Content type · 3,446 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€80,000 Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital): Insufficient technical and organisational measures to ensure information security According to the data protection authority, personal information about participants in a public competition had been unlawfully disclosed online. The reason for this was that, due… ITALY · ·Art. 5, 6, 13 +2 Sep 30, 2020
€3,000 Venu Sanz Chef, S.L.: Insufficient legal basis for data processing Use of personal data for advertising purposes without sufficient legal basis. SPAIN · ·Art. 5, 6 Sep 30, 2020
€20,050 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 20,050 on a legal person. The accused processes hundreds of thousands of personal data on the website about self-employed persons without… CZECH REPUBLIC · ·Art. 5, 6, 12 +2 Sep 30, 2020
€60,000 Scanshare s.r.l.: Insufficient technical and organisational measures to ensure information security According to the data protection authority, personal information about participants in a public competition had been unlawfully disclosed online. The reason for this was that, due… ITALY · ·Art. 5, 6, 9 +1 Sep 30, 2020
€400 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 400 on a legal person. In connection with the delivery of magazine subscriptions, the company did not provide the data subject with… CZECH REPUBLIC · ·Art. 15 Sep 25, 2020
€60,000 Xfera Moviles S.A.: Insufficient legal basis for data processing Failure to remove the data subject's personal data at the time of cancellation of his/her telephone services contract and sending a warning to the data subject after cancellation… SPAIN · ·Art. 5, 6 Sep 25, 2020
€13,900 Odin Flissenter AS: Insufficient legal basis for data processing The company assessed the credibility of another company and thereby, according to Datatilsynet, processed personal data relating to a natural person (the owner of the company… NORWAY · ·Art. 5, 6 Sep 25, 2020
€400 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 400 on a legal person. Proceedings were initiated following an inspection carried out in response to a complaint. The accused processed and… CZECH REPUBLIC · ·Art. 5, 13, 28 +1 Sep 25, 2020
€60,000 GLP Instalaciones 86, SL: Insufficient legal basis for data processing In order to obtain assistance for the installation of an air conditioning system, the data subject had contacted Naturgy Energy Group S.A. Subsequently, he was contacted by two… SPAIN · ·Art. 5, 6 Sep 22, 2020
€7,800 Iweb Internet Learning, S.L.: Insufficient fulfilment of information obligations Lack of information in the privacy policy (information on the data controller) as well as inadequate obtaining of consent, as only a general consent could be given without… SPAIN · ·Art. 7, 12, 13 Sep 22, 2020
€3,000 Grupo Carolizan: Non-compliance with general data processing principles Operation of CCTV camera systems in an arcade area in front of a building, i.e. also covering public space. This violated the principles of data minimization, as the surveillance… SPAIN · ·Art. 5 Sep 17, 2020
€3,200 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 3,200 on a legal person. The accused processed data from public registers on its website without legal basis and did not respond to… CZECH REPUBLIC · ·Art. 6, 15, 17 Sep 17, 2020
€60,000 Vodafone España, SAU: Insufficient legal basis for data processing A former customer had received e-mails containing electronic bills even after he had terminated his contract with the company resulting in a processing of personal data without… SPAIN · ·Art. 5, 6 Sep 17, 2020
€10,000 Property owners community: Non-compliance with general data processing principles Publication of a document containing personal data (information about identity of the data subject as well as about debts) on a community notice billboard. SPAIN · ·Art. 5 Sep 16, 2020
€8,000 Private Person: Non-compliance with general data processing principles Operation of a CCTV camera that also monitored public space outside the premises of the data controller. GREECE · ·Art. 5 Sep 11, 2020
€1,500 Political Party: Insufficient legal basis for data processing Sending of an e-mail to a former party member who had since resigned, with the request to act as an election representative without sufficient legal basis to process the personal… SPAIN · ·Art. 5, 6 Sep 11, 2020
€2,000 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 2,000 on a legal person. Despite previously assuring the complainant that their personal data had been deleted from the accused's database… CZECH REPUBLIC · ·Art. 6, 17 Sep 8, 2020
€2,000 Sanatatea Press Group S.R.L.: Insufficient technical and organisational measures to ensure information security Sending the personal data collected for the registration for an online course to other participants due to a technical failure. ROMANIA · ·Art. 5, 32 Sep 8, 2020
€5,000 Former mayor of a community: Insufficient legal basis for data processing Originial fine summary: Sending election advertising to citizens without sufficient legal basis. Update: On January 27th, 2021, the Brussels Court of Appeal overturned the fine of… BELGIUM · ·Art. 5, 6 Sep 7, 2020
Privacy Appeals Board: Datatilsynet may demand information from OpenX under GDPR Art. The Norwegian Consumer Council (Forbrukerrådet) filed three complaints against the gay/bi dating app Grindr and five adtech companies that received personal data through the app.… 20/02254 (Grindr) ·Norway ·Art. 57, 58 Sep 7, 2020
€3,000 Barcelona Airport Security Guard Association ('AVSAB'): Non-compliance with general data processing principles A member of the AVSAB security committee used WhatsApp to send messages to private phone numbers containing personal information about employees. This was a violation of the… SPAIN · ·Art. 5 Sep 7, 2020
€2,000 Istituto Comprensivo Statale Crucoli Torretta: Insufficient technical and organisational measures to ensure information security Publication of personal data of students on the website of the Institute with, inter alia, notes about health and progress in school due to technical failure. ITALY · ·Art. 5, 32 Sep 7, 2020
GBP 130,000 ICO - CPS Advisory Limited CPS Advisory Limited (CPSAL) conducted direct marketing calls in relation to personal pensions. The data CPSAL used to conduct the calls had been purchased from third party data… United Kingdom · ·Art. 55A Sep 4, 2020
€276,000 Bergen Municipality: Insufficient technical and organisational measures to ensure information security In October 2019, the Data Protection Authority was informed by the Municipality of Bergen about a data breach in connection with the municipality's tool for communication between… NORWAY · ·Art. 5, 32 Sep 3, 2020
€2,000 Comune di Casaloldo: Insufficient legal basis for data processing Publication of personal data on the website of the community. ITALY · ·Art. 5, 6 Sep 3, 2020
€500 Apartment building owners association: Insufficient legal basis for data processing Export of a still image from a video surveillance system and posting of the image on the billboard of the building without sufficient legal basis. In addition, violation of the… ROMANIA · ·Art. 5, 6, 12 +3 Sep 1, 2020
DSB (Austria) - 2020-0.303.727 In June 2019, the complainant requested erasure of her personal data from the respondent's website, claiming that an article on that website contained wrong statements about her.… 2020-0.303.727 ·Art. 17, 85 Sep 1, 2020
€75,000 Telefónica Móviles España, SAU: Insufficient legal basis for data processing According to the supervisory authority, the company processed personal data without sufficient legal basis, with the result that the data subject received several hundred… SPAIN · ·Art. 5, 6 Sep 1, 2020
€1,200 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 1,200 on a legal person. The complainant, through her attorney, requested access to her personal data. The accused failed to respond, even… CZECH REPUBLIC · ·Art. 15 Aug 31, 2020
€5,000 Basketball Federation of Castilla and Leon: Insufficient legal basis for data processing The Basketball Association transmitted personal data to third parties, which were subsequently published on the Internet without consent of the data subjects. In addition, the… SPAIN · ·Art. 5, 6 Aug 28, 2020
€50,000 Bankia S.A.: Non-compliance with general data processing principles The bank kept personal data of a data subject for several years, even after the data subject was no longer a customer. The data was also accessible to bank employees during this… SPAIN · ·Art. 5 Aug 28, 2020
€2,000 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 2,000 on a legal person. Despite the objection raised by the data subject (the owner of the industrial rights) against the processing and… CZECH REPUBLIC · ·Art. 12 Aug 28, 2020
€65,000 Cork University Maternity Hospital: Insufficient technical and organisational measures to ensure information security The „Data Protection Authority of Ireland“ imposed a fine on Cork University Maternity Hospital (CUMH) after the personal data of 78 patients was discovered disposed of in a… IRELAND ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Aug 18, 2020
€56 Health care worker: Insufficient legal basis for data processing Acess to personal data in a health database for private research activities. ESTONIA · ·Art. 5, 6 Aug 17, 2020
€5,000 Party of the Socialists of Catalonia: Non-compliance with general data processing principles The Socialist Party of Catalonia has used the personal data provided by a professional doctor to send a letter to the complainant's relative asking for political support. This… SPAIN · ·Art. 5 Aug 17, 2020
€48 Police Officer: Insufficient legal basis for data processing Acess to personal data in a police database for private research activities. ESTONIA · ·Art. 5, 6 Aug 17, 2020
€85,000 Tusla Child and Family Agency: Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) fined Tusla Child and Family Agency EUR 85,000. The controller had reported 71 data breaches to the Irish DPA that occurred between May 25 and November 16,… IRELAND ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Aug 12, 2020
€10,000 Cavauto S.R.L.: Insufficient legal basis for data processing Access to personal data of a former employee (containing his browser history) on his work computer. ITALY · ·Art. 5, 6, 7 Aug 10, 2020
€10,000 Community of Baronissi: Insufficient legal basis for data processing The community published on its website personal data of data subjects including names, birth dates, place of birth, place of residence, etc. ITALY · ·Art. 5, 6 Aug 10, 2020
€3,000 GROW BEATS SL: Insufficient fulfilment of information obligations The company had published a cookie policy on its website, which on the one hand contained no information about the purpose of the use of cookies and on the other hand no… SPAIN · ·Art. 12, 13, 14 Aug 6, 2020
€3,000 GTL S.R.L.: Insufficient fulfilment of data subjects rights Failure to graint access to personal data of a data subject according to Art. 15 GDPR. ITALY · ·Art. 12, 15 Aug 6, 2020
€3,000 Just Landed S.L.: Insufficient fulfilment of information obligations Just Landed was fined with EUR 3000 for insufficient cookie information according to national data protection laws and at the same time warned due to insufficient fulfilment of… SPAIN · ·Art. 13 Aug 6, 2020
€2,000 School: Insufficient legal basis for data processing Placing personal data of pupils on a public notice board. ITALY · ·Art. 5, 6 Aug 5, 2020
€250,000 Spartoo: Non-compliance with general data processing principles A fine of EUR 250000 was imposed on the online retailer Spartoo. The reason for this was that the company, which has its headquarters in France but supplies a large number of… FRANCE · ·Art. 5, 13, 14 Aug 5, 2020
€3,000 Restaurant: Non-compliance with general data processing principles Installation of CCTV surveillance cameras that were also monitoring the public space and without proper information. SPAIN · ·Art. 5, 12, 13 Aug 5, 2020
€100 Bank: Insufficient legal basis for data processing A bank employee made a copy of the identity card of a bank client who wanted to exchange EUR 100 in foreign currency and justified this with money laundering charges. However,… AUSTRIA · ·Art. 5, 6 Aug 5, 2020
€60,000 Vodafone España, SAU: Insufficient legal basis for data processing The data subject received confirmation from Vodafone of a number porting, which the latter had never commissioned. SPAIN · ·Art. 5, 6 Aug 4, 2020
€1,000 Supermarket: Insufficient legal basis for data processing The operator of a supermarket displayed the letter of dismissal to the personnel manager on the publicly visible notice board of the supermarket. ITALY · ·Art. 5, 6 Aug 4, 2020
€20,100 PrivatBo A.M.B.A.: Insufficient technical and organisational measures to ensure information security The company had distributed USB sticks to tenants in the context of a sale of real estate, which contained not only non-personal information on the real estate objects in question… DENMARK · ·Art. 5, 32 Aug 4, 2020
€5,000 National Institute for Social Security - Department of the Province of Brescia: Insufficient fulfilment of data subjects rights Failure to graint access to personal health data of a data subject according to Art. 15 GDPR. ITALY · ·Art. 15 Aug 4, 2020