Content type · 3,446 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€8,000 Health Protection Agency of Sardinia (ATS): Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 8,000 on the Health Protection Agency of Sardinia (ATS). A patient had mistakenly received medical records and clinical… ITALY · ·Art. 5, 9 Oct 14, 2021
€20,000 ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ: Insufficient legal basis for data processing The Hellenic DPA has fined ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ EUR 20,000. The company had in several cases carried out marketing… GREECE · ·Art. 6, 12, 21 Oct 14, 2021
€78,000 Bank Millennium S.A: Insufficient fulfilment of data breach notification obligations The Polish DPA (UODO) has imposed a fine of EUR 78,000 on Bank Millennium S.A.. The UODO had become aware of a data protection breach following a complaint against the bank. It… POLAND · ·Art. 33, 34 Oct 14, 2021
€18,000 LUXEMBOURG DPA: Insufficient involvement of data protection officer The DPA from Luxembourg has imposed a fine of EUR 13,200 on a company. According to the DPA, the controller failed to involve the data protection officer in all matters relating… ·Art. 37, 38, 39 ·Insufficient involvement of data protection officer Oct 13, 2021
€40,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on Vodafone España, S.A.U.. A woman filed a complaint against the controller based on the fact that the controller had sent telephone bills… SPAIN · ·Art. 5, 32 Oct 13, 2021
€13,200 LUXEMBOURG DPA: Insufficient involvement of data protection officer The DPA from Luxembourg has imposed a fine of EUR 13,200 on a company. According to the DPA, the controller firstly failed to involve the data protection officer in all matters… ·Art. 38, 39 ·Insufficient involvement of data protection officer Oct 13, 2021
€10,000 MAF.COM ESQUI CLUB: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on MAF.COM ESQUI CLUB. The mother of an underage girl who had attended ski lessons with the controller filed a complaint… SPAIN · ·Art. 7 Oct 11, 2021
DSB (Austria) - 2021-0.698.184 The data subject was a shareholder and managing director of two companies. The controller operated a free online search platform that allowed users to look up companies registered… 2021-0.698.184 ·Art. 6, 51, 57 +1 Oct 8, 2021
€30,000 ORANGE ESPAGNE, S.A.U.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on ORANGE ESPAGNE, S.A.U.. A data subject had filed a complaint with the DPA as she had received a total of 30 calls from Jazztel employees… SPAIN · ·Art. 6 Oct 8, 2021
€5,300 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg has imposed a fine of EUR 5,300 on a company. The company had installed 75 surveillance cameras on its premises as well as tracking devices in some of its… ·Art. 5, 13 ·Non-compliance with general data processing principles Oct 6, 2021
Facebook Ireland Limited: Insufficient fulfilment of information obligations The organization 'None of your business' (NOYB) published a draft decision of the Irish DPA (DPC) on October 13, 2021, which indicates that it proposes a fine between EUR 28… Art. 5, 12, 13 ·Insufficient fulfilment of information obligations Oct 6, 2021
€4,000 CLUB DEPORTIVO SANSUEÑA, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined CLUB DEPORTIVO SANSUEÑA, S.L. EUR 4,000 for adding the cell phone number of a data subject to a WhatsApp group without the data subject's consent. SPAIN · ·Art. 5, 6, 32 Oct 5, 2021
€1,000 Store owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on the owner of a store. The controller had installed a video surveillance system, however, without having placed signs… SPAIN · ·Art. 13 Oct 4, 2021
€5,000 CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L. EUR 5,000 for unlawfully processing an individual's data. Previously, CYNGASA, S.L. had… SPAIN · ·Art. 6 Oct 4, 2021
€2,000 Store owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on the owner of a store. The controller had installed a video surveillance system that covered, among other things, a public… SPAIN · ·Art. 5 Oct 4, 2021
€5,000 PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 5,000 on the company PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ. An individual had attempted to… GREECE · ·Art. 21, 25 Oct 4, 2021
€5,000 CYNGASA, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on CYNGASA, S.L.. The data subject, when requesting a work report, discovered that the controller had disclosed his personal… SPAIN · ·Art. 6 Sep 29, 2021
€11,000 Territorial Administration of the Government of Genoa: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 11,000 on the Territorial Administration of the Government of Genoa. The department had published a file on its website that contained a… ITALY · ·Art. 2, 5, 6 Sep 29, 2021
€2,000 Physician: Insufficient legal basis for data processing The Italian DPA (Garante) has fined a physician EUR 2,000. A patient had complained to the DPA that the doctor had disclosed his personal data to third parties without… ITALY · ·Art. 5, 9 Sep 29, 2021
€10,000 ACONCAGUA JUEGOS S.A.: Insufficient involvement of data protection officer The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on ACONCAGUA JUEGOS S.A.. The controller had failed to appoint a data protection officer and thus violated Art. 37 GDPR. SPAIN · ·Art. 37 Sep 29, 2021
€107,000 Danish Cancer Society: Insufficient technical and organisational measures to ensure information security The Danish DPA has fined the Danish Cancer Society EUR 107,000 for failing to comply with the requirements of the GDPR regarding appropriate security measures. The Danish Cancer… DENMARK · ·Art. 32 Sep 29, 2021
€500,000 Address Broker: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine of EUR 500,000 on an address broker. The controller provided a form for data subjects to exercise their rights. The controller regularly did… AUSTRIA · ·Art. 12 Sep 28, 2021
€3,000 Bar owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a bar owner EUR 3,000. A data subject had filed a complaint with the DPA. He had suffered an accident in the bar which was recorded by the… SPAIN · ·Art. 5 Sep 28, 2021
€9.5M Austrian Post: Insufficient fulfilment of data subjects rights The Austrian DPA imposed a fine of EUR 9.5 million on the Austrian Post on September 28, 2021. The main accusation is that, in addition to the contact options used by Austrian… AUSTRIA · ·Art. 12 Sep 28, 2021
€496,000 Ferde AS: Non-compliance with general data processing principles The Norwegian DPA has fined Ferde AS, a Norwegian toll company, EUR 496,000. Through a report on the state-owned broadcasting company NRK, the Norwegian DPA became aware that… NORWAY · ·Art. 5, 28, 32 +1 Sep 27, 2021
€3,000 SPAIN DPA: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a company. The company had requested various personal data from customers for appointment bookings. The DPA found that… ·Art. 13 ·Insufficient fulfilment of information obligations Sep 24, 2021
€900,000 Vattenfall Europe Sales GmbH: Insufficient data processing agreement The DPA from Hamburg has imposed a fine of EUR 900,000 on Vattenfall Europe Sales GmbH. The fine is related to data matching, which the controller had carried out in the period… GERMANY ·Art. 12, 13 ·Insufficient data processing agreement Sep 24, 2021
€2,000 Istituto Comprensivo - IC Cosenza III “V. Negroni”: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 2,000 on Istituto Comprensivo - IC Cosenza III “V. Negroni”. The educational institution had published a document, which also contained… ITALY · ·Art. 2, 5, 6 +1 Sep 21, 2021
€12,500 Ultra-Technology AS: Insufficient legal basis for data processing The Norwegian Data Protection Authority has imposed a fine of EUR 12,500 on Ultra-Technology AS. Background of the fine is a complaint from a data subject who was credit-checked… NORWAY · ·Art. 6 Sep 21, 2021
€40,200 Høylandet Municipality: Insufficient technical and organisational measures to ensure information security The Norwegian DPA has imposed a fine of EUR 40,200 on the municipality of Høylandet. The latter had reported a data breach to the DPA in accordance with Art. 33 GDPR. An employee… NORWAY · ·Art. 32 Sep 20, 2021
€75,600 ST. OLAVS HOSPITAL HF: Insufficient technical and organisational measures to ensure information security The Norwegian DPA has fined St. Olav's Hospital in the amount of EUR 75,600. The hospital suffered three data leaks in accordance with Art. 33 the GDPR. The first incident had… NORWAY · ·Art. 32 Sep 20, 2021
€18,000 CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L.. The data subject filed a complaint with the AEPD. He had requested an MRI scan of… SPAIN · ·Art. 5 Sep 20, 2021
€67,200 Syddanmark Region: Insufficient technical and organisational measures to ensure information security The Danish DPA imposed a fine of EUR 67,200 on Syddanmark Region. On March 9, 2020, the DPA received a notification from Syddanmark Region regarding a personal data breach… DENMARK · ·Art. 32 Sep 17, 2021
€10,000 Mediterranean Hospital of Cyprus: Insufficient cooperation with supervisory authority The Cypriot DPA has fined Mediterranean Hospital of Cyprus EUR 10,000 for failing to provide information requested by the DPA during an investigation. Art. 31, 58 ·Insufficient cooperation with supervisory authority Sep 17, 2021
€4,000 Frigorifica Botana S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 4,000 on Frigorifica Botana S.L.. The main activity of Frigorífica Botana is freezing, storing and processing seafood. Based on a… SPAIN · ·Art. 5 Sep 16, 2021
€5,000 Comune di Montalbano Jonico: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the municipality of Montalbano Jonico. An individual had filed a complaint against the municipality with the DPA. He… ITALY · ·Art. 2, 5, 6 +1 Sep 16, 2021
€200,000 Bocconi University: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 200,000 on Bocconi University. A student had filed a complaint with the DPA about possible GDPR violations related to the use… ITALY · ·Art. 2, 5, 6 +6 Sep 16, 2021
€10,000 Favrskov municipality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 10,000 on Favrskov municipality. On August 19, 2020, the DPA received a notification from Favrskov Municipality of a personal data breach… DENMARK · ·Art. 32 Sep 16, 2021
€3.3M Sky Italia S.r.l.: Insufficient legal basis for data processing The Italian DPA (Garante) has fined Sky Italia S.r.l. EUR 3,296,326 for illegal telemarketing. The DPA's decision followed a complex investigation launched after dozens of reports… ITALY · ·Art. 5, 6, 7 +5 Sep 16, 2021
€1,000 Farpa s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1,000 on Farpa s.r.l.. The company had installed video surveillance systems in social facilities it operates, however, their specific use… ITALY · ·Art. 5, 13, 88 +1 Sep 16, 2021
€5,000 La Prima S.r.l.: Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the real estate portal La Prima S.r.l.. A data subject had filed a complaint against the controller with the DPA. She… ITALY · ·Art. 5, 6, 24 +1 Sep 16, 2021
€5,000 Ciechi Ardizzone Gioeni di Catania: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the Ciechi Ardizzone Gioeni di Catania residential home for blind people. A visitor to the residence filed a complaint… ITALY · ·Art. 5, 12, 13 +1 Sep 16, 2021
€3,000 Société nouvelle de l’annuaire français: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has fined Société nouvelle de l'annuaire français (SNAF) EUR 3,000. SNAF operates the website annuairefrancais.fr, which lists French companies based on data… FRANCE · ·Art. 16, 17, 30 +1 Sep 15, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that, unauthorized third parties had… SPAIN · ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that unauthorized third parties… SPAIN · ·Art. 6 Sep 14, 2021
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing. The data subject stated that two telephone lines were registered… SPAIN · ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing. The data subject stated that he received a call from Vodafone in… SPAIN · ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing.The data subject stated that several telephone lines were… SPAIN · ·Art. 6 Sep 14, 2021
€1,000 GESTIONES AUTO LOW COST S. L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 1,000 on GESTIONES AUTO LOW COST S. L. due to the fact that the company's website did not contain a privacy policy. SPAIN · ·Art. 13 Sep 13, 2021
€9,000 Website operator: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 9,000 on the controller of a website. A person had filed a complaint with the DPA due to the fact that the controller had… SPAIN · ·Art. 6, 13 Sep 13, 2021