Content type · 3,651 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€843 Lawyer: Insufficient legal basis for data processing The Hungarian DPA imposed a fine of EUR 843 on a lawyer for having unauthorizedly disclosed documents containing personal data of his client in the course of criminal proceedings. HUNGARY · ·Art. 5, 6, 9 Dec 3, 2021
€60,000 Irish Teacher Council: Insufficient technical and organisational measures to ensure information security The Irish DPA has imposed a fine of EUR 60,000 on the Irish Teaching Council. The Council notified the DPA of a data breach under Art. 33 of the GDPR. Accordingly, two employees… IRELAND ·Art. 5, 32, 33 ·Insufficient technical and organisational measures to ensure information security Dec 2, 2021
€30,000 Ica s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has fined ICA s.r.l. EUR 30,000. The municipality of Collegno had implemented a system developed by ICA through which citizens could pay fines for… ITALY · ·Art. 5, 32 Dec 2, 2021
€2,000 IMAGINA FRAN SPORT, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) fined IMAGINA FRAN SPORT, S.L. EUR 2,000 due to the fact that its privacy policy did not comply with the requirements of Art. 13 GDPR. For instance, the… SPAIN · ·Art. 13 Dec 2, 2021
€5,000 Azienda USL di Parma: Non-compliance with general data processing principles The Italian DPA (Garante) fined Azienda USL di Parma EUR 5,000. A patient filed a complaint with the DPA because she had mistakenly received two reports of diagnostic tests on two… ITALY · ·Art. 5, 9 Dec 2, 2021
€7,000 Società Med Store Saronno s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has fined Società Med Store Saronno s.r.l. EUR 7,000. The nursing home notified the DPA of a data breach pursuant to Art. 33 GDPR. The facility had… ITALY · ·Art. 5, 32 Dec 2, 2021
€30,000 Casa di cura Fondazione Gaetano e Piera Borghi s.r.l.: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has fined Casa di cura Fondazione Gaetano e Piera Borghi s.r.l. EUR 30,000. The nursing home notified the DPA of a data breach pursuant to Art. 33 GDPR.… ITALY · ·Art. 5, 32 Dec 2, 2021
€4,000 Pactum Poland Sp. z o.o.: Insufficient cooperation with supervisory authority Fine for not answering requests for further information of the supervisory authority in due time following a data breach. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Dec 1, 2021
€6,800 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 6,800 on a company. The company had installed a video surveillance system to protect the company's assets, prevent… ·Art. 5, 13 ·Non-compliance with general data processing principles Dec 1, 2021
€5,000 INTRODUCTION BUSINESS CAPITAL MEDIA, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 5,000 on INTRODUCTION BUSINESS CAPITAL MEDIA, S.L.. The data subject had received advertising calls from the controller, although the… SPAIN · ·Art. 21, 23, 48 Dec 1, 2021
€5,000 ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has fined ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE in the amount of EUR 5,000. A data subject had indicated that he had objected to further newsletter… SPAIN · ·Art. 17, 21 Nov 30, 2021
€5,000 ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has fined ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE in the amount of EUR 5,000. A data subject had indicated that he had objected to further newsletter… SPAIN · ·Art. 17, 21 Nov 30, 2021
€1,500 Neighborhood community: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a neighborhood community. The controller had installed video cameras on their private property in such a way that they could capture images of the… SPAIN · ·Art. 5 Nov 30, 2021
€20,000 DAVISER SERVICIOS, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 20,000 on DAVISER SERVICIOS, S.L.. The company had been processing biometric data (fingerprints) of employees for access to… SPAIN · ·Art. 5 Nov 30, 2021
€4,000 TIGERS MARKET, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) imposed a fine of EUR 4,000 on TIGERS MARKET, S.L.. The data subject had received advertising calls from the controller, although the data subject was… SPAIN · ·Art. 21, 23, 48 Nov 29, 2021
€110,000 UAB Prime Leasing: Insufficient technical and organisational measures to ensure information security The Lithuanian DPA has fined UAB Prime Leasing, the operator of the short-term car rental platform CityBee, EUR 110,000. The DPA conducted the investigation on its own initiative… LITHUANIA · ·Art. 32 Nov 29, 2021
€1,000 Restaurant owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined a restaurant owner EUR 1,000 for failing to provide information signs about CCTV surveillance in the establishment. SPAIN · ·Art. 13 Nov 29, 2021
€2,000 Valoris Center S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA (ANSPDCP) has imposed a fine of EUR 2,000 on Valoris Center S.R.L.. The controller notified the DPA of a data breach pursuant to Art. 33 GDPR. A call center… ROMANIA · ·Art. 29, 32 Nov 26, 2021
€400,000 B&T S.p.A.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 400,000 on B&T S.p.A. Two data subjects had complained to the DPA about unsolicited SMS advertising. In addition, they stated that it was… ITALY · ·Art. 5, 6, 12 +3 Nov 25, 2021
€2.8M Dutch Minister of Finance: Insufficient legal basis for data processing The Dutch DPA (AP) has fined the Minister of Finance EUR 2,75 million. In the context of childcare benefit applications, tax offices had processed data on the dual nationality of… THE NETHERLANDS · ·Art. 5, 6, 8 Nov 25, 2021
€585,000 Cabinet Office: Insufficient technical and organisational measures to ensure information security The UK DPA (ICO) has fined the Cabinet Office EUR 585,000. On December 27, 2019, the Cabinet Office published a file on GOV.UK containing the names and uncensored addresses of… UNITED KINGDOM · ·Art. 5, 32 Nov 25, 2021
€200,000 Aimon Srl: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 200,000 on Aimon Srl. Two data subjects had complained about unsolicited SMS advertising from B&T S.p.A. to the DPA. In the course of the… ITALY · ·Art. 5, 6, 12 +1 Nov 25, 2021
€6,000 Società H San Raffaele Resnati s.r.l.: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 6,000 on Società H San Raffaele Resnati s.r.l. The DPA initiated an investigation against the health care provider after it… ITALY · ·Art. 5, 9 Nov 25, 2021
€9,000 UNIÓN FINANCIERA ASTURIANA S.A. E.F.C.: Insufficient legal basis for data processing The Spanish DPA (AEPD) fined UNIÓN FINANCIERA ASTURIANA S.A. E.F.C.. The controller had carried out a credit check on the data subject without any contractual basis for doing so.… SPAIN · ·Art. 6 Nov 24, 2021
€98,000 Norwegian State Pension Fund (SPK): Insufficient legal basis for data processing The Norwegian DPA has imposed a fine of EUR 98,000 on the Norwegian State Pension Fund (SPK). The controller had notified the DPA of a data breach pursuant to Art. 33 GDPR. The… NORWAY · ·Art. 5, 6, 9 Nov 24, 2021
€51,000 Icelandic Ministry of Industry and Innovation: Non-compliance with general data processing principles The Icelandic Data Protection Authority has imposed a fine of EUR 51,000 on the Ministry of Industry and Innovation and a fine of EUR 27,200 on YAY ehf. The fine is related to a… ICELAND ·Art. 5, 6, 7 +4 ·Non-compliance with general data processing principles Nov 23, 2021
€27,200 YAY ehf.: Non-compliance with general data processing principles The Icelandic Data Protection Authority has imposed a fine of EUR 51,000 on the Ministry of Industry and Innovation and a fine of EUR 27,200 on YAY ehf. The fine is related to a… ICELAND ·Art. 5, 6, 28 +1 ·Non-compliance with general data processing principles Nov 23, 2021
€3,000 FUENSANTA S.L.: Insufficient cooperation with supervisory authority The controller failed to provide information requested by the Spanish DPA (AEPD) for investigative purposes. SPAIN · ·Art. 58 Nov 23, 2021
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. A data subject had filed a complaint against the data… SPAIN · ·Art. 6 Nov 23, 2021
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U.. A data subject had filed a complaint with the DPA as the controller had transferred her cell phone line to… SPAIN · ·Art. 6 Nov 23, 2021
€40,000 Vodafone España, SAU: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Vodafone España S.A.U. EUR 40,000. An individual had filed a complaint against Vodafone with the DPA because her cell phone line was transferred… SPAIN · ·Art. 6 Nov 23, 2021
€2,000 ANIVERSALIA NETWORKS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) fined ANIVERSALIA NETWORKS, S.L. EUR 2,000 due to the fact that the privacy policy on its website did not comply with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 Nov 22, 2021
€1,000 Neighborhood community: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine of EUR 1000 on a neighborhood community. The reason for this was that the information sign about a video surveillance system did not contain… SPAIN · ·Art. 13 Nov 22, 2021
€3,000 SPAIN DPA: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a company. The company had requested various personal data from customers for appointment bookings. The DPA found that… ·Art. 13 ·Insufficient fulfilment of information obligations Nov 22, 2021
€800 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 800 on a legal person. The accused did not respond to the complainant's repeated requests for copies of the telephone recordings. CZECH REPUBLIC · ·Art. 12 Nov 19, 2021
€30,000 Vodafone España, SAU: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España SAU. A data subject had filed a complaint with the AEPD against the data controller. The data subject states that he… SPAIN · ·Art. 6 Nov 15, 2021
€40,000 Vodafone España, SAU: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España SAU. An individual had filed a complaint with the DPA. The data subject claims to have received text messages from… SPAIN · ·Art. 6 Nov 15, 2021
€1,000 Supermarket: Insufficient fulfilment of information obligations Usage of CCTV camera without proper information. SPAIN · ·Art. 13 Nov 15, 2021
€1,000 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) imposed a fine of EUR 1,000 on a private individual for the unauthorized installation of a video surveillance camera on their car. The car had been parked… SPAIN · ·Art. 5 Nov 15, 2021
€2,900 Vodafone România SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA (ANSPDCP) has imposed a fine of EUR 2,900 on VODAFONE România S.A.. The company had reported a data breach to the DPA in accordance with Art. 33 GDPR. In the… ROMANIA · ·Art. 3, 32 Nov 14, 2021
€3,000 AD735 DATA MEDIA ADVERTISING S.L.: Insufficient cooperation with supervisory authority Failure to provide requested information to the Spanish DPA (AEPD) within the required timeframe in violation of Art. 58 GDPR. SPAIN · ·Art. 58 Nov 12, 2021
€925,000 WS WiSpear Systems Ltd: Non-compliance with general data processing principles The Cypriot DPA has imposed a fine of EUR 925,000 on WS WiSpear Systems Ltd. The company had collected various data from individuals (Media Access Control addresses and… CYPRUS ·Art. 5 ·Non-compliance with general data processing principles Nov 12, 2021
€400,000 Transavia: Insufficient technical and organisational measures to ensure information security The Dutch DPA has fined airline Transavia EUR 400,000. In 2019, the airline suffered a data breach, in which a hacker gained access to Transavia's systems through two accounts… THE NETHERLANDS · ·Art. 32 Nov 12, 2021
€1,500 Company: Insufficient fulfilment of information obligations Usage of CCTV camera without proper information. SPAIN · ·Art. 13 Nov 12, 2021
€150,000 TIM S.p.A.: Insufficient fulfilment of data subjects rights The Italian DPA (Garante) has fined mobile operator TIM S.p.A. EUR 150,000 for denying a data subject access to his phone data needed to defend himself in a criminal case. Since… ITALY · ·Art. 15 Nov 11, 2021
€1,500 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 1,500 on a company. The company had installed a video surveillance system to ensure that their customers would not have to… ·Art. 5, 13 ·Non-compliance with general data processing principles Nov 9, 2021
€400,000 Régie autonome des transports parisiens: Non-compliance with general data processing principles The French DPA (CNIL) imposed a fine of EUR 400,000 on RATP (the operator of the public transport system in Paris). In May 2020, a trade union filed a complaint with the CNIL… FRANCE · ·Art. 5, 32 Nov 4, 2021
€2,000 COOPERA RC SERVICES, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on COOPERA RC SERVICES. The controller had not provided sufficient contact details through which data subjects could… SPAIN · ·Art. 13 Nov 2, 2021
€1,000 IKEA ROMÂNIA SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA (ANSPDCP) has imposed a fine of EUR 1,000 on IKEA ROMÂNIA SA. The controller had sent a notification to the DPA about a personal data breach under Art. 33 GDPR.… ROMANIA · ·Art. 32 Nov 1, 2021
€5,000 S.P.E.E.H. Hidroelectrica S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA (ANSPDCP) has imposed a fine of EUR 5,000 on S.P.E.H. Hidroelectrica S.A.. The controller had notified the DPA of several breaches of personal data protection… ROMANIA · ·Art. 32 Nov 1, 2021