Content type · 2,650 documents in this view · 3,836 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3611 Processing 2650 Personal Data 2423 Controllers 2035 Processing Agreement 1116 Security 1022 Supervision 865 Healthcare 622 Public Authority 573 Law Enforcement 572 Monitoring 551 Consent 509
€20,000 Gaypa s.r.l.: Non-compliance with general data processing principles The Italian DPA (Garante) imposed a fine of EUR 20,000 on Gaypa s.r.l.. The controller had kept a former employee's email account active and had access to the data subject's… ITALY · ·Art. 5, 12, 13 Oct 29, 2020
€4,000 Play Orenes, S.L.: Non-compliance with general data processing principles The company used CCTV cameras outside its premises which also captured the public space resulting in a violation of the principle of data minimisation. SPAIN · ·Art. 5 Oct 28, 2020
€36,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Processing of personal data of a data subject without sufficient legal basis due to errors in the correct assignment of customer contracts. SPAIN · ·Art. 5, 6 Oct 28, 2020
€20,000 Università Campus Bio-medico di Roma (Polyclinic): Non-compliance with general data processing principles In a data breach notification pursuant to Art. 33 GDPR, the data protection authority found that patients accessing their online medical reports via their smartphones could also… ITALY · ·Art. 5, 9 Oct 26, 2020
€200 Private Individual: Non-compliance with general data processing principles Original summary: The DPA of Saxony-Anhalt imposed a fine of EUR 200 on a private individual. The controller had taken photos of vehicles and, in some cases, their drivers and… GERMANY ·Art. 5, 32 ·Non-compliance with general data processing principles Oct 24, 2020
€54,800 Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak: Insufficient fulfilment of data subjects rights The data controller denied the data subject access to the video material recorded by CCTV in a local store, with which the data subject wanted to prove that he or she had not… HUNGARY · ·Art. 12, 15, 18 +1 Oct 23, 2020
€15,000 Vilnius City Municipality Administration: Non-compliance with general data processing principles During the data synchronization of the Population Information System of the Municipal Administration with the databases of the State Centre for Business Registers, the personal… LITHUANIA · ·Art. 5 Oct 21, 2020
€2,000 Globus Score SRL: Insufficient cooperation with supervisory authority The company had not provided the ANSPDCP with requested information. ROMANIA · ·Art. 58 Oct 20, 2020
€1,000 Grant Ideas Ltd: Insufficient legal basis for data processing Sending emails to data subjects without sufficient legal basis. CYPRUS · ·Art. 5, 6 Oct 19, 2020
€600 Private Individual: Insufficient legal basis for data processing Between February and June 2020, a private individual published information about patients on his personal Facebook page. The information included health data in terms of Art. 4… AUSTRIA · ·Art. 5, 9 Oct 19, 2020
€150 Private Individual: Insufficient legal basis for data processing The private individual recorded a female person while she was using one of the WC cabins by placing a cell phone (smartphone with camera function) under the WC cabin partition… AUSTRIA · ·Art. 5, 6 Oct 19, 2020
€30,000 PS/00032/2020 A user of the website of Iberia, an airline, lodged a complaint before the Spanish DPA (AEPD) saying that they had not been given an option to reject the cookies when using the… Spain · ·Art. 22 Oct 16, 2020
€3,000 S.C. Marsorom S.R.L.: Insufficient technical and organisational measures to ensure information security Disclosure of personal data of customers on the companies website due to inadequate technical and organisational measures to ensure information security. ROMANIA · ·Art. 32 Oct 15, 2020
€2,000 Private Person: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour. SPAIN · ·Art. 5, 6 Oct 9, 2020
€50,000 Centro de Investigación y Estudio para la Obesidad, SL: Insufficient legal basis for data processing Fines for the transfer of the data subject's personal data to Evo Finance EFC, SA in the course of processing a health insurance application, without a sufficient legal basis for… SPAIN · ·Art. 5, 6 Oct 9, 2020
€5,000 Caja Rural San José de Nules S. Cooperativa de Crédito: Non-compliance with general data processing principles The company published information with the names and surnames of its employees, which led to the disclosure of the data subject's financial situation. SPAIN · ·Art. 5 Oct 9, 2020
€900 Café Restaurante B.B.B: Non-compliance with general data processing principles The cafe used CCTV cameras which also captured the public space outside resulting in a violation of the so called principle of data minimisation. SPAIN · ·Art. 5 Oct 9, 2020
€4,000 Callesgarcia, S.L.: Insufficient legal basis for data processing Usage of a photo of the data subjects for commercial purposes without sufficient legal basis. SPAIN · ·Art. 5, 6 Oct 6, 2020
€60,000 Lycamobile: Insufficient legal basis for data processing Fine for processing of personal data without sufficient legal basis due to incorrect information about the owners of prepaid phone cards (mismatch between the registered owners in… SPAIN · ·Art. 5, 6 Oct 6, 2020
€3,000 Avata Hispania, S.L.: Insufficient legal basis for data processing Infringement of Art. 28 (3) g) GDPR, since personal data were further processed after the controller had terminated the contractual relationship with the processor. SPAIN · ·Art. 5, 6, 28 Oct 3, 2020
€2,000 Asociația de proprietari Militari R: Insufficient cooperation with supervisory authority Fine for failure to comply with an order of the supervisory authority. ROMANIA · ·Art. 31, 58 Oct 1, 2020
€3,000 Megareduceri TV S.R.L.: Insufficient cooperation with supervisory authority Fine for failure to comply with an order of the supervisory authority. ROMANIA · ·Art. 31, 58 Oct 1, 2020
€35M H&M Hennes & Mauritz Online Shop A.B. & Co. KG: Insufficient legal basis for data processing The fashion company with seat in Hamburg operates a service center in Nuremberg. Here, according to the findings of the Hamburg data protection officer, since at least 2014… GERMANY · ·Art. 5, 6 Oct 1, 2020
€80,000 Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital): Insufficient technical and organisational measures to ensure information security According to the data protection authority, personal information about participants in a public competition had been unlawfully disclosed online. The reason for this was that, due… ITALY · ·Art. 5, 6, 13 +2 Sep 30, 2020
€20,050 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 20,050 on a legal person. The accused processes hundreds of thousands of personal data on the website about self-employed persons without… CZECH REPUBLIC · ·Art. 5, 6, 12 +2 Sep 30, 2020
€3,000 Venu Sanz Chef, S.L.: Insufficient legal basis for data processing Use of personal data for advertising purposes without sufficient legal basis. SPAIN · ·Art. 5, 6 Sep 30, 2020
€13,900 Odin Flissenter AS: Insufficient legal basis for data processing The company assessed the credibility of another company and thereby, according to Datatilsynet, processed personal data relating to a natural person (the owner of the company… NORWAY · ·Art. 5, 6 Sep 25, 2020
€60,000 Xfera Moviles S.A.: Insufficient legal basis for data processing Failure to remove the data subject's personal data at the time of cancellation of his/her telephone services contract and sending a warning to the data subject after cancellation… SPAIN · ·Art. 5, 6 Sep 25, 2020
€400 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 400 on a legal person. In connection with the delivery of magazine subscriptions, the company did not provide the data subject with… CZECH REPUBLIC · ·Art. 15 Sep 25, 2020
€400 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 400 on a legal person. Proceedings were initiated following an inspection carried out in response to a complaint. The accused processed and… CZECH REPUBLIC · ·Art. 5, 13, 28 +1 Sep 25, 2020
€7,800 Iweb Internet Learning, S.L.: Insufficient fulfilment of information obligations Lack of information in the privacy policy (information on the data controller) as well as inadequate obtaining of consent, as only a general consent could be given without… SPAIN · ·Art. 7, 12, 13 Sep 22, 2020
€60,000 GLP Instalaciones 86, SL: Insufficient legal basis for data processing In order to obtain assistance for the installation of an air conditioning system, the data subject had contacted Naturgy Energy Group S.A. Subsequently, he was contacted by two… SPAIN · ·Art. 5, 6 Sep 22, 2020
€3,000 Grupo Carolizan: Non-compliance with general data processing principles Operation of CCTV camera systems in an arcade area in front of a building, i.e. also covering public space. This violated the principles of data minimization, as the surveillance… SPAIN · ·Art. 5 Sep 17, 2020
€3,200 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 3,200 on a legal person. The accused processed data from public registers on its website without legal basis and did not respond to… CZECH REPUBLIC · ·Art. 6, 15, 17 Sep 17, 2020
€60,000 Vodafone España, SAU: Insufficient legal basis for data processing A former customer had received e-mails containing electronic bills even after he had terminated his contract with the company resulting in a processing of personal data without… SPAIN · ·Art. 5, 6 Sep 17, 2020
€10,000 Property owners community: Non-compliance with general data processing principles Publication of a document containing personal data (information about identity of the data subject as well as about debts) on a community notice billboard. SPAIN · ·Art. 5 Sep 16, 2020
€8,000 Private Person: Non-compliance with general data processing principles Operation of a CCTV camera that also monitored public space outside the premises of the data controller. GREECE · ·Art. 5 Sep 11, 2020
€1,500 Political Party: Insufficient legal basis for data processing Sending of an e-mail to a former party member who had since resigned, with the request to act as an election representative without sufficient legal basis to process the personal… SPAIN · ·Art. 5, 6 Sep 11, 2020
IP Slovenia: ZEKom-1 governs legal basis for NIJZ #StayHealthy SMS to users The IP received a request for an opinion concerning sending of an SMS message to users about the new #StayHealthy app created by the National Institute of Public Health (NIJZ).… 07121-1/2020/1570 · ·Art. 6, 58 Sep 11, 2020
€2,000 Sanatatea Press Group S.R.L.: Insufficient technical and organisational measures to ensure information security Sending the personal data collected for the registration for an online course to other participants due to a technical failure. ROMANIA · ·Art. 5, 32 Sep 8, 2020
Datatilsynet (Norway)- 20/02254 The Norwegian Consumer Council (Forbrukerrådet) filed three complaints against the gay/bi dating app Grindr and five adtech companies that received personal data through the app.… 20/02254 (Grindr) · ·Art. 57, 58 Sep 7, 2020
€3,000 Barcelona Airport Security Guard Association ('AVSAB'): Non-compliance with general data processing principles A member of the AVSAB security committee used WhatsApp to send messages to private phone numbers containing personal information about employees. This was a violation of the… SPAIN · ·Art. 5 Sep 7, 2020
32/2020 The complainant, making use of the Greek Ministry of Education and Religion's Order 12773/Δ2/23.01.2015, filed in the name of their son an exemption request from the participation… 32/2020 ·Greece · Sep 7, 2020
€5,000 Former mayor of a community: Insufficient legal basis for data processing Originial fine summary: Sending election advertising to citizens without sufficient legal basis. Update: On January 27th, 2021, the Brussels Court of Appeal overturned the fine of… BELGIUM · ·Art. 5, 6 Sep 7, 2020
€2,000 Comune di Casaloldo: Insufficient legal basis for data processing Publication of personal data on the website of the community. ITALY · ·Art. 5, 6 Sep 3, 2020
€500 Apartment building owners association: Insufficient legal basis for data processing Export of a still image from a video surveillance system and posting of the image on the billboard of the building without sufficient legal basis. In addition, violation of the… ROMANIA · ·Art. 5, 6, 12 +3 Sep 1, 2020
DSB: online article about former politician is journalistic processing under Art. 85 GDPR In June 2019, the complainant requested erasure of her personal data from the respondent's website, claiming that an article on that website contained wrong statements about her.… 2020-0.303.727 ·Austria ·Art. 17, 85 Sep 1, 2020
€75,000 Telefónica Móviles España, SAU: Insufficient legal basis for data processing According to the supervisory authority, the company processed personal data without sufficient legal basis, with the result that the data subject received several hundred… SPAIN · ·Art. 5, 6 Sep 1, 2020
€22,700 Surveyor General of Poland ('GKK'): Insufficient legal basis for data processing Processing of personal data on the GEOPORTAL2 platform in the form of land and mortgage registers (including names, surnames and other personal data) without sufficient legal… ·Art. 5, 6 ·Insufficient legal basis for data processing Aug 31, 2020
€2,000 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 2,000 on a legal person. Despite the objection raised by the data subject (the owner of the industrial rights) against the processing and… CZECH REPUBLIC · ·Art. 12 Aug 28, 2020