Content type · 486 documents in this view · 3,634 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
€900 LfD (Lower Saxony) - Fine EUR 900,000 against bank A commercial bank (controller) used personal data of current and former customers (data subjects) to identify customers with an affinity for digital media usage, in order to… Germany ·Art. 6 Sep 28, 2022
€26,700 TV2 Média Csoport Zrt.: Non-compliance with general data processing principles The Hungarian DPA has fined TV2 Média Csoport Zrt. EUR 26,700. In the course of its investigation, the DPA found that the controller had operated two websites without providing… HUNGARY · ·Art. 5, 6, 12 +1 Sep 26, 2022
€10,000 SOPHIE ET VOILA, S.L: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on SOPHIE ET VOILA, S.L..The wedding dress company had published a picture of a customer in a wedding dress on its Instagram… SPAIN · ·Art. 6 Sep 16, 2022
€80,700 Coin dealer: Non-compliance with general data processing principles The Hungarian DPA imposed a fine of EUR 80,700 on a coin dealer. During its investigation, the DPA found that the privacy policy did not contain sufficient information about the… HUNGARY · ·Art. 5, 6, 7 +2 Sep 12, 2022
€15 HDPA (Greece) - 50/2022 A former teacher (the data subject) at a private primary school (the controller) submitted a complaint to the Greek DPA regarding a video surveillance system in the classrooms,… Art. 5, 6, 12 +2 Sep 9, 2022
€10,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 10,000 on a private individual. The individual had published personal data of another person on a blog without their consent and in a… SPAIN · ·Art. 6 Sep 1, 2022
€600,000 ACCOR SA: Insufficient fulfilment of data subjects rights The French DPA (CNIL) has imposed a fine of EUR 600,000 on ACCOR SA. Both CNIL and other European DPAS had received complaints against ACCOR from several individuals. In the… FRANCE · ·Art. 12, 13, 15 +2 Aug 19, 2022
€197,000 AMPLIFON Hungary Trade and Service Provider LLC: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 197,000 on AMPLIFON Hungary Trade and Service Provider LLC. The DPA had received complaints from several data subjects for having… ·Art. 5, 6, 12 +1 ·Non-compliance with general data processing principles Aug 11, 2022
€1,000 Wabag Water Services SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 1,000 on SC Wabag Water Services SRL. An employee of the company had filed a complaint with the DPA due to the fact that their employer… ROMANIA · ·Art. 5, 6 Aug 9, 2022
€900,000 Hannoversche Volksbank: Insufficient legal basis for data processing The DPA of Lower Saxony has imposed a fine of EUR 900,000 on Hannoversche Volksbank. The bank had analyzed data from active and former customers without their consent. For this… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jul 28, 2022
APD/GBA (Belgium) - 117/2022 The data subject was a former customer of the controller (which remained unknown). The data subject received direct marketing from the controller. The data subject objected to the… 117/2022 ·Art. 6, 12, 15 +1 Jul 26, 2022
€10,000 Stay over s.r.l.: Insufficient fulfilment of data subjects rights The Italian DPA has fined Stay Over s.r.l. EUR 10,000. A former employee had filed a complaint with the DPA. The company had failed to respond to a request for access to personal… ITALY · ·Art. 5, 12, 13 +2 Jul 21, 2022
APD/GBA (Belgium) - 115/2022 During a meeting where the data subject was not present, the data subject's manager (controller) announced her departure and read out a document issued by the company doctor,… 115/2022 ·Art. 5, 6, 9 Jul 19, 2022
€1,500 Physician: Insufficient fulfilment of data subjects rights The Hungarian DPA has imposed a fine of EUR 1,500 on a physician. A patient had asked the doctor to send her complete medical records, such as imaging records as well as consent… HUNGARY · ·Art. 5, 12, 13 Jul 8, 2022
Garante per la protezione dei dati personali (Italy) - 9788429 Social media platform TikTok (the controller) provided personalized advertising to its users (the data subjects) on the legal basis of consent (Article 6(1)(a) GDPR). In June… 9788429 ·Art. 5, 6, 122 Jul 7, 2022
€45,000 Senseonics Inc.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 45,000 on Senseonics Inc. The company had reported a data breach to the DPA pursuant to Art. 33 GDPR, involving an employee accidentally… ITALY · ·Art. 5, 6, 7 +4 Jul 7, 2022
€3,000 FLY FUT, S.L.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine against FLY FUT, S.L., a company specialized in drone footage at soccer matches in the amount of EUR 3,000. A father had filed a complaint with… SPAIN · ·Art. 6 Jun 28, 2022
€2,000 Parliamentary election candidate: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 2,000 on a parliamentary election candidate. A data subject had filed a complaint with the DPA because of receiving unsolicited election… GREECE · ·Art. 11, 12 Jun 24, 2022
SA Rossel & Cie: Insufficient legal basis for data processing Original fine summary: The Belgian DPA has imposed a fine of EUR 50,000 on the media company SA Rossel & Cie. During its investigation, the DPA found GDPR violations on three… BELGIUM · ·Art. 6, 7, 12 +2 Jun 16, 2022
€50,000 Roularta Media Group: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 50,000 on Roularta Media Group. As part of its investigation, the DPA found that the cookie management on two websites operated by… BELGIUM · ·Art. 5, 6, 7 +4 May 25, 2022
€50 APD/GBA (Belgium) - 85/2022 On 16 January 2019, the Executive-committee of the Belgian DPA (GBA) started an investigation on the use of cookies on Belgian media websites. The controller in this case is… Art. 4, 5, 6 +3 May 25, 2022
€42,000 Alquiler Seguro SA: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 42,000 on Alquiler Seguro SA. The company had advertised a job for which the data subject had applied. As part of the application… SPAIN · ·Art. 6 May 24, 2022
€12,000 Comune di Napoli Corpo di Polizia Municipale: Insufficient legal basis for data processing The Italian DPA has fined the police authority 'Comune di Napoli Corpo di Polizia Municipale' EUR 12,000. The police authority had sent a list of names, addresses, tax numbers,… ITALY · ·Art. 5, 6, 88 +1 May 22, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had taken photos of a group of minors as well as police officers without their consent and… SPAIN · ·Art. 6 May 20, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has fined a private individual operating three websites EUR 2,000. During its investigation, the DPA found that all three websites lacked a field for giving… SPAIN · ·Art. 6 May 20, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had shared a video on WhatsApp showing images of a violent attack on the data subject… SPAIN · ·Art. 6 May 12, 2022
€5,000 MISTORE CANARIAS, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 5,000 on MISTORE CANARIAS, S.L.. A person who had made a purchase from the company had filed a complaint against the company with… SPAIN · ·Art. 6 May 3, 2022
€16,000 LABORATORIOS GONZÁLEZ, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined LABORATORIOS GONZÁLEZ, S.L.. The laboratory had sent the results of a Covid-19 test that the data subject had taken not only to them but also to… SPAIN · ·Art. 5 Apr 29, 2022
€15,000 MEDEROS MOVITEN, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 15,000 on MEDEROS MOVITEN, S.L.. The data subject had signed a mobile service contract with the company. However, the company also… SPAIN · ·Art. 6 Apr 28, 2022
€1,000 Educationest s.r.l.: Insufficient legal basis for data processing The Italian DPA has fined Educationest s.r.l. EUR 1,000. The daycare center had sent an email to the families of the children in its care, informing them of the pregnancy and the… ITALY · ·Art. 5, 6 Apr 28, 2022
€40,000 Working Capital Management España, S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine of EUR 40,000 on the credit information agency Working Capital Management España, S.L.. A data subject had filed a complaint with the… SPAIN · ·Art. 6 Apr 28, 2022
€20,000 Nos s.r.l.s.: Insufficient legal basis for data processing The Italian DPA fined Nos s.r.l.s. in the amount EUR 20,000. Nos acted as a processor for Vodafone and did advertising for the telecommunications company. For this purpose, Nos… ITALY · ·Art. 5, 6, 7 +2 Apr 28, 2022
€1,000 ASST di Lodi: Insufficient technical and organisational measures to ensure information security The Italian DPA (Garante) has imposed a fine of EUR 1,000 on ASST di Lodi. The healthcare facility had reported a data breach to the DPA pursuant to Art. 33 GDPR. A patient had… ITALY · ·Art. 5, 9, 32 Apr 26, 2022
€1,200 MOVALIA TRASLADOS, S.L.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) has imposed a fine on MOVALIA TRASLADOS, S.L.U.. During its investigation, the DPA found numerous deficiencies on a website operated by the controller. For… SPAIN · ·Art. 6, 13 Apr 23, 2022
€5,600 Physician: Insufficient legal basis for data processing The Spanish DPA (AEPD) has fined a physician. The physician had used recordings of a patient's treatment for advertising purposes. However, the patient had not consented to this.… SPAIN · ·Art. 6 Apr 22, 2022
AEPD (Spain) - EXP202203606 Resolution No. R/00665/2022 is highlighted by a case concerning a claimant (namely A.A.A) and a respondent party (namely Securitas Direct España, S.A). The claimant filed against… R/00665/2022 ·Art. 17, 55 Apr 22, 2022
€9,000 JIMBO NETWORKS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on JIMBO NETWORKS, S.L.. During its investigation, the DPA found numerous deficiencies on a website operated by the controller. For… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€1,800 Website operator: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on the operator of the website link During its investigation, the DPA found numerous deficiencies on a website operated by the… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€150,000 BASER COMERCIALIZADORA DE REFERENCIA, S.A.: Insufficient legal basis for data processing The Spanish DPA has fined BASER COMERCIALIZADORA DE REFERENCIA, S.A., EUR 150,000. A customer of the company had filed a complaint with the DPA since their electricity supply… SPAIN · ·Art. 6, 32 Apr 11, 2022
€20,000 Made in Italy s.r.l.s.: Insufficient legal basis for data processing The Italian DPA (Garante) has imposed a fine of EUR 20,000 on Made in Italy s.r.l.s.. A data subject had filed a complaint with the DPA after receiving promotional calls from the… ·Art. 6, 7, 15 +5 ·Insufficient legal basis for data processing Apr 7, 2022
€5,000 Mayor: Insufficient legal basis for data processing The Hellenic DPA has fined a mayor EUR 5,000. The mayor had sent documents of an employee of the municipality to third parties without the employee's consent. The DPA considered… GREECE · ·Art. 5 Apr 4, 2022
€1,300 Workshop: Non-compliance with general data processing principles The Hungarian DPA has imposed a fine of EUR 1,300 on a workshop. The workshop had installed a video surveillance system to protect the company's assets. However, the cameras also… HUNGARY · ·Art. 5, 6, 13 Mar 29, 2022
€13,500 Company: Insufficient legal basis for data processing The Hungarian DPA imposed a fine of EUR 13,500 on a company. An individual had filed a complaint with the DPA, stating that the company had published personal data such as their… HUNGARY · ·Art. 5, 6, 12 +1 Mar 2, 2022
€1,000 Civil law firm 'Sabou, Burz & Cuc': Insufficient legal basis for data processing The Romanian DPA has fined the civil law firm 'Sabou, Burz & Cuc' EUR 1,000. The DPA launched an investigation after a client complained that the controller had published their… ROMANIA · ·Art. 5, 6 Feb 22, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had published audiovisual material of a court trial on Twitter without obtaining the… SPAIN · ·Art. 6 Feb 4, 2022
IAB Europe: Insufficient legal basis for data processing The Belgian DPA has imposed a fine of EUR 250,000 on IAB Europe. The DPA had received several complaints against IAB Europe since 2019. In the context of this complaint, the… BELGIUM · ·Art. 5, 6, 9 +8 Feb 2, 2022
€5,000 INCOPROSOL, S.L.: Non-compliance with general data processing principles The Spanish DPA has fined INCOPROSOL, S.L. EUR 5,000. The controller had recorded a telephone conversation with a customer without obtaining the customer's consent. SPAIN · ·Art. 5 Jan 31, 2022
€1,500 Property Owner Community: Insufficient legal basis for data processing Use of CCTV cameras in building complex without obtaining the consent of all the property owners. SPAIN · ·Art. 6 Jan 31, 2022
Belgian DPA rules on competence in cross-border cookie consent complaint involving The respondent owns a website 'YourOnlineChoices', through which data subjects can control their ad experience online. When browsing the web and visiting different websites, they… 11/2022 ·Belgium · Jan 21, 2022
€56,000 VODAFONE ESPAÑA, S.A.U.: Insufficient legal basis for data processing The Spanish DPA (AEPD) imposed a fine on VODAFONE ESPAÑA, S.A.U. due to insufficient legal basis for data processing. The data subject states that two telephone connections were… SPAIN · ·Art. 6 Jan 18, 2022