Content type · 482 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€90,000 Sociedad Vascongada de Publicaciones, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on Sociedad Vascongada de Publicaciones, S.A.. The controller had published a video on its news site that included an Excel spreadsheet with… SPAIN · ·Art. 5 Jun 22, 2023
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Jun 21, 2023
€1,000 Vodafone Romania SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Vodafone Romania SA. During its investigation, the DPA found that the controller had failed to sufficiently comply with a data… ·Art. 15 ·Insufficient fulfilment of data subjects rights Jun 21, 2023
€40M CRITEO: Insufficient fulfilment of data subjects rights The French DPA has imposed a fine of EUR 40 million on CRITEO. The controller is specialized in 'retargeting advertising'. This involves the company tracking the surfing behavior… Jun 15, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 14, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 13, 2023
€4.9M Spotify: Insufficient fulfilment of data subjects rights The Swedish Data Protection Authority (DPA) has imposed a fine of EUR 4.9 million on the music streaming provider Spotify. The DPA had launched an investigation after receiving a… SWEDEN ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Jun 12, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 9, 2023
€40,000 RCS Mediagroup S.p.a.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 40,000 on RCS Mediagroup S.p.a. for publishing images of an individual without a valid legal basis. ITALY · ·Art. 5 Jun 8, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Jun 6, 2023
€56,000 VODAFONE ONO, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on VODAFONE ONO, S.A.U.. The controller had carried out a credit check on an individual without there being a customer relationship or other… SPAIN · ·Art. 6 Jun 6, 2023
€150,000 NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ
Α.Ε.,: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 150,000 on NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ. Α.Ε., imposed a fine of EUR 150,000. A customer had filed a complaint with the… GREECE · ·Art. 12, 15, 21 +1 May 29, 2023
€70,000 Digi Spain Telecom, S.L.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Digi Spain Telecom, S.L.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing May 23, 2023
€10,000 La Gazzetta di Parma S.r.l.: Non-compliance with general data processing principles The Italian DPA has fined La Gazzetta di Parma S.r.l. EUR 10,000. The controller had published photos in its newspaper of an individual accused of murder. The photos showed the… ITALY · ·Art. 5 May 17, 2023
€1,200M Meta Platforms Ireland Limited: Insufficient legal basis for data processing The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 1.2 billion. This is the highest fine imposed to date under the GDPR. In its decision, the DPC found that Meta had… ·Art. 46 May 12, 2023
€70,000 DIGI SPAIN TELECOM, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on DIGI SPAIN TELECOM, S.L.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM… ·Art. 6 ·Insufficient legal basis for data processing Apr 25, 2023
€70,000 Telefónica Móviles España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Telefónica Móviles España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of… SPAIN · ·Art. 6 Apr 24, 2023
€15,000 Citynews S.p.A.: Non-compliance with general data processing principles The Italian DPA has fined Citynews S.p.A. EUR 15,000. The controller had published an article in a newspaper reporting on the arrest of an individual, including health data of the… ITALY · ·Art. 5, 9 Apr 14, 2023
€7.6M TIM S.p.A.: Insufficient legal basis for data processing The Italian DPA has fined TIM S.p.A. EUR 7,631,175. The DPA had received numerous complaints about the telecommunications provider, mainly for unauthorized telemarketing… ITALY · ·Art. 5, 6, 7 +5 Apr 13, 2023
€112,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card to an… SPAIN · ·Art. 6 Apr 13, 2023
€15M TikTok: Non-compliance with general data processing principles The UK DPA (ICO) has fined TikTok EUR 14.5 million. The ICO had found that more than one million British children under the age of 13 were using TikTok without the consent of… UNITED KINGDOM · ·Art. 5, 12, 13 Apr 4, 2023
€50,000 20 MINUTOS EDITORA, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on 20 MINUTOS EDITORA, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Apr 3, 2023
€50,000 ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.. Several media outlets, including the controller had published an audio… SPAIN · ·Art. 5 Apr 3, 2023
€70,000 Orange Espagne S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 70,000 on Orange Espagne S.A.U.. A person had filed a complaint with the DPA because the company had given a duplicate of their SIM card… SPAIN · ·Art. 6 Mar 23, 2023
€50,000 UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.. Several media outlets, including the controller had published an audio recording… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 CONECTA5 TELECINCO, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on CONECTA5 TELECINCO, S.A.U.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 LA VANGUARDIA EDICIONES, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on LA VANGUARDIA EDICIONES, S.L.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 EL DIARIO DE PRENSA DIGITAL SL.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on EL DIARIO DE PRENSA DIGITAL SL.. Several media outlets, including the controller had published an audio recording of a multiple… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 DISPLAY CONNECTORS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on DISPLAY CONNECTORS, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€40,000 TITANIA COMPAÑÍA EDITORIAL, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on TITANIA COMPAÑÍA EDITORIAL, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€40,000 EDITORIAL DE PRENSA CANARIA, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on EDITORIAL DE PRENSA CANARIA, S.A.. Several media outlets, including the controller had published an audio recording of a multiple rape… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 DIARIO ABC, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on DIARIO ABC, S.L.. Several media outlets, including the controller had published an audio recording of a multiple rape victim's… SPAIN · ·Art. 5 Mar 21, 2023
€50,000 SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 50,000 on SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L.. Several media outlets, including the controller had published an audio recording of a… SPAIN · ·Art. 5 Mar 21, 2023
€10,000 NGENIERÍA Y TELECOM JAÉN, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on INGENIERÍA Y TELECOM JAÉN, S.L.. The controller had extented the data subject's contract without their consent. SPAIN · ·Art. 6 Mar 17, 2023
€1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient identification methodes, resulting in a customer… BULGARIA · ·Art. 5 Mar 16, 2023
€100,000 ORANGE ESPAGNE S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 100,000 on ORANGE ESPAGNE S.A.U.. A customer who had purchased a cell phone from ORANGE had filed a complaint with the DPA. As a… SPAIN · ·Art. 5 Mar 16, 2023
€136,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U. A data subject had filed a complaint against the data controller as unauthorized fraudsters managed to access… SPAIN · ·Art. 6, 32 Mar 15, 2023
€40,000 VODAFONE ONO, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on VODAFONE ONO, S.A.U.. The controller had carried out a credit check on an individual without there being a customer relationship or other… SPAIN · ·Art. 6 Mar 10, 2023
€30,000 DISPLAY CONNECTORS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on DISPLAY CONNECTORS, S.L.. An individual had filed a complaint with the DPA regarding the controller's publication of information about a… SPAIN · ·Art. 5 Feb 22, 2023
€40,000 Vodafone: Insufficient fulfilment of data breach notification obligations The Hellenic DPA has imposed a fine of EUR 40,000 on Vodafone. An individual had filed a complaint with the DPA because, following a request for access to records of conversations… GREECE · ·Art. 15, 33 Feb 20, 2023
€3,250 Epic Ltd.: Insufficient legal basis for data processing The Cypriot DPA has imposed a fine of EUR 3,250 on Epic Ltd. The contoller had made unsolicited calls to 332 former customers without a valid legal basis. The DPA also found that… CYPRUS · ·Art. 6, 24, 32 Feb 3, 2023
€10,000 Vodafone: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on Vodafone. An individual had filed a complaint with the DPA because they had received a package containing promotional gifts… GREECE · ·Art. 5, 6, 13 Feb 2, 2023
€5.5M WhatsApp Ireland Ltd.: Insufficient legal basis for data processing The Irish DPA (DPC) has fined WhatsApp Ireland Ltd. EUR 5.5 million. The Austrian organization 'None of Your Business' (NOYB) had filed a complaint with the DPA on behalf of an… ·Art. 6, 12, 13 ·Insufficient legal basis for data processing Jan 19, 2023
€1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient technical and organisational measures to ensure… BULGARIA · ·Art. 5, 6 Jan 17, 2023
€7,000 Πολίτης newspaper: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 7,000 on the newspaper 'Πολίτης'. The controller had unlawfully published the names and pictures of two police officers. CYPRUS · ·Art. 5, 6 Jan 16, 2023
€390M Meta Platforms Ireland Limited: Non-compliance with general data processing principles The Irish DPA (DPC) has fined Meta Platforms Ireland Limited EUR 390 million. The DPA has imposed a fine of EUR 210 million for violations related to the provision of its Facebook… Jan 4, 2023
€3,000 Breikot Management Ltd: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 3,000 on Breikot Management Ltd. The DPA found that the company had violated the principle of minimization by processing excessive… CYPRUS · ·Art. 5, 6 Jan 1, 2023
€3M VOODOO ('provider') was a mobile game developer The investigation service of the French DPA (the investigation service) carried out several checks on voodoo.io and on several of the provider's mobile applications on iOS, in… SAN-2022-026 ·France · Dec 29, 2022