Content type · 3,609 documents in this view · 3,835 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3609 Processing 2638 Personal Data 2407 Controllers 2025 Processing Agreement 1114 Security 1016 Supervision 859 Healthcare 622 Law Enforcement 568 Monitoring 551 Public Authority 545 Consent 507
€2,000 Private Individual: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine of EUR 2,000 on a private individual. The controller had published the phone number of the data subject to a picture of another person on a… SPAIN · ·Art. 6 Jul 30, 2021
€4,000 Gas inspector: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined a gas inspector. The controller had carried out butane gas checks in the private homes of the data subjects on the basis of a list containing… SPAIN · ·Art. 6 Jul 30, 2021
€600 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a private individual EUR 600 for unauthorized video surveillance. The controller had installed a video surveillance camera which covered, among… SPAIN · ·Art. 5 Jul 30, 2021
€3,000 UNIVERSIDAD A DISTANCIA DE MADRID, S.A.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine on UNIVERSIDAD A DISTANCIA DE MADRID, S.A.. A data subject had filed a complaint against the distance learning university. He stated that… SPAIN · ·Art. 17, 21 Jul 29, 2021
€1,000 APARTAMENTOS PLAYA DE COVACHOS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) imposed a fine of EUR 1,000 on APARTAMENTOS PLAYA DE COVACHOS, S.L.. The controller had installed a video surveillance system at its resort and informed… SPAIN · ·Art. 13 Jul 27, 2021
€3,000 INSTAPACK, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on INSTAPACK, S.L.. A data subject had filed a complaint with the DPA. The reason for the complaint is that he had been… SPAIN · ·Art. 5, 6 Jul 27, 2021
€2,000 Owners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on an owners' association. A data subject claimed to the DPA that the controller had installed a camera that recorded both… SPAIN · ·Art. 5 Jul 27, 2021
€500 Website operator: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) fined a website operator EUR 500 due to the fact that its privacy policy did not comply with the requirements of Art. 13 GDPR. SPAIN · ·Art. 13 Jul 27, 2021
€60,000 PRA Iberia S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined PRA Iberia S.L. EUR 60,000. A data subject had filed a complaint against the controller with the AEPD. The complaint was based on the fact that… SPAIN · ·Art. 6, 15 Jul 27, 2021
€10,000 PERSONAL MARK, S.L.: Insufficient fulfilment of data subjects rights The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on PERSONAL MARK, S.L.. A data subject complained that she was receiving promotional text messages from the controller,… SPAIN · ·Art. 17 Jul 27, 2021
€2,400 PODEMOS PARTIDO POLÍTICO: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on the political party PODEMOS PARTIDO POLÍTICO. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5, 13 Jul 27, 2021
€1,000 NEXTSTEPAGENCY, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined NEXTSTEPAGENCY, S.L. EUR 1,000. A website of the controller lacked reliable data about the owner of the website such as tax number and postal… SPAIN · ·Art. 13 Jul 27, 2021
€2,000 Vasco Andaluza de Inversiones S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on Vasco Andaluza de Inversiones S.L.. The data subject had signed a contract with the gym Fitness Place. In this contract,… SPAIN · ·Art. 6 Jul 27, 2021
€2,000 Body Tonic Shop S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on Body Tonic Shop S.L.. The data subject had signed a contract with the gym Fitness Place. In this contract, the data… SPAIN · ·Art. 6 Jul 27, 2021
€3,000 UST GLOBAL ESPAÑA, S.A.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 3,000 on UST GLOBAL ESPAÑA, S.A.. An employee filed a complaint against the controller with the DPA. UST GLOBAL ESPAÑA, S.A. was… SPAIN · ·Art. 5 Jul 27, 2021
€4,000 Private Individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a private individual EUR 4,000 for unauthorized video surveillance. The controller had installed two cameras on a public road and another in a… SPAIN · ·Art. 5 Jul 27, 2021
€2,000 Gerco Fit S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on Gerco Fit S.L.. The data subject had signed a contract with the gym Fitness Place. In this contract, the data subject… SPAIN · ·Art. 6 Jul 27, 2021
€900 Owners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine on an owners' association. A data subject claimed to the DPA that the controller had installed a camera on one of his houses, which… SPAIN · ·Art. 5 Jul 27, 2021
€400,000 Monsanto Company: Insufficient fulfilment of information obligations The French DPA (CNIL) has fined MONSANTO EUR 400,000. In May 2019, several media revealed that MONSANTO was in possession of a file containing the personal data of more than 200… FRANCE · ·Art. 14, 28 Jul 26, 2021
€2,000 Fincas Miguel García S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has fined Fincas Miguel García S.L. in the amount of EUR 2,000. A data subject had filed a complaint against the controller, alleging a breach of Art. 13… SPAIN · ·Art. 13 Jul 26, 2021
€2.5M Mercadona S.A.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Mercadona S.A. EUR 2,520,000. The controller had installed facial recognition systems in Mercadona stores for the purpose of tracking individuals… SPAIN · ·Art. 5, 6, 9 +4 Jul 26, 2021
€2,000 Intersumi S.C.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine of EUR 2,000 on Intersumi S.C.. The controller failed to provide an adequate privacy statement on its website. SPAIN · ·Art. 13 Jul 26, 2021
€200,000 Regione Lombardia: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 200,000 on the Region of Lombardy. The region had published on its website the personal data of more than 100,000 students who… ITALY · ·Art. 5, 6 Jul 22, 2021
€30,000 Flowbird Italia s.r.l.: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 30,000 on Flowbird Italia s.r.l.. The Garante had launched an investigation following a complaint from an individual who had… ITALY · ·Art. 5, 6, 30 Jul 22, 2021
APDCAT advises Catalan draft law transposing EU 2019/1153 lacks data minimization and The Catalan DPA issued an opinion at the request of the Ministry of the Interior in order to evaluate the Law proposal that will transpose the Directive (EU) 2019/1153, laying… PD 6/2021 ·Spain ·Art. 7 Jul 22, 2021
€800,000 Roma Capitale: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 800,000 on Roma Capitale. The Garante had launched an investigation following a complaint from an individual who had complained… ITALY · ·Art. 5, 12, 13 +3 Jul 22, 2021
€400,000 Atac s.p.a.: Non-compliance with general data processing principles The Italian DPA (Garante) has imposed a fine of EUR 400,000 against Atac s.p.a.. The Garante had launched an investigation following a complaint from an individual who had… ITALY · ·Art. 5, 6, 30 +1 Jul 22, 2021
€2.5M Deliveroo Italy s.r.l.: Non-compliance with general data processing principles The Italian DPA (Garante) has fined food delivery service Deliveroo Italy s.r.l. EUR 2,500,000 for unlawfully processing the personal data of approximately 8000 drivers. Garante's… ·Art. 5, 13, 22 +5 ·Non-compliance with general data processing principles Jul 22, 2021
€1.8M SGAM AG2R LA MONDIALE: Non-compliance with general data processing principles The French DPA (CNIL) has fined private insurer SGAM AG2R LA MONDIALE EUR 1,750,000. The CNIL had carried out an inspection at the AG2R LA MONDIALE group in 2019. On this… FRANCE · ·Art. 5, 13, 14 Jul 20, 2021
€67,900 Region of Syddanmark: Insufficient technical and organisational measures to ensure information security The Danish DPA (Datatilsynet) has fined the Region of Syddanmark EUR 67,900 for failing to comply with its obligation as a data controller to implement adequate security measures.… DENMARK · ·Art. 32 Jul 16, 2021
€746M Amazon Europe Core S.à.r.l.: Non-compliance with general data processing principles In its quarterly report, Amazon.com Inc. announced that the DPA from Luxembourg (CNPD) had fined Amazon Europe Core S.à r.l. EUR 746,000,000 for failing to process personal data… LUXEMBOURG · ·Non-compliance with general data processing principles Jul 16, 2021
€45,000 Telefónica Móviles España, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined Telefónica Mobiles España, S.A.U. EUR 45,000. A data subject filed a complaint against the controller with the DPA. His complaint was based on the… SPAIN · ·Art. 6 Jul 12, 2021
€1,500 Aparcamiento Arcusa S.L.U.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on Aparcamiento Arcusa S.L.U. The controller had installed video surveillance cameras which, among other things, also… SPAIN · ·Art. 5, 13 Jul 9, 2021
€80,700 Medicals Nordic I/S: Non-compliance with general data processing principles The Danish DPA (Datatilsynet) has fined Medicals Nordic I/S EUR 80,700. In January 2021, the DPA became aware that Medicals Nordic was using WhatsApp to transmit confidential… DENMARK · ·Non-compliance with general data processing principles Jul 9, 2021
€5,000 Pediatrician: Insufficient fulfilment of data subjects rights The Hellenic DPA has fined a pediatrician EUR 5,000. A father had asked the controller to view the medical records contained in his child's patient file via e-mail. However, the… GREECE · ·Art. 12, 15 Jul 8, 2021
€4,000 Malagatrom S.L.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 4,000 on Malagatrom S.L.U.. The data subject had purchased a product from the controller via the platform 'Amazon', which was… SPAIN · ·Art. 6 Jul 8, 2021
€50,000 Caixabank S.A.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 50,000 on Caixabank S.A.. A data subject had filed a complaint with the DPA because he had received commercial advertising from… SPAIN · ·Art. 6 Jul 8, 2021
€53,800 Nordbornholms Byggeforretning Aps: Insufficient legal basis for data processing The Danish DPA ( Datatilsynet) has imposed a fine of EUR 53,800 on Nordbornholms Byggeforretning Aps. In 2018, the DPA was contacted by a data subject who complained that his… DENMARK · ·Art. 5, 6 Jul 7, 2021
€2,000 Homeowners Association: Non-compliance with general data processing principles Usage of CCTV camera which also captured the public space in violation of the principle of data minimisation. SPAIN · ·Art. 5 Jul 7, 2021
€4,200 Marbella Resorts S.L.: Insufficient data processing agreement The Spanish DPA (AEPD) has imposed a fine of EUR 7,000 on Marbella Resorts S.L.. In the case at hand, the data subject had booked a room in the hotel complex of the controller. On… SPAIN · ·Art. 28 Jul 6, 2021
Insurance company: Insufficient fulfilment of information obligations The DPA has ex officio, without prior notice, conducted a direct supervision over an insurance company based in Zagreb. Upon inspection of its business facility for carrying out… CROATIA · ·Art. 13, 14 Jul 5, 2021
€25,000 Higher Education Institution: Non-compliance with general data processing principles The Finnish DPA imposed a fine of EUR 25,000 on a higher education institution for data protection violations in the processing of employee location data. The controller had… FINLAND · ·Art. 5, 6 Jul 5, 2021
IT services company: Insufficient technical and organisational measures to ensure information security A Croatian IT company provides IT services to entities such as mobile operators, banks and state institutions in Croatia, as well as to companies abroad (USA, Great Britain, the… CROATIA · ·Art. 32 Jul 5, 2021
€1,500 Private Individual: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 1,500 on a private individual. That private individual had published personal data of the data subject on a website without her… SPAIN · ·Art. 6 Jul 2, 2021
€6,000 Private Individual: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of Euro 6,000 on a private individual. On July 8, 2020, the DPA became aware of the dissemination on social networks of a video showing… SPAIN · ·Art. 6 Jul 1, 2021
€1,000 SPAIN DPA: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 1,000 on a company. The controller had used the personal data of a third party in order to obtain a microcredit. The DPA states… ·Art. 6 ·Insufficient legal basis for data processing Jul 1, 2021
€3,000 Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra: Insufficient fulfilment of data breach notification obligations The Polish DPA (UODO) has imposed a fine of EUR 3,000 on the Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra Foundation for the promotion of mediation and legal… POLAND · ·Art. 33, 34 Jun 30, 2021
€12,500 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 12,500 on a company. The company had installed a video surveillance system for the purpose of protecting company property,… ·Art. 5, 13 ·Non-compliance with general data processing principles Jun 29, 2021
€8,500 Magazine publisher: Insufficient legal basis for data processing The Finnish DPA has imposed a fine of EUR 8,500 on a magazine publisher. The DPA received four complaints against the magazine publisher for unsolicited telephone advertising.The… FINLAND · ·Art. 5, 7, 12 +3 Jun 24, 2021
€10,000 TNT EXPRESS WORLDWIDE SPAIN, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 10,000 on TNT EXPRESS WORLDWIDE SPAIN, S.L.. The data subject had placed a private order with the controller and had entered the… ·Art. 5 ·Non-compliance with general data processing principles Jun 22, 2021