Content type · 2,666 documents in this view · 3,876 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3650 Processing 2666 Personal Data 2443 Controllers 2048 Processing Agreement 1116 Security 1028 Supervision 883 Healthcare 624 Public Authority 579 Law Enforcement 578 Monitoring 558 Consent 512
€36,000 VODAFONE ONO, S.A.U.: Non-compliance with general data processing principles The company sent a marketing email to a large number of recipients (clients) without using the blind copy feature. The initial fine of EUR 60.000 was reduced to EUR 36.000. SPAIN · ·Art. 5 Jan 1, 2019
€14,000 Doctor: Insufficient legal basis for data processing A patient complained to the Commissioner that the request for access to her medical file was not satisfied by the hospital because the dossier could not be identified/located by… CYPRUS · ·Art. 5, 6 Jan 1, 2019
€2,000 Restaurant: Non-compliance with general data processing principles Video surveillance cameras have been used in violation of principle of data minimisation (monitoring also of customer areas in restaurants). GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2019
€800 Police Officer: Insufficient legal basis for data processing A police officer used a witness's personal data to contact her personally. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2019
€294,000 GERMANY DPA: Non-compliance with general data processing principles A company was fined EUR 294 000 for 'unnecessarily long' storage and retention of personnel files and for 'excessive' data collection in the personnel selection process, during… Art. 5 ·Non-compliance with general data processing principles Jan 1, 2019
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The company had charged a Netflix service that had not been solicited by the claimant. The claimant could prove that the service had been used by another household which allegedly… SPAIN · ·Art. 6 Jan 1, 2019
€160,000 Taxa 4x35: Non-compliance with general data processing principles The Danish DPA reported the taxi company to the police and recommended a fine (of 1.2M DKK) for non-adherence to the data-minimization principle. While the company deleted the… DENMARK · ·Art. 5 Jan 1, 2019
GERMANY DPA: Insufficient legal basis for data processing Nine fines between EUR 350 and EUR 1,000 for unlawful use of a dashcam. Art. 6 ·Insufficient legal basis for data processing Jan 1, 2019
€10,000 Newspaper: Insufficient legal basis for data processing The publication of the newspaper, both in hard copy and in electronic form, allegedly involved inconvenience, unnecessary and unlawful detention of a citizen, and revealed the… CYPRUS · ·Art. 6 Jan 1, 2019
€9,000 Employer: Non-compliance with general data processing principles Video surveillance cameras have not only been used to protect property, but have also monitored employees (violation of principle of data minimisation). SPAIN · ·Art. 5 Jan 1, 2019
€2,200 Private person: Insufficient legal basis for data processing The fine was imposed against a private person who was using CCTV at his home. The video surveillance covered areas which are intended for the general use of the residents of the… AUSTRIA · ·Art. 5, 6, 13 Dec 20, 2018
€5,000 Kolibri Image
Regina und Dirk Maass GbR: Insufficient data processing agreement Please note: According to our information this fine has been withdrawn in the meantime. Kolibri Image had send a request to the Data Protection Authority of Hessen asking how to… GERMANY · ·Art. 28 Dec 17, 2018
€500 Bank: Insufficient legal basis for data processing A fine of 1000 BGN (or roughly 500 EUR) was imposed on a bank for calling a client for the unresolved bills of his neighbor. This provoked the client to evoke his right to be… BULGARIA · ·Art. 5, 6 Dec 4, 2018
€300 Private car owner: Insufficient legal basis for data processing A Dashcam was unlawfully used. AUSTRIA · ·Art. 5, 6 Sep 27, 2018
€1,800 Kebab restaurant: Insufficient legal basis for data processing CCTV was unlawfully used. Sufficient information about the video surveillance was missing. In addition, the storage period of 14 days was too long and therefore against the… AUSTRIA · ·Art. 5, 13, 14 Jan 1, 2018
Norwegian DPA: Legelisten.no may process healthcare reviews without prior consent Legelisten.no AS is a Norwegian limited liability company running a website where people anonymously can post reviews about dentists, doctors, psychologists and other healthcare… 15/01355 ·Norway · Nov 8, 2017