Content type · 3,651 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€75,000 Telefónica Móviles España, SAU: Insufficient legal basis for data processing The company had carried out the number porting of his telephone line from his current company without his consent. Personal data was transferred from the former telephone operator… SPAIN · ·Art. 5, 6 Jul 23, 2020
€5,000 El Real Sporting de Gijón S.A.D.: Insufficient legal basis for data processing Fines for sending direct marketing communications without sufficient consent, as the form Real Sporting de Gijón submitted to club members did not comply with the GDPR (opt-out… SPAIN · ·Art. 6, 7 Jul 23, 2020
€10,000 El Periódico de Catalunya, S.L.U.: Insufficient legal basis for data processing Following a request for erasure addressed to the company, the data subject received another newsletter from the newspaper, although El Periódico de Catalunya claimed to have… SPAIN · ·Art. 5, 6 Jul 23, 2020
€5,000 Xfera Moviles S.A.: Insufficient cooperation with supervisory authority Following a complaint, Xfera Móviles was requested by the AEPD to submit certain information and documents, but did not do so within the provided time limit. SPAIN · ·Art. 58 Jul 23, 2020
€70,000 Telefónica Móviles España, SAU: Insufficient legal basis for data processing The data subject's account was debited for two telephone lines that he had never ordered or approved. This constituted unlawful processing of personal data, since the data… SPAIN · ·Art. 5, 6 Jul 23, 2020
€24,000 Banco Bilbao Vizcaya Argentaria, SA: Insufficient legal basis for data processing BBVA had no legitimate basis for processing the data of the data subject and had therefore infringed Article 6(1) of the GDPR, since the company processed solvency and credit… SPAIN · ·Art. 5, 6 Jul 20, 2020
€400 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 400 on a legal person. The privacy notice required under Articles 12 to 14 of the GDPR was placed in the contacts section of the website… CZECH REPUBLIC · ·Art. 12 Jul 20, 2020
€40,000 Iberia Lae SA Operadora Unipersonal: Insufficient cooperation with supervisory authority The company did not grant the data subject access to telephone records. The applicant's request for access did not receive a reply, despite the prior order of the AEPD. SPAIN · ·Art. 58 Jul 20, 2020
€70,000 Xfera Moviles S.A.: Non-compliance with general data processing principles A data subject had received a call from another Xfera Móviles customer who stated that the company had charged his bank account with an invoice, disclosing the personal details of… SPAIN · ·Art. 5 Jul 20, 2020
€1,500 Comercial Vigobrandy, SL: Insufficient fulfilment of information obligations Installation of CCTV surveillance without adequate information by using a sign SPAIN · ·Art. 12, 13, 14 Jul 20, 2020
€80,000 Orange Espagne S.A.U.: Insufficient legal basis for data processing The company had unlawfully activated several telephone line contracts using the personal data of a data subject. This constituted an unlawful processing operation, since the data… SPAIN · ·Art. 5, 6 Jul 20, 2020
€28 Google Ireland Ltd.: Insufficient fulfilment of data subjects rights Failure to respond to a data subjects request to access information (Art. 15 GDPR - here: about data processed in the context of Google AdWords) in due time. HUNGARY · ·Art. 12, 15 Jul 16, 2020
€22,300 Office for geodesy and cartography: Insufficient cooperation with supervisory authority Refusal of access to the premises by the supervisory authority in the course of an audit. POLAND · ·Art. 31, 58 Jul 15, 2020
€400 Legal Person: Insufficient legal basis for data processing The Czech DPA has imposed a fine of EUR 400 on a legal person. The accused did not provide evidence that the data subject had consented to the scanning or copying of their ID card… CZECH REPUBLIC · ·Art. 5, 6, 7 +3 Jul 14, 2020
€600,000 Google Belgium SA: Insufficient fulfilment of data subjects rights The Belgian data protection authority has fined Google Belgium SA, a subsidiary of Google, 600,000 euros. The reasons for the fine were the rejection of an application by a data… ·Art. 5, 6, 12 +1 ·Insufficient fulfilment of data subjects rights Jul 14, 2020
€5,000 Operator of CCTV of a residential building: Insufficient legal basis for data processing The operator of video cameras on a residential property had installed cameras there to monitor the shared area of two blocks of flats. The data controller argued that the owners… BELGIUM · ·Art. 6, 7 Jul 14, 2020
€200,000 Merlini s.r.l.: Insufficient legal basis for data processing The company had carried out telemarketing activities on behalf of Wind Tre S.p.A. through a third party provider as data processor without sufficient legal basis fpr data… ITALY · ·Art. 5, 6, 7 +2 Jul 13, 2020
€800,000 Iliad Italia S.p.A.: Non-compliance with general data processing principles The fine relates to data protection infringements concerning the processing of customer data for the activation of SIM cards and the manner in which payment data was recorded. In… ITALY · ·Art. 5, 25 Jul 13, 2020
€17M Wind Tre S.p.A.: Insufficient legal basis for data processing Fines for several unlawful data processing activities relating to direct marketing. Hundreds of data subjects claimed to have received unsolicited communications sent without… ITALY · ·Art. 5, 6, 12 +2 Jul 13, 2020
€5,000 Global Business Travel Spain SLU: Insufficient technical and organisational measures to ensure information security The fine was preceded by an employee's access to health data of a person concerned. In the course of its investigations, the Data Protection Authority found that Global Business… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jul 10, 2020
€55,000 Xfera Moviles S.A.: Insufficient technical and organisational measures to ensure information security The company had changed a contract for a mobile phone connection to a new owner, whereby the personal data of a data subject such as his address and telephone numbers were freely… SPAIN · ·Art. 5, 32 Jul 10, 2020
€12,000 Vodafone España, SAU: Non-compliance with general data processing principles Fines for violation of Art. 5 (1) d) GDPR for changing the customer's master data into the name of a third party, the ex-spouse of the customer. SPAIN · ·Art. 5 Jul 10, 2020
€1,000 Centro Internacional De Crecimiento Laboral Y Profesional S.L.: Insufficient legal basis for data processing Sending commercial messages without consent and without the possibility to object. SPAIN · ·Art. 5, 6 Jul 10, 2020
€5,000 School Fitness Holiday & Franchising S.L.: Non-compliance with general data processing principles Breach of transparency principle. No further information available at the moment. SPAIN · ·Art. 5 Jul 10, 2020
€1,500 Auto Desguaces Iglesias S.L.: Non-compliance with general data processing principles The company had installed surveillance cameras that recorded the public road and therefore violated the principle of data minimization. SPAIN · ·Art. 5 Jul 10, 2020
€46,660 Municipality of Rælingen: Insufficient technical and organisational measures to ensure information security Fine for the processing of children's health data in connection with disability through the digital learning platform 'Showbie'. The Municipality had failed to carry out a Data… NORWAY · ·Art. 32, 35 Jul 10, 2020
€3,400 East Power Sp. z o.o.: Insufficient cooperation with supervisory authority After three subpoenas to East Power, in which the latter failed to provide sufficient explanations on a direct marketing complaint, the data protection authority found that East… POLAND · ·Art. 31, 58 Jul 10, 2020
€15,000 Proleasing Motors SRL: Insufficient technical and organisational measures to ensure information security The company had failed to take adequate technical and organisational measures to ensure data security, which led to the publication on Facebook of a document containing a password… ROMANIA · ·Art. 32 Jul 9, 2020
€830,000 Bureau Krediet Registration ('BKR'): Insufficient fulfilment of data subjects rights BKR had required the payment of a fee when individuals requested access to their personal data and only provided access to their data once a year free of charge by post. THE NETHERLANDS · ·Art. 12, 15 Jul 6, 2020
Odin Flissenter AS: Insufficient legal basis for data processing On July 2, 2020, the Norwegian DPA (Datatilsynet) announced that it intents to fine Odin Flissenter AS EUR 28,000 for violations of Art. 5 GDPR and Art. 6 GDPR. This fine has been… NORWAY · ·Art. 5, 6 Jul 2, 2020
€24,000 Iberdrola Clientes: Non-compliance with general data processing principles A third person had received an electricity bill with personal details such as name, address and bank account of another customer. The reason for this was that Iberdola Clientes… SPAIN · ·Art. 5 Jul 2, 2020
€3,600 Saunier-Tec Mantenimientos de Calor y Frio, SL.: Insufficient fulfilment of data breach notification obligations Although the company had taken steps to remedy a data breach, it had not informed the AEPD sufficiently. As a result, the AEPD imposed a fine of EUR 4,800, which was reduced to… SPAIN · ·Art. 33 Jul 2, 2020
€4,000 De Vere Spain S.L.: Insufficient fulfilment of data subjects rights The company did not respond to the data subject's request to stop processing his or her data, and therefore data subject continued to receive commercial calls. ·Art. 21 ·Insufficient fulfilment of data subjects rights Jul 2, 2020
€15,000 Mapei S.p.A.: Insufficient fulfilment of data subjects rights Mapei failed to respond to the request for access to personal data of the data subject. In addition, Mapei had left the e-mail account of the person concerned active even after… ITALY · ·Art. 5, 12, 13 +1 Jul 2, 2020
€5,000 Xfera Moviles S.A.: Insufficient cooperation with supervisory authority The company had not cooperated sufficiently with the data protection authority. SPAIN · ·Art. 31, 58 Jul 2, 2020
€1.2M Allgemeine Ortskrankenkasse ('AOK') (health insurance company): Insufficient technical and organisational measures to ensure information security From 2015 to 2019, AOK Baden-Württemberg (insurance organization) organized competitions on various occasions and collected personal data of the participants, including their… GERMANY ·Art. 5, 6, 32 ·Insufficient technical and organisational measures to ensure information security Jun 30, 2020
€40,000 Tusla Child and Family Agency: Insufficient fulfilment of data breach notification obligations The organization sent a letter with abuse allegations to a third party who then uploaded it to social networks. IRELAND ·Art. 33 ·Insufficient fulfilment of data breach notification obligations Jun 30, 2020
€6,700 Lejre Municipality: Non-compliance with general data processing principles The data protection authority had found that the Lejre Municipal Child and Youth Centre had regularly uploaded minutes of meetings with particularly sensitive and sensitive… DENMARK · ·Art. 5, 6, 33 +1 Jun 30, 2020
€5,000 New York College S.A.: Non-compliance with general data processing principles The College had contacted the complainant directly by telephone with regard to an educational programme and had processed personal data in a non-transparent manner. GREECE · ·Art. 5 Jun 29, 2020
€13,500 Department of Home Affairs: Insufficient fulfilment of data subjects rights Fines for failure to comply with the right of access to personal data under Articles 12 and 15 GDPR. The Isle of Man has declared the GDPR - although it is not an EU state - to be… ISLE OF MAN ·Art. 12, 15 ·Insufficient fulfilment of data subjects rights Jun 25, 2020
€7,500 Miraclia (telecommunications company): Insufficient legal basis for data processing The recording of telephone jokes via an app constitutes processing of personal data in accordance with the applicable data protection law, as the voices of individuals may… SPAIN · ·Art. 5, 6 Jun 23, 2020
€112,000 Østfold HF Hospital: Insufficient technical and organisational measures to ensure information security It was found that Østfold HF Hospital had stored patient data, including sensitive data such as the reason for hospitalisation, during the period 2013-2019 without controlling… NORWAY · ·Art. 32 Jun 22, 2020
€2,000 Comunidad de propietarios demelza beach: Non-compliance with general data processing principles Illegal use of CCTV cameras due to coverage of public space and recording of passing pedestrians. Furthermore, insufficient fulfilment of information obligations. SPAIN · ·Art. 5, 6, 13 +1 Jun 22, 2020
Aquateknikk AS: Insufficient legal basis for data processing On June 19, 2020, the Norwegian DPA (Datatilsynet) announced that it intents to fine Aquateknikk AS EUR 28,000 for violations of Art. 5 GDPR and Art. 6 GDPR . This fine has been… NORWAY · ·Art. 5, 6 Jun 19, 2020
€6,000 National Police Brigade: Insufficient legal basis for data processing Making copies of a company's business records in the context of investigations which contained data from third parties and for which there was no legal basis for processing. SPAIN · ·Art. 5, 6 Jun 19, 2020
€10,000 BELGIUM DPA: Insufficient fulfilment of data subjects rights The company sent an e-mail to the person concerned without his consent. Thereupon the person concerned requested timely information about the entries in the database concerning… ·Art. 5, 6, 15 ·Insufficient fulfilment of data subjects rights Jun 19, 2020
€4,000 Enel Energie: Insufficient technical and organisational measures to ensure information security Failure to take adequate measures to prevent unauthorised disclosure of personal data. The fine was preceded by a complaint about the disclosure of personal data of the data… ROMANIA · ·Art. 32 Jun 18, 2020
€1,900 Housing Association: Non-compliance with general data processing principles Unlawful usage of surveillance cameras. In the decision, the data protection authority stressed that sound recordings have additional privacy implications, especially in a… SWEDEN ·Art. 5, 6 ·Non-compliance with general data processing principles Jun 16, 2020
€7,500 PVV Overijssel: Insufficient fulfilment of data breach notification obligations The Dutch DPA (AP) fined the Overijssel local branch of the PVV party EUR 7,500 for failing to notify the AP of a personal data breach, in violation of Art. 33 GDPR. An email… THE NETHERLANDS · ·Art. 33 Jun 16, 2020
€2,000 Café Bar: Non-compliance with general data processing principles Illegal use of CCTV cameras (recording of third parties) and insufficient fulfilment of information obligations. SPAIN · ·Art. 5, 6, 13 +1 Jun 16, 2020