Content type · 2,674 documents in this view · 3,877 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3655 Processing 2674 Personal Data 2449 Controllers 2053 Processing Agreement 1118 Security 1032 Supervision 890 Healthcare 626 Public Authority 583 Law Enforcement 581 Monitoring 561 Consent 515
€11,200 Health and Medical Board of the Region of Örebro County: Insufficient legal basis for data processing Publication of personal data of a patient without sufficient legal basis. SWEDEN · ·Art. 5, 6 May 12, 2020
€5,000 Banca Comercială Română SA: Insufficient technical and organisational measures to ensure information security The data protection authority finds that the company has not taken adequate technical and organisational measures to ensure an adequate level of information security. This applies… ROMANIA · ·Art. 32 May 5, 2020
€500 Housing Association: Insufficient legal basis for data processing Fine of EUR 500 against a housing association for publishing photos showing members of the association without their consent. ESTONIA · ·Art. 6 Apr 30, 2020
€725,000 Unknown Organisation: Insufficient legal basis for data processing The organisation had required its staff to have their fingerprints scanned to record attendance. However, as the decision of the data protection authority stated, the organisation… THE NETHERLANDS · ·Art. 5, 9 Apr 30, 2020
€50,000 Proximus SA: Insufficient involvement of data protection officer According to the data protection authority, the company's data protection officer was not sufficiently involved in the processing of personal data breaches and the company did not… BELGIUM · ·Art. 31, 37, 58 Apr 28, 2020
€3,000 Estee Lauder Romania: Insufficient legal basis for data processing Processing of personal data without sufficient legal basis including health data. ·Art. 6, 7, 9 ·Insufficient legal basis for data processing Apr 23, 2020
€3,000 Telekom Romania Communications SA: Insufficient technical and organisational measures to ensure information security The company had not taken sufficient technical and organizational measures to ensure the accuracy of personal data transmitted by telephone for the conclusion of contracts. This… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Apr 23, 2020
€2,000 Political Party: Insufficient legal basis for data processing Forging signatures on a voters' list. BULGARIA · ·Art. 6 Apr 14, 2020
€2,000 Ιγνατιάδης Νικόλαος και ΣΙΑ Ε.Ε.: Non-compliance with general data processing principles The Hellenic DPA (HDPA) has imposed a fine of EUR 2,000 on Ιγνατιάδης Νικόλαος και ΣΙΑ Ε.Ε. The controller had installed surveillance cameras covering areas where its employees… GREECE · ·Art. 5, 6 Apr 7, 2020
€2,890 Bank: Insufficient legal basis for data processing Due to an administrative error, the personal data of the data subject were registered and transferred to the Central Credit Information System (CCI) in connection with a loan… HUNGARY · ·Art. 5, 6 Mar 26, 2020
€3,000 Enel Energie: Insufficient technical and organisational measures to ensure information security The company has sent an email to a client which contained personal data of another client since the company failed to implement adequate technical and organisational measures to… ROMANIA · ·Art. 32 Mar 25, 2020
€3,000 Dante International: Insufficient legal basis for data processing The company has sent a commercial e-mail to a client though the client had previously unsubscribed from commercial communications. ROMANIA · ·Art. 6, 21 Mar 25, 2020
€2,000 SOS Infertility Association: Insufficient cooperation with supervisory authority The Association did not provide the data protection authority with the information requested by the latter after the Association had processed personal data without a sufficient… ROMANIA · ·Art. 58 Mar 25, 2020
€4,150 Vodafone Romania: Insufficient technical and organisational measures to ensure information security The company has sent an email to a customer which contained personal data of another customer due to inadequate technical and organisational measures to ensure information… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Mar 25, 2020
€15,000 CP&A: Insufficient technical and organisational measures to ensure information security The Dutch DPA (AP) has imposed a fine of EUR 15,000 on CP&A. The controller had documented both the causes of illness and specific complaints of the data subjects as part of the… THE NETHERLANDS · ·Art. 9, 32 Mar 24, 2020
€8,000 Speech and Special Education Centre - Mihou Dimitra: Insufficient fulfilment of data subjects rights The complainant had requested access to his child's data and to tax information. This request was rejected by the data controller. In addition, the data controller had violated an… GREECE · ·Art. 15, 58 Mar 20, 2020
€6,000 Oliveros Ustrell, S.L.: Insufficient legal basis for data processing The company forwarded an unsigned porting contract to the operator Vodafone. However, the data controller was unable to provide evidence of the order. For this reason, the… SPAIN · ·Art. 5, 6 Mar 19, 2020
€5,800 Unknown Company: Insufficient fulfilment of data subjects rights The data controller has not complied with its obligation regarding the right of access to video recordings and was also unable to demonstrate that his data processing activities… HUNGARY · ·Art. 6, 15 Mar 19, 2020
€6,000 Amalfi Servicios de Restauracion S.L.: Non-compliance with general data processing principles Video surveillance of public space and thus violation of the principle of data minimization. Furthermore: Violation of information obligations, as insufficient information has… SPAIN · ·Art. 5, 13, 14 Mar 16, 2020
€5,000 Centro De Estudio Dirigidos Delta, S.L.: Non-compliance with general data processing principles Centro De Estudio Dirigidos Delta sent a message containing personal data such as first and last name and ID numbers to a third party via WhatsApp without the consent of the data… SPAIN · ·Art. 5 Mar 16, 2020
€4,000 Private Person: Insufficient legal basis for data processing On a beach, a private person secretly photographed female bathers. The incident was reported to the AEPD by the local police. SPAIN · ·Art. 5, 6 Mar 16, 2020
€2,000 Homeowners Association: Non-compliance with general data processing principles Video surveillance of public space and thus violation of the principle of data minimization. Furthermore: Violation of information obligations, as insufficient information has… SPAIN · ·Art. 5, 13, 14 Mar 12, 2020
€870 Creditor: Insufficient legal basis for data processing Sending of SMS to a data subject as a reminder for a debt, even when the debt has already been paid. HUNGARY · ·Art. 5, 6 Mar 9, 2020
€15,000 Gesthotel Activos Balagares: Non-compliance with general data processing principles The data subject argued that he had sent a private letter to the hotel management and union delegates containing information about an episode of harassment he had suffered,… SPAIN · ·Art. 5 Mar 9, 2020
€4,000 Liceo Scientifico Nobel di Torre del Greco: Insufficient legal basis for data processing The AEPD's decision reveals that the high school unlawfully published health data and other information of more than 2000 teachers in the teacher rankings published on the… ITALY · ·Art. 5, 6, 9 Mar 6, 2020
€4,000 Liceo Artistico Statale di Napoli: Insufficient legal basis for data processing The AEPD's decision reveals that the high school unlawfully published health data and other information in the teacher rankings published on the Institute's website. This… ITALY · ·Art. 5, 6, 9 Mar 6, 2020
€4,000 Private individual: Non-compliance with general data processing principles Unlawful usage of video surveillance cameras which also monitored parts of the public space (violation of principle of data minimization). SPAIN · ·Art. 5 Mar 6, 2020
€3,000 San Giorgio Jonico: Insufficient legal basis for data processing Publication of a citizen's personal data on a website and failure to comply with requests for deletion. ITALY · ·Art. 5, 6, 17 Mar 5, 2020
€60,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing According to the AEPD, the data subject has received several SMS from a separate operator indicating the activation of a new contract. The reason for this was that an employee of… SPAIN · ·Art. 5, 6 Mar 4, 2020
€290 Representative of a local government: Insufficient legal basis for data processing A local representative took a photo of the director of a company fully owned by the local government depicting the director allegedly tearing off an election poster of the… HUNGARY · ·Art. 5, 6, 12 +2 Mar 4, 2020
School in Gdansk (Danzig) (fine imposed against town of Gdansk): Insufficient legal basis for data processing Original summary: A school in Gdansk used biometric fingerprint scanners to authenticate students for the payment process in the school canteen. Although the parents had given… POLAND · ·Art. 5, 9 Mar 4, 2020
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing According to the AEPD, the company sent an SMS to an clients mobile number confirming that a telephone contract with that number had been signed even though the client was not a… SPAIN · ·Art. 5, 6 Mar 3, 2020
€24,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing According to the AEPD, the company sent two SMS to an clients mobile number informing about a rate change in its contract and confirming the purchase of a new mobile phone,… SPAIN · ·Art. 5, 6 Mar 3, 2020
€525,000 Royal Dutch Tennis Association ('KNLTB'): Insufficient legal basis for data processing The Dutch Data Protection Authority has fined the Royal Dutch Tennis Association ('KNLTB') with EUR 525,000 for selling the personal data of more than 350,000 of its members to… THE NETHERLANDS · ·Art. 5, 6 Mar 3, 2020
Coop Finnmark SA: Insufficient legal basis for data processing On February 28, 2020, the Norwegian DPA (Datatilsynet) announced that it intents to fine Coop Finnmark SA EUR 38,600 for violations of Art. 5 GDPR and Art. 6 GDPR . This fine has… NORWAY · ·Art. 5, 6 Feb 28, 2020
€3,600 AEMA Hispánica: Non-compliance with general data processing principles The company had sent the payroll of an employee to another employee and therefore disclosed personal data to an unauthorised party. SPAIN · ·Art. 5 Feb 28, 2020
€120,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Vodafone España was unable to prove to the data protection authority that the data subject had given his consent to the processing of his personal data for the provision of a… SPAIN · ·Art. 5, 6 Feb 27, 2020
€6,000 Casa Gracio Operation: Non-compliance with general data processing principles The company used CCTV cameras in the premises of a hotel which also captured the public roads outside the hotel resulting in a violation of the so called principle of data… SPAIN · ·Art. 5 Feb 25, 2020
€48,000 HM Hospitales: Insufficient legal basis for data processing The data subject stated that at the time of his admission to hospital he had to fill in a form containing a checkbox indicating that, if he did not tick it, he agreed to the… SPAIN · ·Art. 5, 6 Feb 25, 2020
€5,000 Public Power Corporation S.A.: Insufficient fulfilment of data subjects rights The Decision clarified that data subjects have a right of access to the processing of their personal data and that they must also be provided with a copy of the personal data… GREECE · ·Art. 15 Feb 21, 2020
€2,560 L.E. EOOD: Insufficient technical and organisational measures to ensure information security The fine of ca EUR 2,557 was imposed on L.E. EOOD for unlawful processing of personal data of data subject I.S. without the knowing and the consent of the data subject and also… BULGARIA · ·Art. 6, 25, 32 Feb 20, 2020
€2,560 T.K. EOOD: Insufficient technical and organisational measures to ensure information security The fine of ca. EUR 2,557 was imposed on T.K. EOOD for unlawful processing of personal data of data subject I.S. by failure to adopt technical and organizational measures to… BULGARIA · ·Art. 25, 32 Feb 20, 2020
€3,000 Colegio Arenales Carabanchel (School): Insufficient legal basis for data processing The decision of the data protection authority states that the school transferred pictures (and therefore personal data) to third parties, who published them without legal basis. SPAIN · ·Art. 6 Feb 14, 2020
€80,000 Iberdrola Clientes: Insufficient legal basis for data processing Iberdola Clientes, an electricity company, terminated the data subject's contract without its consent, concluded three new contracts with the data subject, processed his personal… SPAIN · ·Art. 6 Feb 14, 2020
€4,000 Comune di Urago: Insufficient legal basis for data processing The local council has published on its website information containing a person's personal data, including health information. ITALY · ·Art. 5, 6 Feb 13, 2020
€3,000 Vodafone Romania: Insufficient technical and organisational measures to ensure information security Vodafone Romania had incorrectly processed personal data of an individual in order to process a complaint, which was subsequently sent to a wrong e-mail address. The reason for… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Feb 11, 2020
€20,000 RTI - Reti Televisive Italiane s.p.a.: Insufficient legal basis for data processing The television station broadcasted a documentary about prostitution in Switzerland, in which the persons interviewed were not made sufficiently anonymous. ITALY · ·Art. 5, 6 Feb 6, 2020
€1,500 Cafetería Nagasaki: Insufficient legal basis for data processing The AEPD found that the Nagasaki Cafetería did not comply with its obligations under the GDPR, as it placed its surveillance cameras in such a way as to monitor the public space… SPAIN · ·Art. 5, 6 Feb 4, 2020
€5,000 Queseria Artesenal Ameco S.L.: Insufficient legal basis for data processing The company processed personal data of customers without required consent. SPAIN · ·Art. 5, 6 Feb 3, 2020
€75,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The fine preceded the complaint by the data subject, who argued that Vodafone España had signed a contract for the transfer of a telephone subscription with a third party without… SPAIN · ·Art. 5, 6 Feb 3, 2020