Content type · 3,446 documents in this view · 3,651 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3581 Processing Agreement2804 Processing2648 Personal Data2613 Controllers2228 Data Controller1873 Law Enforcement1546 IP Address1284 Security1034 Supervision890 Monitoring548 Consent522
€1,900 HUNGARY DPA: Insufficient fulfilment of data subjects rights The data controller did not fulfil the data subject's access request. ·Art. 15 ·Insufficient fulfilment of data subjects rights Apr 5, 2019
€220,000 Private company working with data from publicly available sources: Insufficient fulfilment of information obligations The fine concerned the proceedings related to the activity of a company which processed the data subjects’ data obtained from publicly available sources, inter alia from the… POLAND · ·Art. 14 Mar 26, 2019
€2,000 PORTUGAL DPA: Insufficient fulfilment of information obligations Inexistence of signalization regarding the use of CCTV systems ·Art. 13 ·Insufficient fulfilment of information obligations Mar 25, 2019
€10,000 CZECH REPUBLIC DPA: Non-compliance with general data processing principles Data was not only processed if adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation') and not only kept… ·Art. 5 ·Non-compliance with general data processing principles Mar 21, 2019
€2,000 PORTUGAL DPA: Insufficient fulfilment of information obligations Inexistence of signalization regarding the use of CCTV systems ·Art. 13 ·Insufficient fulfilment of information obligations Mar 19, 2019
€170,000 Bergen Municipality: Insufficient technical and organisational measures to ensure information security The incident relates to computer files with usernames and passwords to over 35000 user accounts in the municipality’s computer system. The user accounts related to both pupils in… NORWAY · ·Art. 5, 32 Mar 1, 2019
€50,000 N26: Insufficient legal basis for data processing The fine was imposed against against a bank (according to a newspaper N26) that had processed 'personal data of all former customers' without permission.The Bank has acknowledged… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Mar 1, 2019
€582 CZECH REPUBLIC DPA: Insufficient technical and organisational measures to ensure information security Data was not processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Feb 28, 2019
€776 CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Information was not provided. ·Art. 15 ·Insufficient fulfilment of data subjects rights Feb 26, 2019
€20,000 PORTUGAL DPA: Insufficient fulfilment of data subjects rights Denial of the right to access recorded phone calls by the Data Subject ·Art. 15 ·Insufficient fulfilment of data subjects rights Feb 5, 2019
€2,500 Private person: Insufficient legal basis for data processing The fine was impossed against a private person who sent several e-mails between July and September 2018, in which he used personal e-mail addresses visible to all recipients, from… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Feb 5, 2019
€1,165 Car renting company: Insufficient fulfilment of information obligations A person who rented a car found out that the car was tracked via GPS by the renting company even though there was no information provided on the fact that the car is being… CZECH REPUBLIC · ·Art. 5 Feb 4, 2019
€50M Google LLC: Insufficient legal basis for data processing The fine was imposed on the basis of complaints from the Austrian organisation 'None Of Your Business' and the French NGO 'La Quadrature du Net'. The complaints were filed on 25th… FRANCE · ·Art. 5, 6, 13 +1 Jan 21, 2019
€500 GERMANY DPA: Insufficient fulfilment of data subjects rights A data controller failed to comply with data subject´s request to access their personal data. Art. 15 ·Insufficient fulfilment of data subjects rights Jan 1, 2019
€30,000 Vodafone España, S.A.U.: Insufficient technical and organisational measures to ensure information security Disclosure of customer personal data (i.a. purchase history) via an SMS to another customer. The initial fine of EUR 50.000 was reduced to EUR 30.000. SPAIN · ·Art. 5, 32 Jan 1, 2019
€160,000 Taxa 4x35: Non-compliance with general data processing principles The Danish DPA reported the taxi company to the police and recommended a fine (of 1.2M DKK) for non-adherence to the data-minimization principle. While the company deleted the… DENMARK · ·Art. 5 Jan 1, 2019
€800 Police Officer: Insufficient legal basis for data processing A police officer used a witness's personal data to contact her personally. GERMANY ·Art. 6 ·Insufficient legal basis for data processing Jan 1, 2019
€40,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing The company had charged a Netflix service that had not been solicited by the claimant. The claimant could prove that the service had been used by another household which allegedly… SPAIN · ·Art. 6 Jan 1, 2019
Hamburger Volksbank eG: Insufficient fulfilment of data subjects rights The company had sent a customer a newsletter with advertising content by e-mail, although this customer had previously expressly objected to the sending of further advertising… GERMANY ·Art. 21 ·Insufficient fulfilment of data subjects rights Jan 1, 2019
€21,000 Vodafone España, S.A.U.: Insufficient legal basis for data processing Vodafone had processed personal data of the claimant (bank details, name, surname and national identification number) years after the contractual relationsid had ended. The fine… SPAIN · ·Art. 6 Jan 1, 2019
€50,000 Unknown Company: Insufficient fulfilment of data subjects rights The data controller had engaged an external company to carry out the duties of access to data according to Art. 15 GDPR. However, the engaged company conducted the correspondence… GERMANY ·Art. 15, 28 ·Insufficient fulfilment of data subjects rights Jan 1, 2019
€51,000 Facebook Germany GmbH: Insufficient involvement of data protection officer Whereas Facebook Ireland had appointed a data proteciton officer for all group companies located in the EU, this appontment was not notfied to the DPA Hamburg, competent for… Art. 37 ·Insufficient involvement of data protection officer Jan 1, 2019
€3,600 AMADOR RECREATIVOS, S.L: Non-compliance with general data processing principles Surveillance of the public space by video surveillance cameras against violation of the principles of data minimisation. SPAIN · ·Art. 5 Jan 1, 2019
€48,000 TELEFONICA MOVILES ESPAÑA, S.A.U.: Non-compliance with general data processing principles The claimant's bank account was charged by the company with two invoices for the services he had contracted, however, displaying personal data of another customer. The initial… SPAIN · ·Art. 5 Jan 1, 2019
€2,000 Restaurant: Non-compliance with general data processing principles Video surveillance cameras have been used in violation of principle of data minimisation (monitoring also of customer areas in restaurants). GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2019
€20,000 Employer: Non-compliance with general data processing principles Video surveillance cameras have not only been used to protect property, but have also monitored employees (violation of principle of data minimisation). SPAIN · ·Art. 5 Jan 1, 2019
GERMANY DPA: Insufficient legal basis for data processing Nine fines between EUR 350 and EUR 1,000 for unlawful use of a dashcam. Art. 6 ·Insufficient legal basis for data processing Jan 1, 2019
€36,000 VODAFONE ONO, S.A.U.: Non-compliance with general data processing principles The company sent a marketing email to a large number of recipients (clients) without using the blind copy feature. The initial fine of EUR 60.000 was reduced to EUR 36.000. SPAIN · ·Art. 5 Jan 1, 2019
GERMANY DPA: Insufficient legal basis for data processing Eight fines between EUR 50 and EUR 800 for unlawful use of a dashcam. Art. 6 ·Insufficient legal basis for data processing Jan 1, 2019
€48,000 VODAFONE ONO, S.A.U.: Insufficient technical and organisational measures to ensure information security Customers could access personal data of other customers in the customer area. The initial fine of EUR 60.000 was reduced to EUR 48.000. SPAIN · ·Art. 32 Jan 1, 2019
€80,000 GERMANY DPA: Insufficient technical and organisational measures to ensure information security In a digital publication, health data was accidentally published due to inadequate internal control mechanisms. Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2019
€20,000 Hamburger Verkehrsverbund GmbH (HVV GmbH): Insufficient fulfilment of data breach notification obligations On July 6, 2018, HVV GmbH was informed by a customer about a security gap on the website www.hvv.de, which was caused by an update on February 5, 2018 and concerned the so-called… GERMANY ·Art. 33, 34 ·Insufficient fulfilment of data breach notification obligations Jan 1, 2019
€9,000 Employer: Non-compliance with general data processing principles Video surveillance cameras have not only been used to protect property, but have also monitored employees (violation of principle of data minimisation). SPAIN · ·Art. 5 Jan 1, 2019
€294,000 GERMANY DPA: Non-compliance with general data processing principles A company was fined EUR 294 000 for 'unnecessarily long' storage and retention of personnel files and for 'excessive' data collection in the personnel selection process, during… Art. 5 ·Non-compliance with general data processing principles Jan 1, 2019
€2,200 Private person: Insufficient legal basis for data processing The fine was imposed against a private person who was using CCTV at his home. The video surveillance covered areas which are intended for the general use of the residents of the… AUSTRIA · ·Art. 5, 6, 13 Dec 20, 2018
€3,200 HUNGARY DPA: Insufficient fulfilment of data subjects rights The fine was imposed for (i) not providing a data subject with CCTV recordings, (ii) not retaining recordings for further use by the data subject, and (iii) not informing the data… ·Art. 12, 13, 15 +1 ·Insufficient fulfilment of data subjects rights Dec 18, 2018
€5,000 Kolibri Image
Regina und Dirk Maass GbR: Insufficient data processing agreement Please note: According to our information this fine has been withdrawn in the meantime. Kolibri Image had send a request to the Data Protection Authority of Hessen asking how to… GERMANY ·Art. 28 ·Insufficient data processing agreement Dec 17, 2018
€4,800 Betting place: Insufficient fulfilment of information obligations Video surveillance was not sufficiently marked and a large part of the sidewalk of the facility was recorded. Surveillance of the public space in this way, i.e. on a large scale… AUSTRIA · ·Art. 13 Dec 9, 2018
€20,000 Knuddels.de: Insufficient technical and organisational measures to ensure information security After a hacker attack in July personal data of approx. 330.000 users, including passwords and email addresses had been revealed. GERMANY ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Nov 21, 2018
€388 CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Information was not provided. ·Art. 15 ·Insufficient fulfilment of data subjects rights Oct 25, 2018
€300 Private car owner: Insufficient legal basis for data processing A Dashcam was unlawfully used. AUSTRIA · ·Art. 5, 6 Sep 27, 2018
€400,000 Public Hospital: Insufficient technical and organisational measures to ensure information security Investigation revealed that the hospital’s staff, psychologists, dietitians and other professionals had access to patient data through false profiles. The profile management… PORTUGAL · ·Art. 5, 32 Jul 17, 2018
€20,000 GERMANY DPA: Insufficient fulfilment of data breach notification obligations Late notification of a data breach and failure to notify the data subjects. Art. 33, 34 ·Insufficient fulfilment of data breach notification obligations Jan 1, 2018
€1,800 Kebab restaurant: Insufficient legal basis for data processing CCTV was unlawfully used. Sufficient information about the video surveillance was missing. In addition, the storage period of 14 days was too long and therefore against the… AUSTRIA · ·Art. 5, 13, 14 Jan 1, 2018
Datatilsynet (Norway) - 15/01355 Legelisten.no AS is a Norwegian limited liability company running a website where people anonymously can post reviews about dentists, doctors, psychologists and other healthcare… 15/01355 ·Art. 4, 5, 6 +3 Nov 8, 2017