Content type · 2,436 documents in this view · 3,871 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3645 Processing 2661 Personal Data 2436 Controllers 2044 Processing Agreement 1116 Security 1027 Supervision 877 Healthcare 624 Public Authority 579 Law Enforcement 576 Monitoring 553 Consent 512
€12,950 Sports association: Insufficient legal basis for data processing One sports association published personal data referring to judges who were granted judicial licenses online. However, not only their names were provided, but also their exact… POLAND · ·Art. 6 Apr 25, 2019
€9,400 HUNGARY DPA: Insufficient legal basis for data processing A data controller used a, in the point of view of NAIH, wrong legal basis for processing of personal data (Art. 6.1.b) for the assignment of claims. ·Art. 5, 6 ·Insufficient legal basis for data processing Apr 17, 2019
€80,000 Company in the financial sector: Insufficient technical and organisational measures to ensure information security In an administrative decision dated 12 April 2019, the authority imposed a fine of 80,000 euros on a medium-sized financial services company. This company had failed to take the… GERMANY ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Apr 12, 2019
€510 Medical centers: Insufficient legal basis for data processing The sanction of 510 EUR was imposed on each medical center for unlawful processing of the personal data of data subject G.B. by a medical centre for the purpose of changing his… BULGARIA · ·Art. 5, 6, 9 Apr 8, 2019
€1,900 HUNGARY DPA: Insufficient fulfilment of data subjects rights The data controller did not fulfil the data subject's access request. ·Art. 15 ·Insufficient fulfilment of data subjects rights Apr 5, 2019
€220,000 Private company working with data from publicly available sources: Insufficient fulfilment of information obligations The fine concerned the proceedings related to the activity of a company which processed the data subjects’ data obtained from publicly available sources, inter alia from the… POLAND · ·Art. 14 Mar 26, 2019
€5,100 A.P. EOOD: Insufficient legal basis for data processing The sanction was imposed on personal data administrator A.P. EOOD for unlawful processing of personal data. The personal data of data subject D.D. was used by A.P. EOOD for… BULGARIA · ·Art. 5, 6 Mar 26, 2019
€10,000 CZECH REPUBLIC DPA: Non-compliance with general data processing principles Data was not only processed if adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation') and not only kept… ·Art. 5 ·Non-compliance with general data processing principles Mar 21, 2019
€3,200 Unnamed financial institution: Insufficient fulfilment of data subjects rights The fine was imposed in relation to a data subject's request for data correction and erasure. NAIH levied a fine against an unnamed financial institution for unlawfully rejecting… HUNGARY · ·Art. 5, 6, 13 +1 Mar 4, 2019
€170,000 Bergen Municipality: Insufficient technical and organisational measures to ensure information security The incident relates to computer files with usernames and passwords to over 35000 user accounts in the municipality’s computer system. The user accounts related to both pupils in… NORWAY · ·Art. 5, 32 Mar 1, 2019
€50,000 N26: Insufficient legal basis for data processing The fine was imposed against against a bank (according to a newspaper N26) that had processed 'personal data of all former customers' without permission.The Bank has acknowledged… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Mar 1, 2019
€582 CZECH REPUBLIC DPA: Insufficient technical and organisational measures to ensure information security Data was not processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Feb 28, 2019
€776 CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Information was not provided. ·Art. 15 ·Insufficient fulfilment of data subjects rights Feb 26, 2019
€27,100 Telecommunication service provider: Insufficient legal basis for data processing Repeated registration of prepaid services without the knowledge and consent of the data subject Employees of the telecommunications provider have used personal data and registered… BULGARIA · ·Art. 5, 6 Feb 26, 2019
€500 Employer: Insufficient fulfilment of data subjects rights An employee sent a request to his employer for access to personal data concerning him. The request was not answered in time and not in a complete way. BULGARIA · ·Art. 15 Feb 22, 2019
€1,560 Debt collector: Non-compliance with general data processing principles A data subject requested information about and erasure of the data processed, which the debt collector refused stating that it could not identify the subject. For identification… HUNGARY · ·Art. 5 Feb 20, 2019
€5,000 Lands Authority: Insufficient technical and organisational measures to ensure information security As a result of the lack of appropriate security measures on the Lands Authority website, over 10 gigabytes of personal data became easily accessible to the public via a simple… MALTA ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Feb 18, 2019
€1,560 Bank: Non-compliance with general data processing principles A bank mistakenly sent SMS messages about a subject's credit card debt to the telephone number of another person. After receiving an incorrect telephone number from the client at… HUNGARY · ·Art. 5 Feb 8, 2019
€20,000 PORTUGAL DPA: Insufficient fulfilment of data subjects rights Denial of the right to access recorded phone calls by the Data Subject ·Art. 15 ·Insufficient fulfilment of data subjects rights Feb 5, 2019
€1,165 Credit brokerage: Insufficient technical and organisational measures to ensure information security Data was not processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental… CZECH REPUBLIC · ·Art. 32 Feb 4, 2019
€500 Bank: Insufficient legal basis for data processing A bank gained personal data concernign a student wihtout a legal basis. BULGARIA · ·Art. 5, 6 Jan 17, 2019
€500 GERMANY DPA: Insufficient fulfilment of data subjects rights A data controller failed to comply with data subject´s request to access their personal data. Art. 15 ·Insufficient fulfilment of data subjects rights Jan 1, 2019
€21,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Vodafone had processed personal data of the claimant (bank details, name, surname and national identification number) years after the contractual relationsid had ended. The fine… SPAIN · ·Art. 6 Jan 1, 2019
€800 Police Officer: Insufficient legal basis for data processing A police officer used a witness's personal data to contact her personally. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2019
€48,000 VODAFONE ONO, S.A.U.: Insufficient technical and organisational measures to ensure information security Customers could access personal data of other customers in the customer area. The initial fine of EUR 60.000 was reduced to EUR 48.000. SPAIN · ·Art. 32 Jan 1, 2019
€30,000 Vodafone España, S.A.U.: Insufficient technical and organisational measures to ensure information security Disclosure of customer personal data (i.a. purchase history) via an SMS to another customer. The initial fine of EUR 50.000 was reduced to EUR 30.000. SPAIN · ·Art. 5, 32 Jan 1, 2019
€50,000 Unknown Company: Insufficient fulfilment of data subjects rights The data controller had engaged an external company to carry out the duties of access to data according to Art. 15 GDPR. However, the engaged company conducted the correspondence… GERMANY ·Art. 15, 28 ·Insufficient fulfilment of data subjects rights Jan 1, 2019
€5,000 State Hospital: Insufficient fulfilment of data subjects rights A patient complained to the Commissioner that the request for access to her medical file was not satisfied by the hospital because the dossier could not be identified/located by… CYPRUS · ·Art. 15 Jan 1, 2019
Hamburger Volksbank eG: Insufficient fulfilment of data subjects rights The company had sent a customer a newsletter with advertising content by e-mail, although this customer had previously expressly objected to the sending of further advertising… GERMANY · ·Art. 21 Jan 1, 2019
€48,000 TELEFONICA MOVILES ESPAÑA, S.A.U.: Non-compliance with general data processing principles The claimant's bank account was charged by the company with two invoices for the services he had contracted, however, displaying personal data of another customer. The initial… SPAIN · ·Art. 5 Jan 1, 2019
€3,200 HUNGARY DPA: Insufficient fulfilment of data subjects rights The fine was imposed for (i) not providing a data subject with CCTV recordings, (ii) not retaining recordings for further use by the data subject, and (iii) not informing the data… ·Art. 12, 13, 15 +1 ·Insufficient fulfilment of data subjects rights Dec 18, 2018
€500 Bank: Insufficient legal basis for data processing A fine of 1000 BGN (or roughly 500 EUR) was imposed on a bank for calling a client for the unresolved bills of his neighbor. This provoked the client to evoke his right to be… BULGARIA · ·Art. 5, 6 Dec 4, 2018
€20,000 Knuddels.de: Insufficient technical and organisational measures to ensure information security After a hacker attack in July personal data of approx. 330.000 users, including passwords and email addresses had been revealed. GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 21, 2018
€388 CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Information was not provided. ·Art. 15 ·Insufficient fulfilment of data subjects rights Oct 25, 2018
€20,000 GERMANY DPA: Insufficient fulfilment of data breach notification obligations Late notification of a data breach and failure to notify the data subjects. ·Art. 33, 34 ·Insufficient fulfilment of data breach notification obligations Jan 1, 2018
Norwegian DPA: Legelisten.no may process healthcare reviews without prior consent Legelisten.no AS is a Norwegian limited liability company running a website where people anonymously can post reviews about dentists, doctors, psychologists and other healthcare… 15/01355 ·Norway · Nov 8, 2017