Content type · 3,651 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
2501–2550 of 3,651 sort newestlargest fineoldest
€20,000 Company: €20,000 fine The DPA from Baden-Württemberg has imposed a fine of EUR 20,000 on a company. The company had developed a new office plan that took into account the vaccination status of its… GERMANY ·Unknown Employees Processing Agreement Supervisory Authorities Jan 1, 2022
€17,000 Bank of Cyprus Public Company Ltd.: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 17,000 on Bank of Cyprus Public Company Ltd. In the context of a sale of credit facilities, the bank had inadvertently transferred data… Art. 5, 24, 32 ·Insufficient technical and organisational measures to ensure information security Security Processing Agreement Privacy by Design & Default Jan 1, 2022
€90M Google LLC: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 90,000,000 on GOOGLE LLC. The CNIL received several complaints regarding the manner in which cookies could be… FRANCE ·CNIL ·Art. 82 Cookies Direct Marketing Processing Agreement Dec 31, 2021
€60M Facebook Ireland Ltd.: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 60,000,000 on Facebook Ireland Ltd. The CNIL received several complaints regarding the manner in which cookies… FRANCE ·CNIL ·Art. 82 Social Media Direct Marketing Cookies Dec 31, 2021
€25,000 PLUS REAL ADVERTISEMENT: Insufficient fulfilment of information obligations The Hellenic DPA has imposed a fine of EUR 25,000 on PLUS REAL ADVERTISEMENT. The controller had conducted advertising calls without the consent of the data subjects. In addition,… GREECE ·HDPA ·Art. 11, 13, 14 Personal Data Direct Marketing Controllers Dec 31, 2021
€60M Google Ireland Ltd.: Insufficient legal basis for data processing On December 31, 2021, the French DPA (CNIL) imposed a fine of EUR 60,000,000 on Google Ireland Ltd. The CNIL received several complaints regarding the manner in which cookies… FRANCE ·CNIL ·Art. 82 Cookies Direct Marketing Processing Agreement Dec 31, 2021
€150M CNIL rejects Google's stay request and ne bis in idem challenge in cookie consent case Google LLC is a subsidiary owned wholly by Alphabet Inc. Google Ireland Limited ('GIL') "presents itself" as the headquarters for the Google group's operations in the EEA and… France ·Art. 56 Cookies Telecommunications Material scope (GDPR) Dec 31, 2021
€30,000 INFO COMMUNICATION SERVICES: Insufficient fulfilment of information obligations The Hellenic DPA has imposed a fine of EUR 30,000 on INFO COMMUNICATION SERVICES. The controller had conducted advertising calls without the consent of the data subjects. In… GREECE ·HDPA ·Art. 11, 13, 14 Personal Data Controllers Direct Marketing Dec 31, 2021
€75,000 Greek Ministry of Tourism: Insufficient technical and organisational measures to ensure information security The Hellenic DPA has imposed a fine of EUR 75,000 on the Greek Ministry of Tourism. A data breach had occurred at the authority. According to the DPA, an attempt by a citizen to… GREECE ·HDPA ·Art. 13, 32, 33 +1 Notification Obligation Data Breaches Public Sector Dec 29, 2021
€180,000 SLIMPAY: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) has imposed a fine of EUR 180,000 on the payment institution SLIMPAY. In 2015, SLIMPAY conducted an internal research project in which it processed personal… FRANCE ·CNIL ·Art. 28, 32, 34 Data Breaches Security Privacy by Design & Default Dec 28, 2021
€6,000 REAL CLUB NÁUTICO DE RIBADEO: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on REAL CLUB NÁUTICO DE RIBADEO. The controller had uploaded links to court decisions containing personal data of the data… SPAIN ·aepd ·Art. 6 Social Media Personal Data Controllers Dec 28, 2021
€2,000 VENTANAS MAKE YOURSELF, S.L.: Insufficient fulfilment of information obligations The corporate website did not present a privacy policy on its main page. SPAIN ·aepd ·Art. 13 Supervisory Authorities Dec 28, 2021
€2,000 Call shop manager: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on the manager of a call shop. In the context of a job vacancy, the manager had set up a stand where applicants could submit their… SPAIN ·aepd ·Art. 13 Personal Data Processing Agreement Supervisory Authorities Dec 28, 2021
€300,000 FREE MOBILE: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has imposed a fine of EUR 300,000 on FREEE MOBILE. The CNIL had received numerous complaints regarding the company's failure to comply with data subjects'… FRANCE ·CNIL ·Art. 12, 15, 21 +2 Right to Object Data Subject Rights Exercise Modalities and Procedures Telecommunications Dec 28, 2021
€5,000 Medical clinic: Insufficient fulfilment of information obligations The Finnish DPA has fined a medical clinic EUR 5,000. A customer of the clinic had complained to the DPA that he had not received access to his medical records from the clinic… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 12, 13 +2 Health Data Personal Data Healthcare Dec 26, 2021
€1,500 LA OFICINA BAR: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined LA OFICINA BAR. The bar operated a video surveillance system in which the observation angle of the cameras extended into the public traffic area. The… SPAIN ·aepd ·Art. 5 Video Surveillance IP Address Monitoring Dec 23, 2021
€5,000 HUBSIDE IBÉRICA S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 HUBSIDE IBÉRICA S.L.. A data subject had filed a complaint with the DPA against the controller for charging her several… SPAIN ·aepd ·Art. 6 Controllers Personal Data Processing Agreement Dec 22, 2021
€5,000 Sfam España General s.l.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on Sfam España General s.l.. A data subject had filed a complaint with the DPA against the controller for charging her… SPAIN ·aepd ·Art. 6 Controllers Personal Data Processing Agreement Dec 22, 2021
€6,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 6,000 on a private individual. The person had shared a video on Twitter showing images of a sexual assault by a man on a woman. The… SPAIN ·aepd ·Art. 6 Legitimate Interest Social Media Processing Dec 21, 2021
€1.3M Lisbon City Council: Insufficient legal basis for data processing The Portuguese DPA has imposed a fine of EUR 1.25 million on the Lisbon City Council. The fine is the sum of 225 fines from various violations committed by the municipality since… PORTUGAL ·CNPD ·Art. 5, 6, 9 +2 Religious Beliefs DPIA Fines Dec 21, 2021
€2,000 FUNDACION ESPANOLA DE MEDICINA ESTETICA Y LONGEVIDAD: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on FUNDACION ESPANOLA DE MEDICINA ESTETICA Y LONGEVIDAD. The DPA criticized that the data protection notice of the controller did… SPAIN ·aepd ·Art. 7, 13 Controllers Consent Processing Agreement Dec 21, 2021
€2,000 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 2,000. The data controller had installed video cameras in such a way that they could record images of the public space and… SPAIN ·aepd ·Art. 5 Controllers IP Address Processing Dec 17, 2021
€3,900 T. Stene Transport AS: €3,900 fine The Norwegian DPA has fined T. Stene Transport AS EUR 3,900 due to an unfair credit check on a data subject. NORWAY ·Datatilsynet ·Unknown Personal Data Processing Agreement Supervisory Authorities Dec 17, 2021
€10,000 ASL Latina: Insufficient legal basis for data processing The Italian DPA (Garante) fined ASL Latina EUR 10,000. The controller had mistakenly sent documents containing health data of the data subject to an uninvolved third party. ITALY ·Garante ·Art. 5, 6, 9 Healthcare Health Data Personal Data Dec 17, 2021
€2,000 Online retailer: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on an online retailer. The data subject bought a product from the controller's online store via eBay and paid with Paypal. However,… SPAIN ·aepd ·Art. 6 Controllers Processing Agreement Personal Data Dec 17, 2021
€4,000 CLUB DEPORTIVO RITMO DE ANDALUCÍA: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 2,000 on CLUB DEPORTIVO RITMO DE ANDALUCÍA. The DPA criticized that the data protection notice of the controller did not comply with the… SPAIN ·aepd ·Art. 7, 13 Processing Agreement Controllers Consent Dec 17, 2021
€1,000 Università Telematica Internazionale Uninettuno: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1,000 on Università Telematica Internazionale Uninettuno. A professor had filed a complaint with the DPA against the educational… ITALY ·Garante ·Art. 5 Education Personal Data IP Address Dec 16, 2021
€1,200 Private individual: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a private individual EUR 1,200 for failing to provide sufficient information about a video surveillance system installed at their property. SPAIN ·aepd ·Art. 13 Video Surveillance Monitoring Supervisory Authorities Dec 16, 2021
€6,500 Travel agency: Insufficient technical and organisational measures to ensure information security The Finnish DPA has imposed a fine of EUR 6,500 on a travel agency. A customer of the travel agency informed the DPA to suspect that the company might not process the data of its… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 17, 25 +1 Personal Data Security Processing Agreement Dec 16, 2021
€10,000 Centro di Medicina preventiva s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has fined Centro di Medicina preventiva s.r.l. EUR 10,000. The controller reported a database under Art. 33 GDPR in connection with a cyberattack by a… ITALY ·Garante ·Art. 5, 25, 32 +1 Security Social Media Health Data Dec 16, 2021
€75,000 Bank: Insufficient involvement of data protection officer The Belgian DPA has imposed a fine of EUR 75,000 on a bank. The DPA identified a conflict of interest regarding the data protection officer. In addition to his work as data… BELGIUM ·APD ·Art. 38 Notified Body Responsibilities and Operational Obligations Supervisory Authorities Processing Agreement Dec 16, 2021
€20,000 FCA Italy s.p.a.: Insufficient fulfilment of data subjects rights The Italian DPA has fined FCA Italy s.p.a. EUR 20,000. A former customer of the controller had asked the controller to provide him with the transcripts of telephone conversations… Garante ·Art. 12 ·Insufficient fulfilment of data subjects rights Controllers Personal Data IP Address Dec 16, 2021
€100,000 Ubi Banca spa: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 100,000 on Ubi Banca spa (now Intesa Sanpaolo spa). A data subject had filed a complaint with the DPA for receiving a letter from the… ITALY ·Garante ·Art. 5 Fairness & Transparency Recipient IP Address Dec 16, 2021
€52,000 Motor insurance center: Non-compliance with general data processing principles The Finnish DPA has fined a motor insurance center EUR 52,000. The controller had excessively requested patient data from within the healthcare system for the purpose of… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 25 Insurance Healthcare Health Data Dec 16, 2021
€20,000 Corradi s.r.l.: Non-compliance with general data processing principles The company had left the e-mail account of the data subject active even after the termination of his employment and had automatically forwarded incoming e-mails. The company did… ITALY ·Garante ·Art. 5, 13, 157 Personal Data IP Address Processing Dec 16, 2021
Enel Energia S.p.A: Insufficient legal basis for data processing Originial fine summary: The Italian DPA has fined Enel Energia S.p.A EUR 26.5 million for numerous breaches of the GDPR. Following a complex preliminary investigation launched… ITALY ·Garante ·Art. 5, 6, 12 +7 Personal Data Controllers Processing Agreement Dec 16, 2021
€60,000 Banco Bilbao Vizcaya Argentaria S.A.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Banco Bilbao Vizcaya Argentaria S.A.. A data subject filed a complaint with the DPA due to the fact that the controller repeatedly… SPAIN ·aepd ·Art. 6 Controllers Insurance Personal Data Dec 16, 2021
€13,450 Municipality of Frederiksberg: Insufficient technical and organisational measures to ensure information security The Danish DPA has fined the municipality of Frederiksberg EUR 13,450. On March 1, 2021, the municipality reported a data breach under Art. 33 GDPR. The municipality's dental care… DENMARK ·Datatilsynet ·Art. 32 Data Breaches Security Public Authority Dec 16, 2021
€50,000 IZA OBRAS Y PROMOCIONES, S.A.: Non-compliance with general data processing principles The Spanish DPA has fined IZA OBRAS Y PROMOCIONES, S.A. EUR 50,000. An employee had filed a complaint with the DPA against the company, alleging that the controller had… SPAIN ·aepd ·Art. 5 Personal Data Healthcare IP Address Dec 14, 2021
€2,000 SC Nobiotic Pharma SRL: Insufficient cooperation with supervisory authority Failure to provide requested information to the Romanian DPA within the required timeframe in violation of Art. 58 GDPR. ROMANIA ·ANSPDCP ·Art. 58 Supervisory Authorities Supervision Processing Agreement Dec 13, 2021
€6.3M Grindr LLC: Insufficient legal basis for data processing The Norwegian DPA has fined Grindr LLC EUR 6.3 million. Grindr is a location-based social networking app designed for gay, bi, trans and queer people. In 2020, the Norwegian… NORWAY ·Datatilsynet ·Art. 6, 9 IP Address Fines Direct Marketing Dec 13, 2021
€20,000 Elektro & Automasjon Systemer AS: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) fined Elektro & Automasjon Systemer AS EUR 20,000. The controller had carried out a credit check on an individual, although there was no legal… NORWAY ·Datatilsynet ·Art. 6 Controllers Processing Agreement Processing Dec 13, 2021
€110,000 Limerick City and County Council: Insufficient fulfilment of data subjects rights The Irish DPA has fined Limerick City and County Council EUR 110,000. As part of an investigation, the DPA conducted an audit of the processing of personal data by the council or… IRELAND ·Art. 12, 13, 15 ·Insufficient fulfilment of data subjects rights Video Surveillance Right of Access Personal Data Dec 9, 2021
€10,000 Warsaw University of Technology: Insufficient technical and organisational measures to ensure information security The Polish DPA (UODO) has fined Warsaw University of Technology EUR 10,000. The university had reported a data breach to the authority pursuant to Art. 33 GDPR. One of the… POLAND ·UODO ·Art. 5, 24, 25 +1 Data Breaches Security Education Dec 9, 2021
€10,000 BELGIUM DPA: Insufficient fulfilment of data subjects rights The Belgian DPA has imposed a fine of EUR 10,000 against a company. The data subject had repeatedly received mail with advertising content from a company, although he had objected… APD ·Art. 12, 14, 15 +2 ·Insufficient fulfilment of data subjects rights Personal Data Direct Marketing Processing Dec 8, 2021
€30,000 One Way Private Company: Insufficient technical and organisational measures to ensure information security The Hellenic DPA has imposed a fine of EUR 30,000 on One Way Private Company. The DPA received 17 complaints regarding illegal telephone calls for the purpose of advertising. The… GREECE ·HDPA ·Art. 11, 28, 32 Security Telecommunications Controllers Dec 8, 2021
€24,000 NBQ Technology, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined NBQ Technology, S.A.U.. A data subject filed a complaint with the DPA against the company after they had denied him a financial transaction due to… SPAIN ·aepd ·Art. 6 Controllers Insurance Processing Agreement Dec 7, 2021
€608,000 Psykoterapiakeskus Vastaamo: Non-compliance with general data processing principles The Finnish DPA has fined Vastaamo psychotherapy center EUR 608,000. In September 2020, the psychotherapy center reported an attack on its patient database to the DPA. An… FINLAND ·Deputy Data Protection Ombudsman ·Art. 5, 33, 34 Integrity and Confidentiality Principle Healthcare Liability Dec 7, 2021
€6,000 Telekom Romania Communications SA: Non-compliance with general data processing principles The Romanian DPA (ANSPDCP) imposed a fine of EUR 6,000 on Telekom Romania Communications SA. A data subject had complained that the controller had sent invoices and messages to… ANSPDCP ·Art. 5, 17 ·Non-compliance with general data processing principles Personal Data IP Address Telecommunications Dec 6, 2021
€1,000 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a store owner EUR 1,000 for failing to provide information signs about CCTV surveillance in the establishment. SPAIN ·aepd ·Art. 13 Video Surveillance Monitoring Supervisory Authorities Dec 3, 2021