Content type · 2,650 documents in this view · 3,837 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3612 Processing 2650 Personal Data 2425 Controllers 2036 Processing Agreement 1116 Security 1022 Supervision 865 Healthcare 623 Public Authority 573 Law Enforcement 572 Monitoring 551 Consent 509
€500,000 Futura Internationale: Insufficient fulfilment of data subjects rights Futura Internationale was fined for cold calls after several complainants obtained cold calls, despite having declared directly to the caller and by post that this was not wanted.… FRANCE · ·Art. 5, 6, 13 +4 Nov 21, 2019
€6,000 Sports Bar: Non-compliance with general data processing principles The sports bar operated a video surveillance system in which the observation angle of the cameras extended into the public traffic area. SPAIN · ·Art. 5 Nov 19, 2019
€30,000 Telefónica SA: Non-compliance with general data processing principles Telefónica had charged the complainant various fees in connection with the operation of a telephone line which the complainant had never owned. The reason for this was that the… SPAIN · ·Art. 5 Nov 14, 2019
€3,000 General Confederation of Labour ('CGT'): Insufficient legal basis for data processing The CGT, with the aim of convening a meeting, e-mailed personal data of the complainant, including her home address, family relationship, pregnancy status and the date of an… SPAIN · ·Art. 6 Nov 13, 2019
€60,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Vodafone has sent the customer's invoice data to unauthorised third parties following a customer invoice complaint. Originally, a fine of EUR 75,000 was threatened, but was… SPAIN · ·Art. 6 Nov 6, 2019
€150,000 LATVIA DPA: Insufficient legal basis for data processing Unlawful data processing. No further information available yet. ·Art. 6 ·Insufficient legal basis for data processing Nov 1, 2019
€1,770 L. Sp. z o.o.: Non-compliance with general data processing principles The Polish DPA (UODO) imposed a fine of EUR 1,770 on L. Sp. z o.o. for the video surveillance of a residential community, which was not in compliance with the provisions of the… POLAND · ·Art. 5 Nov 1, 2019
€5,000 Restaurant: Non-compliance with general data processing principles Excessive use of video surveillance in violation of the principle of data minimization. GERMANY ·Art. 5 ·Non-compliance with general data processing principles Nov 1, 2019
€50,000 Menzis (Health Insurance Company): Non-compliance with general data processing principles Marketing staff had access to patient data. Among other things, this violated the purpose limitation principle. THE NETHERLANDS · ·Art. 5 Oct 31, 2019
€6,000 Jocker Premium Invex: Insufficient legal basis for data processing After registering for a local census, Jocker Premium Invex had sent the applicant postal advertisements and commercial offers, although data such as first name, surname and postal… SPAIN · ·Art. 6 Oct 31, 2019
Deutsche Wohnen SE: Non-compliance with general data processing principles In addition to sanctioning violations of privacy by design principles (Art. 5 GDPR, Art. 25 GDPR - see separate entry), the Berlin data protection commissioner imposed further… GERMANY ·Art. 5 ·Non-compliance with general data processing principles Oct 30, 2019
€16M Austrian Post: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 16,000,000 on the Austrian Post. The controller had sold information regarding the political affinity to third parties without a… AUSTRIA · ·Art. 5, 6 Oct 29, 2019
€36,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The claimant, whose data had been provided to the company by his daughter, as authorised by him, received a call from the company offering its services, which he refused. However,… SPAIN · ·Art. 5, 6 Oct 25, 2019
€70,000 LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd: Insufficient legal basis for data processing The decision found that the use of the Bradford factor for profiling and monitoring sick leave constituted unlawful processing of personal data in breach of Article 6 and Article… CYPRUS · ·Art. 6, 9 Oct 25, 2019
€2,000 LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd: Insufficient legal basis for data processing The decision found that the use of the Bradford factor for profiling and monitoring sick leave constituted unlawful processing of personal data in breach of Article 6 and Article… CYPRUS · ·Art. 6, 9 Oct 25, 2019
€10,000 LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd: Insufficient legal basis for data processing The decision found that the use of the Bradford factor for profiling and monitoring sick leave constituted unlawful processing of personal data in breach of Article 6 and Article… CYPRUS · ·Art. 6, 9 Oct 25, 2019
€60,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles Vodafone sent an invoice history to the subscriber as part of the invoice complaint by the subscriber. The history also contained invoice data of an unknown third party. SPAIN · ·Art. 5 Oct 23, 2019
€9,380 Major of Aleksandrów Kujawski: Insufficient data processing agreement No data processing agreement has been concluded with the company whose servers contained the resources of the Public Information Bulletin (BIP) of the Municipal Office in… POLAND · ·Art. 28 Oct 18, 2019
€2,500 UTTIS INDUSTRIES SRL: Insufficient fulfilment of information obligations The sanctions were applied to the controller because he could not prove that the data subjects were informed about the processing of personal data / images through the video… ROMANIA · ·Art. 5, 6, 12 +1 Oct 17, 2019
€60,000 Xfera Moviles S.A.: Insufficient legal basis for data processing Xfera Movile has used personal data without a legal basis for the conclusion of a telephone contract and has continued to process personal data even when the data subject… SPAIN · ·Art. 5, 6 Oct 16, 2019
€47,000 ClickQuickNow: Non-compliance with general data processing principles The UODO imposed a fine of EUR 47000 for obstructing the exercise of the right of withdrawal for the processing of personal data. The company has not taken appropriate technical… POLAND · ·Art. 5 Oct 16, 2019
€2,860 Unknown Company: Non-compliance with general data processing principles An employee was on sick leave when his employer checked his desktop, laptop and emails to ensure that his work-related duties were being covered in his absence. The employer then… HUNGARY · ·Art. 5, 6, 13 +2 Oct 15, 2019
€15,000 Raiffeisen Bank SA: Insufficient technical and organisational measures to ensure information security Original fine summary: Raiffeisen Bank Romania carried out scoring assessments on the basis of personal data of individuals registered on the Vreau Credit platform provided by the… ROMANIA · ·Art. 32 Oct 9, 2019
€20,000 Vreau Credit SRL: Insufficient technical and organisational measures to ensure information security Raiffeisen Bank Romania carried out scoring assessments on the basis of personal data of individuals registered on the Vreau Credit platform provided by the platform's staff via… ROMANIA · ·Art. 32, 33 Oct 9, 2019
€400 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 400 on a legal person. The accused did not meet the objection of two data subjects to the processing of their personal data for direct… CZECH REPUBLIC · ·Art. 21 Oct 8, 2019
€5,112 The Ministry of Interior Affairs: Insufficient legal basis for data processing The fine of EUR 5,112 was imposed on the Ministry of Interior Affairs for unlawfully processing the personal data of data subject A.K. The Ministry of Interior sent the personal… BULGARIA · ·Art. 5, 6 Oct 8, 2019
€200,000 Telecommunication Service Provider: Non-compliance with general data processing principles A large number of customers were subject to telemarketing calls, although they had declared an opt-out for this. This was ignored due to technical errors. GREECE · ·Art. 5, 25 Oct 7, 2019
€200,000 Telecommunication Service Provider: Non-compliance with general data processing principles Inappropriate technical measures resulted in the data of 8,000 customers not being deleted upon request. GREECE · ·Art. 21, 25 Oct 7, 2019
€2,000 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 2,000 on a legal person. The accused circumvented the law when, instead of providing social services with proper authorization, it did so… CZECH REPUBLIC · ·Art. 5, 12, 30 Oct 4, 2019
€15,100 Town of Kerepes: Insufficient legal basis for data processing The city based its video surveillance practice on its legitimate interests (Art. 6 (1) f GDPR). However, accordingt to Art. 6 (1) subparagraph 2 this legal basis shall not apply… HUNGARY · ·Art. 6 Oct 1, 2019
€30,000 Vueling Airlines: Insufficient legal basis for data processing The Spanish Data Protection Agency (AEPD) has sanctioned Vueling Airlines with 30,000 euros for not giving users the ability to refuse their cookies and force them to use them if… SPAIN · ·Art. 5, 6 Oct 1, 2019
€9,000 Inteligo Media SA: Insufficient legal basis for data processing As part of the registration process on the webseite avocatnet.ro, the operator used an unfilled checkbox, by means of which users could declare that they did not wish to receive… ROMANIA · ·Art. 5, 6 Sep 26, 2019
€10,000 Merchant: Non-compliance with general data processing principles The Belgian data protection authority has imposed a fine of 10,000 euros on a merchant who wanted to use an electronic identity card (eID) to create a customer card. The DPA's… BELGIUM · ·Art. 5 Sep 17, 2019
€11,760 Commercial representative of telecommunication service provider: Insufficient legal basis for data processing The pecuniary sanction of EUR 11, 760 was imposed on the commercial representative of telecommunications service provider for unlawful processing of the personal data of a data… BULGARIA · ·Art. 6 Sep 3, 2019
€1,121 Private enforcement agent: Insufficient fulfilment of data subjects rights The fine of EUR 1, 121 was imposed on a private enforcement agent for processing of the personal data of data subject through recording by technical means for video surveillance… BULGARIA · ·Art. 12, 15 Sep 3, 2019
Deliberação 2019/494 In its Opinion 20/2018 concerning the draft of Law 58/2019 which ensures the implementation of the GDPR in the portuguese national legal framework, the DPA drew the attention of… Deliberação 2019/494 ·Portugal · Sep 3, 2019
€5,113 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… BULGARIA · ·Art. 6, 25 Sep 3, 2019
€1,022 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… BULGARIA · ·Art. 6, 25 Sep 3, 2019
€28,100 National Revenue Agency: Insufficient legal basis for data processing The pecuniary sanction of EUR 28, 121 was imposed on the National Revenue Agency for unlawful processing of the personal data of data subject G.B.I. The personal data of G.B.I.… BULGARIA · ·Art. 6, 58 Sep 3, 2019
€18,630 School in Skellefteå: Insufficient legal basis for data processing A school in Skellefteå made a trial to use facial recognition technology. The fine was imposed against the school which had used facial recognition technology to monitor the… SWEDEN ·Art. 5, 9, 35 +1 ·Insufficient legal basis for data processing Aug 20, 2019
€60,000 AVON COSMETICS: Insufficient legal basis for data processing A consumer claimed that AVON COSMETICS had unlawfully processed his data without adequately verifying his identity, which led to his data being erroneously entered in a register… SPAIN · ·Art. 6 Aug 16, 2019
€1,715 Government Office Managing the Real Estate Register: Non-compliance with general data processing principles The owners of a real estate complained that the government office posted its decision on the change in the person of the lessee (which concluded a lease agreement with real estate… HUNGARY · ·Art. 5, 14 Aug 8, 2019
€200 Private person (YouTube-Channel): Insufficient legal basis for data processing The private person used a dashcam to make recordings of public road traffic and then published them on YouTube as a compilation. GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Aug 5, 2019
€4,290 Public area maintenance company: Non-compliance with general data processing principles An ex-employee complained that his employer unlawfully monitored his work by its CCTV. The employer argued that CCTV monitoring was necessary to assess, whether the employee… HUNGARY · ·Art. 5, 6, 13 Aug 2, 2019
€150,000 PWC Business Solutions: Insufficient legal basis for data processing The processing of employee personal data was based on consent. The HDPA found that consent as legal basis was inappropriate, as the processing of personal data was intended to… GREECE · ·Art. 5, 6, 13 +1 Jul 30, 2019
€8,575 Budapest Environs Regional Court: Insufficient legal basis for data processing The chairman of the Budapest Environs Regional Court organised a meeting for court officials, during which he stated that he quit from the Hungarian Association of Judges and… HUNGARY · ·Art. 5, 6 Jul 17, 2019
€3,000 LEGAL COMPANY & TAX HUB SRL: Insufficient technical and organisational measures to ensure information security The fine was imposed because adequate technical and organizational measures to ensure a level of security appropriate to the risk of processing were not implemented. This has led… ROMANIA · ·Art. 32 Jul 5, 2019
€15,000 WORLD TRADE CENTER BUCHAREST SA: Insufficient technical and organisational measures to ensure information security The breach of data security was that a printed paper list used to check breakfast customers and containing personal data of 46 clients who stayed at the hotel's WORLD TRADE CENTER… ROMANIA · ·Art. 32 Jul 2, 2019
€11,000 Private person (soccer coach): Insufficient legal basis for data processing The fine was imposed on a soccer coach who had secretly filmed female players while they were naked in the shower cubicle for years. AUSTRIA · ·Art. 6 Jul 1, 2019
€130,000 UNICREDIT BANK SA: Insufficient technical and organisational measures to ensure information security The fine was issued as a result of the failure to implement appropriate technical and organisational measures (related to (1) the determination of the processing means/operations,… ROMANIA · ·Art. 5, 25 Jun 27, 2019