameras in the offices of its employees. The video… ROMANIA · ·Art. 5, 6 May 4, 2022
€10,000 Nationale Maatschappij der Belgische Spoorwegen: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 10,000 on the Belgian national railroad company (Nationale Maatschappij der Belgische Spoorwegen). A Twitter user who had received an… BELGIUM · ·Art. 5, 6, 12 +1 May 4, 2022
€10,600 HEI – Medical Travel: Insufficient fulfilment of data subjects rights The Icelandic DPA has imposed a fine of EUR 10,600 on HEI - Medical Travel. A data subject had filed a complaint with the DPA against the controller. The controller had gained… ICELAND · ·Art. 9, 15, 17 May 3, 2022
€36,000 City of Reykjavík: Insufficient legal basis for data processing The Icelandic DPA has imposed a fine of EUR 36,000 on the City of Reykjavík. The city had used the digital education system 'Seesaw' at several schools. The student system… ICELAND · ·Art. 5, 6, 32 May 3, 2022
€4,000 Megareduceri TV S.R.L.: Insufficient cooperation with supervisory authority Failure to provide requested information to the Romanian DPA within the required timeframe in violation of Art. 58 GDPR. ROMANIA · ·Art. 58 May 3, 2022
€5,000 MISTORE CANARIAS, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on MISTORE CANARIAS, S.L.. A person who had made a purchase from the company had filed a complaint against the company with… SPAIN · ·Art. 6 May 3, 2022
€8,300 Telemarketing company: Insufficient cooperation with supervisory authority The Finnish DPA has imposed a fine of EUR 8,300 on a telemarketing company for non-compliance with a DPA order. A customer of the company had requested access to the recording of… FINLAND · ·Art. 58 Apr 29, 2022
€16,000 LABORATORIOS GONZÁLEZ, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined LABORATORIOS GONZÁLEZ, S.L.. The laboratory had sent the results of a Covid-19 test that the data subject had taken not only to them but also to… SPAIN · ·Art. 5 Apr 29, 2022
€4,200 CLÍNICA DENTAL SAN FRANCISCO, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine on CLÍNICA DENTAL SAN FRANCISCO, S.L.. A data subject had filed a complaint with the AEPD against the controller due to the fact that the… SPAIN · ·Art. 17, 21 Apr 29, 2022
€200,000 Amiu S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 200,000 on Amiu S.p.A.. The company operates the waste collection service for the city of Taranto and acted as a processor for this… ITALY · ·Art. 5, 6, 28 +1 Apr 28, 2022
€2,000 Comune di Partanna: Insufficient legal basis for data processing The community published information about a court case on its website, including personal data such as the name and professional information of a data subject. ITALY · ·Art. 2, 5, 6 Apr 28, 2022
€2,500 'Isabella Gonzaga' high school: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,500 on the 'Isabella Gonzaga' high school. The school had published a document, which also contained personal health data of some… ITALY · ·Art. 2, 5, 6 +1 Apr 28, 2022
€50,000 Istituto Nazionale Assicurazione Infortuni sul Lavoro: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Istituto Nazionale Assicurazione Infortuni sul Lavoro (Public Accident Insurance for workers) EUR 50,000. As part of its investigation, the DPA found… ITALY · ·Art. 2, 5, 6 +2 Apr 28, 2022
€1,500 CAFFE VECCHIO, S.L.: Insufficient legal basis for data processing The Spanish DPA has fined CAFFE VECCHIO, S.L. EUR 1,500. A former employee of the café had filed a complaint with the DPA. The operator of the café had responded to negative… SPAIN · ·Art. 5, 6 Apr 28, 2022
€70,000 Ospedale San Raffaele s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 70,000 on the healthcare facility Ospedale San Raffaele s.r.l.. The hospital had reported two data breaches to the DPA under Art. 33… ITALY · ·Art. 5, 9 Apr 28, 2022
€15,000 MEDEROS MOVITEN, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 15,000 on MEDEROS MOVITEN, S.L.. The data subject had signed a mobile service contract with the company. However, the company also… SPAIN · ·Art. 6 Apr 28, 2022
€3,000 Comune di Monte Sant'Angelo: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Comune di Monte Sant'Angelo. A person who had participated in a selection procedure had filed a complaint with the DPA due to… ITALY · ·Art. 2, 5, 6 +1 Apr 28, 2022
€1,500 Direzione Didattica Statale 1° Circolo-Eboli: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 1,500 on the school 'Direzione Didattica Statale 1° Circolo-Eboli'. The educational institution had sent a document containing the names… ITALY · ·Art. 2, 5, 6 +1 Apr 28, 2022
€1,000 Educationest s.r.l.: Insufficient legal basis for data processing The Italian DPA has fined Educationest s.r.l. EUR 1,000. The daycare center had sent an email to the families of the children in its care, informing them of the pregnancy and the… ITALY · ·Art. 5, 6 Apr 28, 2022
€40,000 Working Capital Management España, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 40,000 on the credit information agency Working Capital Management España, S.L.. A data subject had filed a complaint with the… SPAIN · ·Art. 6 Apr 28, 2022
€10,000 Italian Ministry of Defense: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 10,000 on the Italian Ministry of Defense. An employee of the ministry had filed a complaint with the DPA. During its investigation, the… ITALY · ·Art. 2, 5, 6 +2 Apr 28, 2022
€150,000 Tarento municipality: Insufficient fulfilment of information obligations The Italian DPA has imposed a fine of EUR 150,000 on Tarento municipality. The company Amiu S.p.A had operated the local waste collection service on behalf of the municipality.… ITALY · ·Art. 5, 12, 13 +3 Apr 28, 2022
€20,000 Nos s.r.l.s.: Insufficient legal basis for data processing The Italian DPA fined Nos s.r.l.s. in the amount EUR 20,000. Nos acted as a processor for Vodafone and did advertising for the telecommunications company. For this purpose, Nos… ITALY · ·Art. 5, 6, 7 +2 Apr 28, 2022
€40,000 Il Sole 24 Ore S.p.a.: Insufficient fulfilment of data subjects rights The Italian DPA has fined the newspaper Il Sole 24 Ore S.p.a. EUR 40,000. The newspaper had published an article on the recognition by the Italian authorities of a U.S. judge's… ITALY · ·Art. 5, 9, 12 Apr 28, 2022
€2,000 Ekss s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has fined the restaurant operator Ekss s.r.l. EUR 2,000. The controller had installed video surveillance cameras in its premises without properly informing the… ITALY · ·Art. 5, 13 Apr 28, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Apr 27, 2022
€1,000 ASST di Lodi: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has imposed a fine of EUR 1,000 on ASST di Lodi. The healthcare facility had reported a data breach to the DPA pursuant to Art. 33 GDPR. A patient had… ITALY · ·Art. 5, 9, 32 Apr 26, 2022
€1,200 MOVALIA TRASLADOS, S.L.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on MOVALIA TRASLADOS, S.L.U.. During its investigation, the DPA found numerous deficiencies on a website operated by the controller. For… SPAIN · ·Art. 6, 13 Apr 23, 2022
€5,600 Physician: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined a physician. The physician had used recordings of a patient's treatment for advertising purposes. However, the patient had not consented to this.… SPAIN · ·Art. 6 Apr 22, 2022
€8,000 Political party: Insufficient technical and organisational measures to ensure information security The Hungarian DPA has imposed a fine of EUR 8,000 on a party. The party had suffered a data protection breach resulting in six Excel files being made accessible on the Internet.… HUNGARY · ·Art. 5, 32 Apr 22, 2022
€600 DOOR2DOOR SPAIN, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine on DOOR2DOOR SPAIN, S.L.. The controller had failed to implement measures repeatedly ordered by the DPA in due time. Also, the controller had… ·Art. 58 ·Insufficient cooperation with supervisory authority Apr 19, 2022
€1,800 Website operator: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on the operator of the website link During its investigation, the DPA found numerous deficiencies on a website operated by the… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€9,000 JIMBO NETWORKS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on JIMBO NETWORKS, S.L.. During its investigation, the DPA found numerous deficiencies on a website operated by the controller. For… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€1,800 FLORAQUEEN FLOWERING THE WORLD S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined FLORAQUEEN FLOWERING THE WORLD S.L. for failing to provide information requested by the DPA during an investigation. The original fine of EUR 3,000 was… SPAIN · ·Art. 58 Apr 18, 2022
€1,000 IKEA România S.R.L.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on IKEA România S.R.L.. A data subject had complained to the DPA that IKEA had failed to comply with their requests to delete the… ROMANIA · ·Art. 12 Apr 18, 2022
€1.5M DEDALUS BIOLOGIE: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) has imposed a fine of EUR 1.5 million on DEDALUS BIOLOGIE. DEDALUS distributes software solutions for medical analysis laboratories. In February, the press… FRANCE · ·Art. 28, 29, 32 Apr 15, 2022
€8,000 RAMONA FILMS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) fined RAMONA FILMS, S.L. for failing to ensure that the company's privacy policy complied with the requirements of Art. 13 GDPR. Specifically, the website… SPAIN · ·Art. 13, 22 Apr 13, 2022
€500 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 500 on a homeowners' association. The executive board of the owners' association had publicly posted a list of defaulting owners. The DPA… SPAIN · ·Art. 5 Apr 12, 2022
€150,000 BASER COMERCIALIZADORA DE REFERENCIA, S.A.: Insufficient legal basis for data processing The Spanish DPA has fined BASER COMERCIALIZADORA DE REFERENCIA, S.A., EUR 150,000. A customer of the company had filed a complaint with the DPA since their electricity supply… SPAIN · ·Art. 6, 32 Apr 11, 2022
€50,000 Palumbo Superyacht Ancona s.r.l.: Insufficient legal basis for data processing The Italian DPA has fined Palumbo Superyacht Ancona s.r.l. EUR 50,000. The company had blocked an employee's company email account without permission. The employee had reported… ITALY · ·Art. 5, 12, 13 +3 Apr 7, 2022
€10,000 E-Mac Professional s.r.l.: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. ITALY · ·Art. 12, 15 Apr 7, 2022
€40,000 ISWEB S.p.A.: Insufficient data processing agreement The Italian DPA imposed a fine of EUR 40,000 on ISWEB S.p.A.. The fine is related to a fine against the healthcare facility Azienda ospedaliera di Perugia. ISWEB had provided the… ITALY · ·Art. 28 Apr 7, 2022
€3.7M Dutch Tax and Customs Administration: Non-compliance with general data processing principles The Dutch DPA has imposed a fine of EUR 3,7 million on the Dutch Tax and Customs Administration. This is the highest fine ever imposed by the Dutch DPA As part of its… THE NETHERLANDS · ·Art. 5, 6, 32 +1 Apr 7, 2022
€15,000 Rebirth s.r.l.: Insufficient fulfilment of information obligations The Italian DPA has fined Rebirth s.r.l. EUR 15,000. The controller had installed 14 surveillance cameras in a café it operated without, however, informing about the video… ITALY · ·Art. 5, 13, 114 +1 Apr 7, 2022
€10,000 Findomestic Banca spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 10,000 on Findomestic Banca spa. A customer had filed a complaint with the DPA regarding a breach of confidentiality related to the… ITALY · ·Art. 5 Apr 7, 2022
€20,000 Made in Italy s.r.l.s.: Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 20,000 on Made in Italy s.r.l.s.. A data subject had filed a complaint with the DPA after receiving promotional calls from the… ·Art. 6, 7, 15 +5 ·Insufficient legal basis for data processing Apr 7, 2022
€40,000 Azienda ospedaliera di Perugia: Non-compliance with general data processing principles The Italian DPA (Garante) has fined Azienda ospedaliera di Perugia EUR 40,000. During an investigation at the healthcare facility, the DPA found multiple GDPR violations. The… ITALY · ·Art. 5, 13, 14 +4 Apr 7, 2022
€500 Property owners' association: Insufficient cooperation with supervisory authority The Romanian DPA (ANSPDCP) has fined a property owners' association EUR 500 for failing to provide information requested by the DPA during an investigation. ROMANIA · ·Art. 58 Apr 7, 2022