Content type · 3,651 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€5,000 Centro De Estudio Dirigidos Delta, S.L.: Non-compliance with general data processing principles Centro De Estudio Dirigidos Delta sent a message containing personal data such as first and last name and ID numbers to a third party via WhatsApp without the consent of the data… SPAIN · ·Art. 5 Mar 16, 2020
€4,000 Private Person: Insufficient legal basis for data processing On a beach, a private person secretly photographed female bathers. The incident was reported to the AEPD by the local police. SPAIN · ·Art. 5, 6 Mar 16, 2020
Bank (name not available at the moment): Insufficient fulfilment of data subjects rights In the period from May 2018 to April 2019, the bank (name not available at the moment) refused to provide its customers with copies of credit documentation (e.g. repayment plan,… CROATIA · ·Art. 15 Mar 13, 2020
€2,000 Homeowners Association: Non-compliance with general data processing principles Video surveillance of public space and thus violation of the principle of data minimization. Furthermore: Violation of information obligations, as insufficient information has… SPAIN · ·Art. 5, 13, 14 Mar 12, 2020
€5M Google LLC: Insufficient fulfilment of data subjects rights Original Fine Summary: The Swedish data protection authority has fined Google LLC € 7 million for failing to adequately comply with its obligations regarding the right of data… SWEDEN ·Art. 5, 6, 17 ·Insufficient fulfilment of data subjects rights Mar 11, 2020
€14,000 Gladsaxe Municipality: Insufficient technical and organisational measures to ensure information security A computer, containing personal data that was not protected by encryption, has been stolen, including sensitive information and personal identification numbers of 20,620 city… DENMARK · ·Art. 5, 32 Mar 10, 2020
€7,000 Hørsholm Municipality: Insufficient technical and organisational measures to ensure information security A city government employee had his work computer stolen, which contained the personal data of about 1,600 city government employees, including sensitive information and… DENMARK · ·Art. 5, 32 Mar 10, 2020
€20,600 National Center of Addiction Medicine ('SAA'): Insufficient technical and organisational measures to ensure information security Persónuvernd noted that a former employee of the SAA received boxes of allegedly personal belongings that he had left there, but which also contained patient data, including the… ICELAND ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Mar 10, 2020
€9,000 Breiðholt Upper Secondary School: Insufficient technical and organisational measures to ensure information security In violation of Art. 32 GDPR, a teacher had sent an e-mail to his students and their parents with an attachment containing data on their well-being, academic performance and… ICELAND ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Mar 10, 2020
€15,000 Gesthotel Activos Balagares: Non-compliance with general data processing principles The data subject argued that he had sent a private letter to the hotel management and union delegates containing information about an episode of harassment he had suffered,… SPAIN · ·Art. 5 Mar 9, 2020
€870 Creditor: Insufficient legal basis for data processing Sending of SMS to a data subject as a reminder for a debt, even when the debt has already been paid. HUNGARY · ·Art. 5, 6 Mar 9, 2020
€4,400 Vis Consulting Sp. z o.o.: Insufficient cooperation with supervisory authority The company prevented an inspection by the data protection authority. As a result, the company has violated Article 31 in conjunction with Article 58(1)(e) and (f) of the GDPR. POLAND · ·Art. 31, 58 Mar 9, 2020
€3,200 Retailer: Insufficient fulfilment of information obligations Insufficient declaration of video surveillance. SPAIN · ·Art. 13, 14 Mar 6, 2020
€4,000 Private individual: Non-compliance with general data processing principles Unlawful usage of video surveillance cameras which also monitored parts of the public space (violation of principle of data minimization). SPAIN · ·Art. 5 Mar 6, 2020
€4,000 Liceo Artistico Statale di Napoli: Insufficient legal basis for data processing The AEPD's decision reveals that the high school unlawfully published health data and other information in the teacher rankings published on the Institute's website. This… ITALY · ·Art. 5, 6, 9 Mar 6, 2020
€4,000 Liceo Scientifico Nobel di Torre del Greco: Insufficient legal basis for data processing The AEPD's decision reveals that the high school unlawfully published health data and other information of more than 2000 teachers in the teacher rankings published on the… ITALY · ·Art. 5, 6, 9 Mar 6, 2020
€3,000 San Giorgio Jonico: Insufficient legal basis for data processing Publication of a citizen's personal data on a website and failure to comply with requests for deletion. ITALY · ·Art. 5, 6, 17 Mar 5, 2020
School in Gdansk (Danzig) (fine imposed against town of Gdansk): Insufficient legal basis for data processing Original summary: A school in Gdansk used biometric fingerprint scanners to authenticate students for the payment process in the school canteen. Although the parents had given… POLAND · ·Art. 5, 9 Mar 4, 2020
€290 Representative of a local government: Insufficient legal basis for data processing A local representative took a photo of the director of a company fully owned by the local government depicting the director allegedly tearing off an election poster of the… HUNGARY · ·Art. 5, 6, 12 +2 Mar 4, 2020
€60,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing According to the AEPD, the data subject has received several SMS from a separate operator indicating the activation of a new contract. The reason for this was that an employee of… SPAIN · ·Art. 5, 6 Mar 4, 2020
€1,800 Solo Embrague: Insufficient fulfilment of information obligations The corporate website did not present a privacy policy or a cookie banner on its main page. SPAIN · ·Art. 13 Mar 3, 2020
€24,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing According to the AEPD, the company sent two SMS to an clients mobile number informing about a rate change in its contract and confirming the purchase of a new mobile phone,… SPAIN · ·Art. 5, 6 Mar 3, 2020
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing According to the AEPD, the company sent an SMS to an clients mobile number confirming that a telephone contract with that number had been signed even though the client was not a… SPAIN · ·Art. 5, 6 Mar 3, 2020
€525,000 Royal Dutch Tennis Association ('KNLTB'): Insufficient legal basis for data processing The Dutch Data Protection Authority has fined the Royal Dutch Tennis Association ('KNLTB') with EUR 525,000 for selling the personal data of more than 350,000 of its members to… THE NETHERLANDS · ·Art. 5, 6 Mar 3, 2020
€42,000 Vodafone España, S.A.U.: Insufficient technical and organisational measures to ensure information security According to the AEPD, the company had not been able to demonstrate adequate measures to ensure information security, leading to unauthorized access to personal data of a client. SPAIN · ·Art. 5, 32 Mar 3, 2020
€3,600 AEMA Hispánica: Non-compliance with general data processing principles The company had sent the payroll of an employee to another employee and therefore disclosed personal data to an unauthorised party. SPAIN · ·Art. 5 Feb 28, 2020
€48,000 Vodafone ONO, S.A.U.: Insufficient technical and organisational measures to ensure information security The decision was taken due to several deficiencies in information security. For example, two people were given the same security access key. SPAIN · ·Art. 32 Feb 28, 2020
Coop Finnmark SA: Insufficient legal basis for data processing On February 28, 2020, the Norwegian DPA (Datatilsynet) announced that it intents to fine Coop Finnmark SA EUR 38,600 for violations of Art. 5 GDPR and Art. 6 GDPR . This fine has… NORWAY · ·Art. 5, 6 Feb 28, 2020
€120,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Vodafone España was unable to prove to the data protection authority that the data subject had given his consent to the processing of his personal data for the provision of a… SPAIN · ·Art. 5, 6 Feb 27, 2020
Rælingen Municipality: Insufficient technical and organisational measures to ensure information security On February 26, 2020, the Norwegian DPA (Datatilsynet) announced that it intents to fine Rælingen Municipality EUR 73,600 for violations of Art. 5 (1) f) GDPR and Art. 32 GDPR .… NORWAY · ·Art. 5, 32 Feb 26, 2020
€48,000 HM Hospitales: Insufficient legal basis for data processing The data subject stated that at the time of his admission to hospital he had to fill in a form containing a checkbox indicating that, if he did not tick it, he agreed to the… SPAIN · ·Art. 5, 6 Feb 25, 2020
€6,000 Casa Gracio Operation: Non-compliance with general data processing principles The company used CCTV cameras in the premises of a hotel which also captured the public roads outside the hotel resulting in a violation of the so called principle of data… SPAIN · ·Art. 5 Feb 25, 2020
€5,000 Public Power Corporation S.A.: Insufficient fulfilment of data subjects rights The Decision clarified that data subjects have a right of access to the processing of their personal data and that they must also be provided with a copy of the personal data… GREECE · ·Art. 15 Feb 21, 2020
€2,560 T.K. EOOD: Insufficient technical and organisational measures to ensure information security The fine of ca. EUR 2,557 was imposed on T.K. EOOD for unlawful processing of personal data of data subject I.S. by failure to adopt technical and organizational measures to… BULGARIA · ·Art. 25, 32 Feb 20, 2020
€2,560 L.E. EOOD: Insufficient technical and organisational measures to ensure information security The fine of ca EUR 2,557 was imposed on L.E. EOOD for unlawful processing of personal data of data subject I.S. without the knowing and the consent of the data subject and also… BULGARIA · ·Art. 6, 25, 32 Feb 20, 2020
€1,500 Mymoviles Europa 2000, S.L.: Insufficient fulfilment of information obligations The AEPD found that the company did not publish a privacy statement on its website and that its legal notice did not sufficiently identify itself. SPAIN · ·Art. 13 Feb 18, 2020
€42,000 Vodafone España, S.A.U.: Insufficient technical and organisational measures to ensure information security The complainant had access to third party data in his personal Vodafone profile. SPAIN · ·Art. 5, 32 Feb 14, 2020
€2,500 Grupo Valsor Y Losan, S.L.: Insufficient technical and organisational measures to ensure information security The controller had disclosed personal data to a third party in a property purchase agreement (breach of principles of integrity and confidentiality of personal data) SPAIN · ·Art. 5 Feb 14, 2020
€80,000 Iberdrola Clientes: Insufficient legal basis for data processing Iberdola Clientes, an electricity company, terminated the data subject's contract without its consent, concluded three new contracts with the data subject, processed his personal… SPAIN · ·Art. 6 Feb 14, 2020
€3,000 Colegio Arenales Carabanchel (School): Insufficient legal basis for data processing The decision of the data protection authority states that the school transferred pictures (and therefore personal data) to third parties, who published them without legal basis. SPAIN · ·Art. 6 Feb 14, 2020
€30,000 Xfera Moviles S.A.: Insufficient technical and organisational measures to ensure information security The AEPD found that a third party had access to the name, telephone number and address of another customer. SPAIN · ·Art. 5, 32 Feb 14, 2020
€4,000 Comune di Urago: Insufficient legal basis for data processing The local council has published on its website information containing a person's personal data, including health information. ITALY · ·Art. 5, 6 Feb 13, 2020
€3,000 Vodafone Romania: Insufficient technical and organisational measures to ensure information security Vodafone Romania had incorrectly processed personal data of an individual in order to process a complaint, which was subsequently sent to a wrong e-mail address. The reason for… ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Feb 11, 2020
€20,000 RTI - Reti Televisive Italiane s.p.a.: Insufficient legal basis for data processing The television station broadcasted a documentary about prostitution in Switzerland, in which the persons interviewed were not made sufficiently anonymous. ITALY · ·Art. 5, 6 Feb 6, 2020
€1,500 Cafetería Nagasaki: Insufficient legal basis for data processing The AEPD found that the Nagasaki Cafetería did not comply with its obligations under the GDPR, as it placed its surveillance cameras in such a way as to monitor the public space… SPAIN · ·Art. 5, 6 Feb 4, 2020
€800 Automoción: Insufficient legal basis for data processing An employee created a fake profile about a female colleague on an erotic portal, which contained, among other things, her contact details, a photo of her and information about her… SPAIN · ·Art. 5, 6 Feb 3, 2020
€75,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The data subject, a former customer of the company, continued to receive invoice notifications, although at that time there was neither a contractual relationship nor any payment… SPAIN · ·Art. 5, 6 Feb 3, 2020
€6,670 Banco Bilbao Vizcaya Argentaria S.L.: Insufficient legal basis for data processing The company repeatedly sent advertising messages to a data subject, although the data subject had objected to the processing of his data. SPAIN · ·Art. 5, 6, 21 Feb 3, 2020
€60,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The fine was preceded by a complaint from the data subject, who argued that he had received an e-mail from Vodafone España, which contained the billing of a telephone line that… SPAIN · ·Art. 5, 6 Feb 3, 2020
€50,000 Vodafone España, S.A.U.: Non-compliance with general data processing principles The fine was preceded by a complaint from a data subject who argued that Vodafone España had sent invoices containing his personal data, such as name, identity card and address,… SPAIN · ·Art. 5 Feb 3, 2020