Content type · 3,594 documents in this view · 3,835 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2638 Personal Data 2400 Controllers 2025 Processing Agreement 1114 Security 1016 Supervision 851 Healthcare 622 Law Enforcement 568 Monitoring 551 Public Authority 540 Consent 507
€525,000 DPG Media Magazines B.V.: Insufficient fulfilment of data subjects rights The Dutch DPA has imposed a fine of EUR 525,000 on DPG Media Magazines B.V. The DPA had received several complaints regarding the way the controller handled requests from… THE NETHERLANDS · ·Art. 12 Jan 14, 2022
€1,500 Private individual: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour. SPAIN · ·Art. 5 Jan 14, 2022
€8M REWE International AG: €8,000,000 fine The Austrian DPA has imposed a fine of EUR 8 million on REWE International AG. Just in the summer of 2021, the subsidiary 'Unser Ö-Bonus Club GmbH' received a fine of EUR 2… AUSTRIA · ·Unknown Jan 14, 2022
€7,500 Azienda Sanitaria Locale Frosinone: Insufficient fulfilment of information obligations The Italian DPA has fined Azienda Sanitaria Locale Frosinone EUR 7,500. In the course of its investigation against the medical facility, the Garante found that their privacy… ITALY · ·Art. 5, 12, 13 Jan 13, 2022
€1,500 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Jan 13, 2022
€1,000 A.S.L. Napoli 1 Centro: Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 1,000 on A.S.L. Napoli 1 Centro. An employee at the health authority had filed a complaint with the DPA against the… ITALY · ·Art. 2, 5, 6 Jan 13, 2022
€1,000 Villa Masi Residenza per anziani: Insufficient fulfilment of information obligations Inexistence of signalization regarding the use of CCTV systems in a nursing care facility. ITALY · ·Art. 13 Jan 13, 2022
€14,000 Azienda sanitaria unica regionale Marche: Insufficient technical and organisational measures to ensure information security The Italian DPA has imposed a fine of EUR 14,000 on Azienda sanitaria unica regionale Marche. The DPA launched an investigation against the health department following media… ITALY · ·Art. 5, 32, 35 Jan 13, 2022
€4,000 Medicina & Lavoro s.r.l.: Insufficient fulfilment of data subjects rights Failure to respond to the data subject's request for access to their data in a timely manner. ITALY · ·Art. 12, 15 Jan 13, 2022
€9,000 EDUCANDO JUNTOS SL: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 9,000 on EDUCANDO JUNTOS SL. The controller had published photos of an employee on some of its channels on social networks and its… SPAIN · ·Art. 6, 17 Jan 11, 2022
€3,000 Property Owner Community: Non-compliance with general data processing principles Usage of CCTV camera which also captured the public roads outside in a violation of the so called principle of data minimisation. SPAIN · ·Art. 5 Jan 11, 2022
€1,000 Εγνατία Οδός Α.Ε.: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 1,000 on Εγνατία Οδός Α.Ε. The company operated a video surveillance system to monitor the payment of tolls. A car owner, who had… GREECE · ·Art. 12 Jan 5, 2022
EDPS: European Parliament is sole controller for COVID testing website and failed In January 2021, noyb filed a complaint against the European Parliament on behalf of six Members of the European Parliament over an internal coronavirus testing website. The… 2020-1013 ·European Union ·Art. 6, 13 Jan 5, 2022
Bank: Insufficient technical and organisational measures to ensure information security The DPA of Brandenburg has imposed a five-digit fine on a bank. The bank had installed a video surveillance system that covered parts of the foyer of the branch with ATMs, the… GERMANY ·Art. 28, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2022
€1,000 Physician: Insufficient technical and organisational measures to ensure information security A physician's office had disposed of records of positive and negative Covid-19 Antigen Rapid test results from patients in a public waste disposal site. GERMANY · ·Art. 32 Jan 1, 2022
€500 The DPA from Baden-Württemberg imposed a fine of EUR 500 on a restaurant The owner had disposed of a large quantity of Covid contact forms in the forest. Restaurant: €500 fine ·GERMANY ·Unknown Jan 1, 2022
€5,000 Cyprus Judo Federation: Insufficient cooperation with supervisory authority The Cypriot DPA has imposed a fine on the Cyprus Judo Federation. The father of a member had filed a complaint with the DPA because the judo coach of his minor son had published… ·Art. 31 ·Insufficient cooperation with supervisory authority Jan 1, 2022
LATVIA DPA: Insufficient cooperation with supervisory authority Five fines for failing to comply with orders issued by the DPA. ·Art. 58 ·Insufficient cooperation with supervisory authority Jan 1, 2022
Logistics company: Insufficient technical and organisational measures to ensure information security A logistics company had disposed of delivery lists in a public waste paper container. The lists contained a large amount of detailed information, such as the first and last names… GERMANY · ·Art. 32, 33 Jan 1, 2022
Job center employee: Insufficient legal basis for data processing A job center employee had accessed data in the job center database systems for private research purposes GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
€6,000 Hermes Airport Ltd.: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 6,000 on Hermes Airport Ltd. The controller had suffered a cyber attack which, according to the DPA, had been caused due to a lack of… CYPRUS · ·Art. 24, 32 Jan 1, 2022
€50,000 Company: Insufficient fulfilment of data subjects rights The DPA of Niedersachsen has imposed a fine of EUR 50,000 on a company. The company sent out a newsletter by e-mail that could not be unsubscribed from due to technical… GERMANY ·Art. 15, 21 ·Insufficient fulfilment of data subjects rights Jan 1, 2022
€2,700 Covid-19 test center: Insufficient technical and organisational measures to ensure information security The DPA of Hamburg has imposed a fine of EUR 2,700 on a Covid-19 test center. The test center had send the data subjects an unencrypted e-mail containing a URL that allowed them… GERMANY · ·Art. 32 Jan 1, 2022
€6,500 Pharmacy: Non-compliance with general data processing principles The DPA of Baden-Württemberg imposed a fine of EUR 6,500 on a pharmacy. The pharmacy had disposed of a large number of personal documents, including diagnoses and medical… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2022
LATVIA DPA: Insufficient cooperation with supervisory authority Six fines for failing to provide information requested by the DPA during an investigation. ·Art. 58 ·Insufficient cooperation with supervisory authority Jan 1, 2022
€2,000 Oroklini Municipal Council: Insufficient cooperation with supervisory authority The Cypriot DPA has fined the Oroklini Municipal Council EUR 2,000 for not properly cooperating with the DPA during an investigation. CYPRUS · ·Art. 31 Jan 1, 2022
Physician: Insufficient legal basis for data processing The DPA of Nordrhein-Westfalen has fined a physician. The physician had responded to a negative online reviews regarding their practice, disclosing personal data of a patient. GERMANY ·Art. 5, 6, 9 ·Insufficient legal basis for data processing Jan 1, 2022
€3,750 PRINTAFORM Ltd.: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 3,750 on PRINTAFORM Ltd. PRINTAFORM, which worked as a processor for Universal Life Insurance Public Co Ltd, had suffered a data breach… CYPRUS · ·Art. 28, 32 Jan 1, 2022
Aid organization: Insufficient technical and organisational measures to ensure information security The DPA of Brandenburg has imposed a five-figure fine on an aid organization. The aid organization provides transportation for people with illnesses. The organization had reported… GERMANY ·Art. 28, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2022
€5,000 DW Dynamic Works LIMITED: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 5,000 on DW Dynamic Works LIMITED. The controller operated as a processor for Hermes Airport Ltd.. Hermes had suffered a cyberattack… CYPRUS · ·Art. 32 Jan 1, 2022
€5,000 Trucking company: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 5,000 on a trucking company. The controller had disclosed personal data of a former employee to third parties without a valid legal… BULGARIA · ·Art. 6 Jan 1, 2022
€3,500 Universal Life Insurance Public Co Ltd.: Insufficient data processing agreement The Cypriot DPA has imposed a fine of EUR 3,500 on Universal Life Insurance Public Co Ltd. The processor of the data controller had suffered a data breach in which personal data… CYPRUS · ·Art. 24, 28 Jan 1, 2022
€800 Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes in order to obtain information about a colleague. GERMANY ·Insufficient legal basis for data processing Jan 1, 2022
€5,000 Cypriot Ministry of Defense: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 5,000 on the Cypriot Ministry of Defense. The controller had suffered a cyber attack which, according to the DPA, had been caused due to… CYPRUS · ·Art. 24, 32 Jan 1, 2022
€3,400 Company: Insufficient legal basis for data processing The Czech DPA imposed a fine of EUR 3,400 on a company. The data subject had concluded an energy supply contract with the controller in the past, but then duly terminated it.… CZECH REPUBLIC · ·Insufficient legal basis for data processing Jan 1, 2022
Debt collection company: Insufficient legal basis for data processing The DPA from Baden-Württemberg has imposed a fine on a debt collection company. The debt collection company had received investor information from an employee of an insolvent… GERMANY ·Art. 6, 14 ·Insufficient legal basis for data processing Jan 1, 2022
Sports photography company: Insufficient legal basis for data processing The DPA of Berlin has imposed a fine on a sports photography company. A sports photographer had published over 16,000 photos of minors who had taken part in a swimming competition… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
€7,380 Police officer: Insufficient legal basis for data processing A police officer had accessed data in police databases for private research purposes over a period of three years. GERMANY ·Insufficient legal basis for data processing Jan 1, 2022
€7,500 DW Dynamic Works LIMITED: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 7,500 on DW Dynamic Works LIMITED. The controller operated as a processor for the Cypriot Ministry of Denfese. The minsitry had suffered… CYPRUS · ·Art. 32 Jan 1, 2022
€1,300 Website operator: Insufficient fulfilment of data subjects rights The Hungarian DPA has imposed a fine of EUR 1,300 on a website operator. An individual had filed a complaint with the DPA against the controller due to the fact that the… HUNGARY · ·Art. 5, 12, 31 Jan 1, 2022
Credit agency: Insufficient fulfilment of data subjects rights The DPA of Berlin imposed a fine on a credit agency. In the course of its investigation, the DPA found that the controller had stored 27 false addresses and 13 false dates of… GERMANY ·Art. 15 ·Insufficient fulfilment of data subjects rights Jan 1, 2022
Restaurant operator: Insufficient legal basis for data processing The DPA of Berlin has imposed a fine on a restaurant operator. During the Corona pandemic, the operator had required restaurant visitors to fill out forms with their personal data… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
Private individual: Non-compliance with general data processing principles Unlawful use of a dashcam GERMANY · ·Art. 5, 6 Jan 1, 2022
€2,500 MALTA DPA: Insufficient technical and organisational measures to ensure information security The controller has unlawfully disclosed personal data of a data subject. Art. 24, 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2022
Company: Insufficient legal basis for data processing The Latvian DPA has fined a company for issuing loyalty cards to customers without a valid legal basis. LATVIA · ·Art. 5, 6 Jan 1, 2022
€1,500 Physician: Insufficient cooperation with supervisory authority The Cypriot DPA has imposed a fine of EUR 1,500 on a physician. The DPA had conducted an investigation against the physician for the unlawful operation of a video surveillance… CYPRUS · ·Art. 31 Jan 1, 2022
Private individual: Insufficient legal basis for data processing The DPA of Berlin imposed a fine on a private individual. The individual, who worked in a store, had contacted a customer privately using the contact information they had… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2022
€250,000 MALTA DPA: Insufficient technical and organisational measures to ensure information security The controller has failed to implement appropriate technical and organizational measures to protect personal data. Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2022
Company: Non-compliance with general data processing principles The DPA of Bremen has imposed a five-digit fine on a company. The controller had unlawfully used GPS software in its company vehicles, allowing unrestricted monitoring of its… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2022
€500 Private individual: Insufficient legal basis for data processing The DPA of Niedersachsen imposed a fine of EUR 5,00 on a private individual. The individual had taken pictures of numerous young women in public. In the course of its… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2022