Content type · 1,280 documents in this view · 3,634 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities3564 Processing Agreement2800 Processing2632 Personal Data2596 Controllers2211 Data Controller1862 Law Enforcement1540 IP Address1282 Security1024 Supervision879 Monitoring545 Consent518
€20,900 Eidskog municipality: Insufficient legal basis for data processing The Norwegian DPA imposed a fine of EUR 20,900 on Eidskog municipality for giving two former employees access to a whistleblower’s report without redacting sensitive health and… NORWAY · ·Art. 6 Sep 6, 2024
€940,000 mBank: Insufficient fulfilment of data breach notification obligations The Polish DPA has fined mBank EUR 940,000. The bank had suffered a data breach in which an employee of the controller sent documents containing customer data to the wrong… POLAND · ·Art. 34 Aug 20, 2024
€26,800 Municipality of Vejen: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 26,800 on the municipality of Vejen. The municipality had suffered a security incident involving the theft of three unencrypted computers… DENMARK · ·Insufficient technical and organisational measures to ensure information security Aug 14, 2024
€270,000 UNIQLO EUROPE, LTD, SUCURSAL EN ESPAÑA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on UNIQLO EUROPE, LTD, SUCURSAL EN ESPAÑA. An individual who provided services to the controller filed a complaint with the DPA due to the fact… SPAIN · ·Art. 5, 32 Aug 12, 2024
€290M Uber Technologies Inc., Uber B.V.: Non-compliance with general data processing principles The Dutch DPA has imposed a fine of EUR 290 million on Uber for transferring personal data of European drivers to the USA without sufficient privacy safeguards. The DPA launched… Jul 22, 2024
€6,900 Municipality of Korou: Insufficient involvement of data protection officer The French DPA has imposed a fine of EUR 6,900 on the municipality of Korou for failing to appoint a data protection officer. FRANCE · ·Art. 31, 37 Jul 22, 2024
€80,000 Selectra S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 80,000 on Selectra S.p.A.. A former employee had lodged a complaint with the DPA on the grounds that the controller was able to access… ITALY · ·Art. 5, 13, 88 +1 Jul 17, 2024
€5M Hera Comm S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5 million on Hera Comm S.p.A. The investigation was launched following numerous complaints. The energy supplier had failed to take… ITALY · ·Art. 5, 12, 15 +3 Jul 17, 2024
€600 ASSOCIACIO CANNABICA DEL MARESME ACANNAM: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on ASSOCIACIO CANNABICA DEL MARESME ACANNAM. The controller had installed video surveillance cameras which, among other… SPAIN · ·Art. 5, 13 Jul 11, 2024
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The individual had installed a video surveillance camera which also recorded parts of a neighbouring… SPAIN · ·Art. 5 Jul 4, 2024
€2.4M Vinted: Insufficient fulfilment of data subjects rights The Lithuanian DPA has imposed a fine of EUR 2,385,276 on the second-hand online store 'Vinted'. The DPA initiated an investigation after the Polish and French DPAs forwarded… LITHUANIA · ·Art. 5, 12 Jul 2, 2024
€600 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a Homeowners' association. The association had installed video surveillance cameras which, among other things, also covered the public space.… SPAIN · ·Art. 5, 13 Jun 26, 2024
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The individual had installed a video surveillance camera in their garage area, which however also recorded… SPAIN · ·Art. 5 Jun 25, 2024
€150,000 BANCO CETELEM, S.A.: Insufficient legal basis for data processing The Spanish DPA has imposed a fine on BANCO CETELEM, S.A.. A person had filed a complaint against the controller with the DPA due to the fact that debits had been made from their… SPAIN · ·Art. 6, 17 Jun 25, 2024
€20,000 Municipality of Nepi: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 20,000 on the municipality of Nepi. The controller had published a document containing the ranking list of a pre-selection test for a… ITALY · ·Art. 2, 5, 6 +1 Jun 20, 2024
€42,000 CUI ZSQ FOOD, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on CUI ZSQ FOOD, S.L.. An employee had filed a complaint with the DPA as video recordings of the company's surveillance system in which they… SPAIN · ·Art. 5 Jun 20, 2024
€1M Fastweb S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 1 million on Fastweb S.p.A. due to unauthorized telemarketing, the unlawful storage of customer data after contract termination, and… ITALY · ·Art. 5, 6, 7 +13 Jun 20, 2024
€3,000 20 AÑOS DE MÚSICA A.I.E.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on 20 AÑOS DE MÚSICA A.I.E.. A person had filed a complaint with the DPA due to the fact that in order for minors to attend concerts organized… SPAIN · ·Art. 5, 13 Jun 17, 2024
€3,000 DQG NORTE A.I.E: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on DQG NORTE A.I.E.. A person had filed a complaint with the DPA due to the fact that in order for minors to attend concerts organized by the… SPAIN · ·Art. 5, 13 Jun 13, 2024
€120,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on BANCO BILBAO VIZCAYA ARGENTARIA, S.A.. A data subject had filed a complaint with the DPA because the controller had proposed to a credit… SPAIN · ·Art. 5 Jun 12, 2024
€5,000 Bakery: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 5,000 on a bakery. The DPA found that the controller had violated its information obligations and the principle of data minimization in… FRANCE · ·Non-compliance with general data processing principles Jun 10, 2024
€2,000 EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 2,000 on EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.. The controller had installed video surveillance cameras which, among other… SPAIN · ·Art. 5, 13 Jun 7, 2024
€120,000 Cappello Giovanni & Figli s.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 120,000 on Cappello Giovanni & Figli s.r.l.. The controller had used facial recognition technology to monitor the attendance of… ITALY · ·Art. 5, 6, 9 +1 Jun 6, 2024
€500 Comune di Ustica: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 500 on Comune di Ustica. The municipality had published a document, containing personal data (including health data) of private… ITALY · ·Art. 2, 5, 6 +2 Jun 6, 2024
€6.4M Eni Plenitude S.p.A.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 6.419.631 on Eni Plenitude S.p.A.. The DPA initiated an investigation against the controller due to 107 notifications and 8 complaints… ITALY · ·Art. 5, 6, 24 +3 Jun 6, 2024
Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company. The company published a promotional video on its website and social networks in which images of patient files of one of its… FRANCE · ·Art. 5 Jun 5, 2024
Company: Non-compliance with general data processing principles The French DPA has imposed a fine on a company operating a call center. The controller had systematically recorded all incoming and outgoing calls for training, evaluation and… FRANCE · ·Art. 5 Jun 5, 2024
€6,000 EUROBOX S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on EUROBOX S.A.. A person had filed a complaint with the DPA because, after having their account with the controller blocked, they were asked to… SPAIN · ·Art. 5, 13 Jun 5, 2024
€800 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the public space. The… SPAIN · ·Art. 5, 13 Jun 5, 2024
€180 Website operator: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on the operator of a website for storing data of a data subject for an excessively long period of time and contrary to the principle of storage… SPAIN · ·Art. 5 Jun 5, 2024
€4,200 PILLOW HOTELS, S.L.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on PILLOW HOTELS, S.L.. A person had filed a complaint with the DPA. The individual had made a booking for an overnight stay with the controller… SPAIN · ·Art. 5, 32, 33 May 30, 2024
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The individual had installed a video surveillance camera which also recorded parts of a neighbouring… SPAIN · ·Art. 5 May 28, 2024
€70,000 CAIXABANK S.A.: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 70,000 on CAIXABANK S.A.. A person had filed a complaint with the DPA because an employee of the controller had accidentally disclosed… SPAIN · ·Art. 5, 32 May 28, 2024
€10,000 Association: Non-compliance with general data processing principles The French DPA has fined an association EUR 10,000 due to a lack of data security, non-compliance with the principle of data minimisation and a failure to comply with its… FRANCE · ·Non-compliance with general data processing principles May 25, 2024
€15,000 Association: Non-compliance with general data processing principles The French DPA has fined an association EUR 15,000 due to a lack of data security, non-compliance with the principle of data minimisation and a failure to comply with its… FRANCE · ·Non-compliance with general data processing principles May 25, 2024
€1,000 VOX ESPAÑA: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 1,000 on VOX ESPAÑA. The controller had installed video surveillance cameras which, among other things, also covered the public space.… SPAIN · ·Art. 5, 13 May 24, 2024
€600 President of a workers' council: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on the president of the workers' council of a company following a complaint by a former employee. During their employment, the company carried… SPAIN · ·Art. 5 May 23, 2024
€8,400 Azienda Sanitaria Locale TO4: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 8,400 on Azienda Sanitaria Locale TO4. The controller had sent an email containing information on medical treatment plans to several… ITALY · ·Art. 5, 9 May 23, 2024
€6,000 Pubilc educational institution: Non-compliance with general data processing principles The French DPA has imposed a fine of EUR 6,000 on a public educational institution for violating the principle of data minimization and its information obligations unter the GDPR. FRANCE · ·Non-compliance with general data processing principles May 23, 2024
€3,500 Professional association: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 3,500 on a professional association. An individual had filed a complaint with the DPA, for the unlawful publication of their personal… ITALY · ·Art. 2, 5, 6 +1 May 23, 2024
€31M Clearview AI Inc.: Non-compliance with general data processing principles The Dutch DPA has fined Clearview Al Inc. EUR 30,500,000. Clearview, a company offering facial recognition services, holds a database of over 30 billion images, including those of… May 16, 2024
€300 Private individual: Non-compliance with general data processing principles The Spanish DPA has imposed a fine of EUR 300 on a private individual. The individual had installed a video surveillance camera which also recorded the entrance area of the… SPAIN · ·Art. 5 May 14, 2024
€2,000 IRIDEX GROUP SALUBRIZARE SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on IRIDEX GROUP SALUBRIZARE SRL. The controller had sent an e-mail to customers without using the blind copy option, revealing the… ROMANIA · ·Art. 32 May 9, 2024
€1,600 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a homeowners' association. A person had filed a complaint with the DPA due to the fact that the data controller had published a picture with… SPAIN · ·Art. 5, 32 May 9, 2024
€75,000 Azienda ospedale università di Padova: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 75,000 on Azienda ospedale università di Padova. During its investigation, the DPA found that employees had accessed patient files… ITALY · ·Art. 5, 9, 25 +1 May 9, 2024
€480 Homeowners' association: Non-compliance with general data processing principles The Spanish DPA has imposed a fine on a homeowners' association. The controller had sent an email to all owners containing a list of the owners' individual monthly heating… SPAIN · ·Art. 5 May 7, 2024
€8,700 Central Young Men’s Christian Association: Insufficient technical and organisational measures to ensure information security The UK DPA (ICO) has fined the Central Young Men’s Christian Association EUR 8,700. The controller had sent an email to individuals participating in a program for individuals… UNITED KINGDOM · ·Art. 5, 32 Apr 30, 2024
€5,000 Dly S.r.l.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 5,000 on Dly S.r.l.. The company had installed video surveillance systems in its premises, however, their specific use was not authorized. ITALY · ·Art. 5, 88, 114 Apr 24, 2024
€3,000 I.N.P.A.S.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on I.N.P.A.S. (Istituto Nazionale di Previdenza e di Assistenza Sociale). During its investigation, the DPA found that a former… ITALY · ·Art. 2, 5, 6 +1 Apr 24, 2024
€20,000 Betting company: Insufficient legal basis for data processing The Croatian DPA (AZOP) has imposed a fine of EUR 20,000 on a data controller operating in the gambling and betting sector. The data controller collected and processed personal… CROATIA · ·Art. 6, 7, 13 Apr 22, 2024