Content type · 3,609 documents in this view · 3,835 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3609 Processing 2638 Personal Data 2407 Controllers 2025 Processing Agreement 1114 Security 1016 Supervision 859 Healthcare 622 Law Enforcement 568 Monitoring 551 Public Authority 545 Consent 507
€5,000 Ciechi Ardizzone Gioeni di Catania: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the Ciechi Ardizzone Gioeni di Catania residential home for blind people. A visitor to the residence filed a complaint… ITALY · ·Art. 5, 12, 13 +1 Sep 16, 2021
€5,000 La Prima S.r.l.: Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 5,000 on the real estate portal La Prima S.r.l.. A data subject had filed a complaint against the controller with the DPA. She… ITALY · ·Art. 5, 6, 24 +1 Sep 16, 2021
€3.3M Sky Italia S.r.l.: Insufficient legal basis for data processing The Italian DPA (Garante) has fined Sky Italia S.r.l. EUR 3,296,326 for illegal telemarketing. The DPA's decision followed a complex investigation launched after dozens of reports… ITALY · ·Art. 5, 6, 7 +5 Sep 16, 2021
€200,000 Bocconi University: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 200,000 on Bocconi University. A student had filed a complaint with the DPA about possible GDPR violations related to the use… ITALY · ·Art. 2, 5, 6 +6 Sep 16, 2021
€10,000 Favrskov municipality: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 10,000 on Favrskov municipality. On August 19, 2020, the DPA received a notification from Favrskov Municipality of a personal data breach… DENMARK · ·Art. 32 Sep 16, 2021
€1,000 Farpa s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1,000 on Farpa s.r.l.. The company had installed video surveillance systems in social facilities it operates, however, their specific use… ITALY · ·Art. 5, 13, 88 +1 Sep 16, 2021
€4,000 Frigorifica Botana S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 4,000 on Frigorifica Botana S.L.. The main activity of Frigorífica Botana is freezing, storing and processing seafood. Based on a… SPAIN · ·Art. 5 Sep 16, 2021
€3,000 Société nouvelle de l’annuaire français: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has fined Société nouvelle de l'annuaire français (SNAF) EUR 3,000. SNAF operates the website annuairefrancais.fr, which lists French companies based on data… FRANCE · ·Art. 16, 17, 30 +1 Sep 15, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing.The data subject stated that several telephone lines were… SPAIN · ·Art. 6 Sep 14, 2021
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing. The data subject stated that two telephone lines were registered… SPAIN · ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. for insufficient legal basis for data processing. The data subject stated that he received a call from Vodafone in… SPAIN · ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that, unauthorized third parties had… SPAIN · ·Art. 6 Sep 14, 2021
€56,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on Vodafone España, S.A.U. due to insufficient legal basis for data processing. The data subject stated that unauthorized third parties… SPAIN · ·Art. 6 Sep 14, 2021
€1,000 Hairdressing salon: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a hairdressing salon. The controller had installed video surveillance cameras and had not properly informed the data… SPAIN · ·Art. 13 Sep 13, 2021
€1,000 GESTIONES AUTO LOW COST S. L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 1,000 on GESTIONES AUTO LOW COST S. L. due to the fact that the company's website did not contain a privacy policy. SPAIN · ·Art. 13 Sep 13, 2021
€9,000 Website operator: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 9,000 on the controller of a website. A person had filed a complaint with the DPA due to the fact that the controller had… SPAIN · ·Art. 6, 13 Sep 13, 2021
€53,800 Midtjylland Region: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 53,800 on Midtjylland Region. On June 12, 2020, the DPA received a notification from the region regarding a personal data security breach… DENMARK · ·Art. 32 Sep 8, 2021
€1,400 Vodafone Ireland Limited: Insufficient fulfilment of data subjects rights The Irish DPA has fined Vodafone Ireland Limited EUR 1,400. Vodafone had in several cases sent marketing SMS and emails and made telephone calls without the consent of the data… ·Art. 21 ·Insufficient fulfilment of data subjects rights Sep 7, 2021
€25,000 Hellenic Technical Enterprises Ltd.: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 25,000 on Hellenic Technical Enterprises Ltd.. The controller hat designed the ticket sales system of the soccer clubs AC Omonia and… CYPRUS · ·Art. 32 Sep 6, 2021
€40,000 APOEL FC: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 40,000 on the soccer club APOEL FC. Due to a lack of security measures in the club's ticket sales system, it was possible for an… CYPRUS · ·Art. 32 Sep 6, 2021
€40,000 AC Omonia: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 40,000 on the soccer club AC Omonia. Due to a lack of security measures in the club's ticket sales system, it was possible for an… CYPRUS · ·Art. 32 Sep 6, 2021
€1,500 AMPUDIA DIAZ, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on AMPUDIA DIAZ, S.L.. The controller had installed a video surveillance system in its premises, which recorded a public… SPAIN · ·Art. 5, 13 Sep 4, 2021
€8,000 Rhodes Municipal Transport Company: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 8,000 on the Rhodes Municipal Transport Company. A former employee had filed a complaint against the controller with the DPA. The former… GREECE · ·Art. 5, 12, 15 Sep 3, 2021
€4,000 Automecanica Jerez, S.L.: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has fined Automecanica Jerez, S.L. EUR 4,000. The controller had sent commercial e-mails to a large number of people without their consent. In doing so, the… SPAIN · ·Art. 5, 21, 32 Sep 2, 2021
€225M WhatsApp Ireland Ltd.: Insufficient fulfilment of information obligations The Irish DPA (DPC) has imposed a fine of EUR 225,000,000 on WhatsApp Ireland Ltd. The DPA had started extensive investigations into the messaging service's compliance with… ·Art. 5, 12, 13 +1 ·Insufficient fulfilment of information obligations Sep 2, 2021
€6,000 Furnishyourspace S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 6,000 on FurnishYourSpace S.L.. The AEPD had received a complaint from the Berlin DPA via the EU Internal Market Information System… SPAIN · ·Art. 5, 6, 12 +2 Aug 30, 2021
€5,000 NOW DOCTOR – Εταιρία Παροχής Ηλεκτρονικών Υπηρεσιών Αναζήτησης και Προβολής Ιατρών Ε.Π.Ε.: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 5,000 on the operator of the medical platform nowdoctor.gr that enables online booking of medical appointments. A doctor had filed a… GREECE · ·Art. 5, 6, 12 +1 Aug 26, 2021
€20,000 Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 20,000 on Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ. A data subject had filed a complaint against the controller after it failed to… GREECE · ·Art. 12, 15 Aug 26, 2021
€20,000 National Bank of Greece: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 20,000 on the National Bank of Greece. A data subject had filed a complaint against a company and the bank after they failed to comply… ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Aug 26, 2021
€1,000 Owners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on an owners' association. The controller had unlawfully installed a video surveillance system in a residential complex… SPAIN · ·Art. 5 Aug 26, 2021
€120,000 Banco Bilbao Vizcaya Argentaria, S.A.: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine on Banco Bilbao Vizcaya Argentaria, S.A.. The reason for this had been a complaint from a person relating to a lack of authentication.… SPAIN · ·Art. 32 Aug 25, 2021
€3,000 Actamedica SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA (ANSPDCP) has fined Actamedica SRL EUR 3,000. The controller had informed a private individual about the loss of her biological samples and a sum of money sent… ROMANIA · ·Art. 28, 32, 33 Aug 24, 2021
€2,000 Company owner: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on a company owner. A person had applied for a job at the controller's company and sent the controller his CV via WhatsApp.… SPAIN · ·Art. 13 Aug 23, 2021
€1,800 Agency: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine on an agency. The controller had disposed of documents containing personal data of its clients in the garbage. The AEPD considered this… SPAIN · ·Art. 32 Aug 23, 2021
€1,500 MOVE Ireland: Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) has fined the organization MOVE (Men Overcoming Violence) EUR 1,500. MOVE is a charity working in the field of domestic violence. The organization aims to… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Aug 20, 2021
€20,100 Danish Immigration Agency: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 20,100 on the Danish Immigration Agency. Media reports brought the DPA's attention to possible logging errors in one of the agency's IT… DENMARK · ·Art. 5, 32 Aug 17, 2021
€2,200 President of the Zgierz District Court: Insufficient technical and organisational measures to ensure information security The Polish DPA (UODO) has imposed a fine of EUR 2,200 on the president of the Zgierz District Court. The president had reported a data breach involving the loss of an unencrypted… POLAND · ·Art. 5, 25, 32 Aug 13, 2021
€1,000 Employer: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on an employer. The controller had installed a video surveillance system without properly informing employees. SPAIN · ·Art. 13 Aug 13, 2021
€9,600 Waxing Palace AS: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 9,600 on the waxing salon operator of Waxing Palace AS. The controller had camera surveillance of the controller's… NORWAY · ·Art. 5, 6, 13 Aug 12, 2021
€2,000 DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES, S.L.. The controller had forwarded two emails containing personal data… SPAIN · ·Art. 5 Aug 10, 2021
€5,000 CLUB GIMNASIA RÍTMICA SAN ANTONIO: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on CLUB GIMNASIA RÍTMICA SAN ANTONIO. A person had filed a complaint against the controller with the AEPD based on the… SPAIN · ·Art. 6 Aug 9, 2021
€1,000 BAZTANDIS, S.L.: Insufficient fulfilment of information obligations Use of surveillance cameras without proper contact information on the data controller, in violation of Art. 13 GDPR. SPAIN · ·Art. 13 Aug 9, 2021
€6,000 Future Vinline S.L.: Insufficient fulfilment of information obligations The Spanish Data Protection Agency (AEPD) has fined Future Vinline S.L.. The privacy policy on the website operated by the controller did not comply with the provisions of the… SPAIN · ·Art. 13 Aug 5, 2021
€3,000 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on a private individual. Two neighbors had complained about the individual to the DPA due to the fact that he had installed… SPAIN · ·Art. 5 Aug 5, 2021
€135,000 Insurance company: Insufficient technical and organisational measures to ensure information security The DPA of Luxembourg has imposed a fine of EUR 135,000 on an insurance company. On October 19, 2018, an employee of the controller had sent an e-mail to an uninvolved third party… LUXEMBOURG · ·Art. 5, 32, 33 Aug 5, 2021
€600 Private individual: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 600 on a private individual. A private individual had sent a document obtained in a court case between the data subject and himself to… AUSTRIA · ·Art. 9 Aug 5, 2021
€96,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on Vodafone España, S.A.U.. A data subject had filed a complaint with the DPA against the controller for failing to comply with her… SPAIN · ·Art. 6, 17 Aug 3, 2021
€3,000 Club Náutico el Estacio: Insufficient technical and organisational measures to ensure information security The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on Club Náutico el Estacio. A data subject filed a complaint against the controller with the AEPD. The complaint is based on… SPAIN · ·Art. 32 Aug 2, 2021
€500,000 Unser Ö-Bonus Club GmbH: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 2,000,000 on Rewe affiliate Ö-Bonus Club GmbH. When signing up for the customer loyalty program jö Bonus Club, the controller is said to… AUSTRIA · ·Art. 6, 7, 12 Aug 2, 2021
€200 Private Individual: Insufficient legal basis for data processing The Romanian DPA (ANSPDCP) has imposed a fine of EUR 200 on a private individual due to the unlawful disclosure of personal data. The controller had disclosed personal data of… ROMANIA · ·Art. 5, 6, 14 Jul 30, 2021