Content type · 3,833 documents in this view · 3,838 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filter by Topic Supervisory Authorities 3612 Processing 2650 Personal Data 2423 Controllers 2035 Processing Agreement 1116 Security 1021 Supervision 865 Healthcare 623 Public Authority 573 Law Enforcement 572 Monitoring 550 Consent 509
€2,850 Financial Enterprise: Insufficient legal basis for data processing A client of a financial enterprise complained that the financial enterprise transferred his data after he objected against the processing and did not provide information on the… HUNGARY · ·Art. 5, 6, 21 Jun 26, 2019
€15,150 HUNGARY DPA: Insufficient fulfilment of data breach notification obligations The data controller did not fulfil its data breach notification obligations when a flash memory with personal data was lost. ·Art. 33 ·Insufficient fulfilment of data breach notification obligations Jun 25, 2019
€350,000 Haga Hospital: Insufficient technical and organisational measures to ensure information security Original Fine Summary: The Haga Hospital does not have a proper internal security of patient records in place. This is the conclusion of an investigation by the Dutch Data… THE NETHERLANDS · ·Art. 32 Jun 18, 2019
€20,000 Employer UNIONTRAD COMPANY: Insufficient legal basis for data processing Between 2013 and 2017, the CNIL received complaints from several employees of the company who were filmed at their workstation. On two occasions, it alerted the company to the… FRANCE · ·Art. 5, 12, 13 +1 Jun 13, 2019
€400 Legal Person: Insufficient fulfilment of data subjects rights The Czech DPA has imposed a fine of EUR 400 on a legal person. The accused did not comply with the data subject's request to delete the personal data from its website, even after… CZECH REPUBLIC · ·Art. 17 Jun 12, 2019
€250,000 Professional Football League (LaLiga): Insufficient fulfilment of information obligations The national Football League (LaLiga) was fined for offering an app which once per minute accessed the microphone of users' mobile phones in order to detect pubs screening… SPAIN · ·Art. 5, 7 Jun 11, 2019
€2,850 Claim management company: Insufficient legal basis for data processing The complainants stated during the case that they concluded a credit agreement with the bank, which sold its claim against the complainants and transferred their respective data… HUNGARY · ·Art. 5, 6 Jun 3, 2019
€2,000 Local bank: Insufficient fulfilment of data subjects rights Customer of a local bank requested access to telephone conversation recordings as well as to CCTV recordings. The bank provided the copies of the recordings of telephone… HUNGARY · ·Art. 12, 15, 18 May 31, 2019
€2,000 Mayor: Insufficient legal basis for data processing The administrative fine was imposed for the misuse of personal data by a mayor for campaign purposes. BELGIUM · ·Art. 5, 6 May 28, 2019
€400,000 SERGIC (Real Estate): Insufficient technical and organisational measures to ensure information security The CNIL based the penalty on two grounds: Lack of basic security measures and excessive data storage. As to the first, sensitive user documents uploaded by rental candidates… FRANCE · ·Art. 5 May 28, 2019
€92,146 Organizer of SZIGET festival and VOLT festival: Insufficient legal basis for data processing The NAIH found that there were inappropriate legal bases is use and that the controller did not comply with the principle of purpose limitation. Also, information on the data… HUNGARY · ·Art. 5, 6, 13 May 23, 2019
€286 Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest: Insufficient fulfilment of data breach notification obligations The employee of the Directorate sent by mistake 9 letters to the wrong recipient, which contained personal data of 18 data subjects (including data of children, criminal data and… HUNGARY · ·Art. 33 May 21, 2019
€61,500 Payment service provider UAB MisterTango: Insufficient fulfilment of data breach notification obligations During an inspection, the Lithuanian Data Protection Supervisory Authority found that the controller processed more data than necessary to achieve the purposes for which he was a… LITHUANIA · ·Art. 5, 32, 33 May 16, 2019
€1,400 Police Officer: Insufficient legal basis for data processing The police officer, using his official user ID but without reference to official duties, queried the owner data concerning the license plate of a person who he did not know well… GERMANY ·Art. 6 ·Insufficient legal basis for data processing May 9, 2019
€194 CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Information was not provided. ·Art. 15 ·Insufficient fulfilment of data subjects rights May 6, 2019
€120,000 Oslo Municipal Education Department: Insufficient technical and organisational measures to ensure information security Fine for security vulnerabilities in a mobile messaging app developed for use in an Oslo school. The app allows parents and students to send messages to school staff. Due to… NORWAY · ·Art. 32 Apr 29, 2019
€12,950 Sports association: Insufficient legal basis for data processing One sports association published personal data referring to judges who were granted judicial licenses online. However, not only their names were provided, but also their exact… POLAND · ·Art. 6 Apr 25, 2019
€50,000 Italian political party Movimento 5 Stelle: Insufficient technical and organisational measures to ensure information security A number of websites affiliated to the Italian political party Movimento 5 Stelle are run, by means of a data processor, through the platform named Rousseau. The platform had… ITALY · ·Art. 32 Apr 17, 2019
€9,400 HUNGARY DPA: Insufficient legal basis for data processing A data controller used a, in the point of view of NAIH, wrong legal basis for processing of personal data (Art. 6.1.b) for the assignment of claims. ·Art. 5, 6 ·Insufficient legal basis for data processing Apr 17, 2019
€80,000 Company in the financial sector: Insufficient technical and organisational measures to ensure information security In an administrative decision dated 12 April 2019, the authority imposed a fine of 80,000 euros on a medium-sized financial services company. This company had failed to take the… GERMANY ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Apr 12, 2019
€510 Medical centers: Insufficient legal basis for data processing The sanction of 510 EUR was imposed on each medical center for unlawful processing of the personal data of data subject G.B. by a medical centre for the purpose of changing his… BULGARIA · ·Art. 5, 6, 9 Apr 8, 2019
€1,900 HUNGARY DPA: Insufficient fulfilment of data subjects rights The data controller did not fulfil the data subject's access request. ·Art. 15 ·Insufficient fulfilment of data subjects rights Apr 5, 2019
€34,375 Hungarian political party: Insufficient fulfilment of data breach notification obligations NAIH imposed a fine of HUF 11,000,000 (EUR 34,375) on an undisclosed Hungarian political party for failing to notify the NAIH and relevant individuals about a data breach, and… HUNGARY · ·Art. 33, 34 Apr 5, 2019
€220,000 Private company working with data from publicly available sources: Insufficient fulfilment of information obligations The fine concerned the proceedings related to the activity of a company which processed the data subjects’ data obtained from publicly available sources, inter alia from the… POLAND · ·Art. 14 Mar 26, 2019
€5,100 A.P. EOOD: Insufficient legal basis for data processing The sanction was imposed on personal data administrator A.P. EOOD for unlawful processing of personal data. The personal data of data subject D.D. was used by A.P. EOOD for… BULGARIA · ·Art. 5, 6 Mar 26, 2019
€2,000 PORTUGAL DPA: Insufficient fulfilment of information obligations Inexistence of signalization regarding the use of CCTV systems ·Art. 13 ·Insufficient fulfilment of information obligations Mar 25, 2019
€10,000 CZECH REPUBLIC DPA: Non-compliance with general data processing principles Data was not only processed if adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation') and not only kept… ·Art. 5 ·Non-compliance with general data processing principles Mar 21, 2019
€2,000 PORTUGAL DPA: Insufficient fulfilment of information obligations Inexistence of signalization regarding the use of CCTV systems ·Art. 13 ·Insufficient fulfilment of information obligations Mar 19, 2019
€3,200 Unnamed financial institution: Insufficient fulfilment of data subjects rights The fine was imposed in relation to a data subject's request for data correction and erasure. NAIH levied a fine against an unnamed financial institution for unlawfully rejecting… HUNGARY · ·Art. 5, 6, 13 +1 Mar 4, 2019
€50,000 N26: Insufficient legal basis for data processing The fine was imposed against against a bank (according to a newspaper N26) that had processed 'personal data of all former customers' without permission.The Bank has acknowledged… GERMANY ·Art. 6 ·Insufficient legal basis for data processing Mar 1, 2019
€170,000 Bergen Municipality: Insufficient technical and organisational measures to ensure information security The incident relates to computer files with usernames and passwords to over 35000 user accounts in the municipality’s computer system. The user accounts related to both pupils in… NORWAY · ·Art. 5, 32 Mar 1, 2019
€582 CZECH REPUBLIC DPA: Insufficient technical and organisational measures to ensure information security Data was not processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Feb 28, 2019
€3,200 Mayor's Office of the city of Kecdkemét: Insufficient legal basis for data processing The fine was imposed on the Mayor’s Office of the city of Kecskemét for unlawful disclosure of the personal information of a whistleblower.NAIH imposed the fine after an employee… HUNGARY · ·Art. 5, 6 Feb 28, 2019
€27,100 Telecommunication service provider: Insufficient legal basis for data processing Repeated registration of prepaid services without the knowledge and consent of the data subject Employees of the telecommunications provider have used personal data and registered… BULGARIA · ·Art. 5, 6 Feb 26, 2019
€776 CZECH REPUBLIC DPA: Insufficient fulfilment of data subjects rights Information was not provided. ·Art. 15 ·Insufficient fulfilment of data subjects rights Feb 26, 2019
€500 Employer: Insufficient fulfilment of data subjects rights An employee sent a request to his employer for access to personal data concerning him. The request was not answered in time and not in a complete way. BULGARIA · ·Art. 15 Feb 22, 2019
€1,560 Debt collector: Non-compliance with general data processing principles A data subject requested information about and erasure of the data processed, which the debt collector refused stating that it could not identify the subject. For identification… HUNGARY · ·Art. 5 Feb 20, 2019
€5,000 Lands Authority: Insufficient technical and organisational measures to ensure information security As a result of the lack of appropriate security measures on the Lands Authority website, over 10 gigabytes of personal data became easily accessible to the public via a simple… MALTA ·Art. 5, 32 ·Insufficient technical and organisational measures to ensure information security Feb 18, 2019
€1,560 Bank: Non-compliance with general data processing principles A bank mistakenly sent SMS messages about a subject's credit card debt to the telephone number of another person. After receiving an incorrect telephone number from the client at… HUNGARY · ·Art. 5 Feb 8, 2019
€2,500 Private person: Insufficient legal basis for data processing The fine was impossed against a private person who sent several e-mails between July and September 2018, in which he used personal e-mail addresses visible to all recipients, from… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Feb 5, 2019
€20,000 PORTUGAL DPA: Insufficient fulfilment of data subjects rights Denial of the right to access recorded phone calls by the Data Subject ·Art. 15 ·Insufficient fulfilment of data subjects rights Feb 5, 2019
€1,165 Car renting company: Insufficient fulfilment of information obligations A person who rented a car found out that the car was tracked via GPS by the renting company even though there was no information provided on the fact that the car is being… CZECH REPUBLIC · ·Art. 5 Feb 4, 2019
€1,165 Credit brokerage: Insufficient technical and organisational measures to ensure information security Data was not processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental… CZECH REPUBLIC · ·Art. 32 Feb 4, 2019
€50M Google LLC: Insufficient legal basis for data processing The fine was imposed on the basis of complaints from the Austrian organisation 'None Of Your Business' and the French NGO 'La Quadrature du Net'. The complaints were filed on 25th… FRANCE · ·Art. 5, 6, 13 +1 Jan 21, 2019
€500 Bank: Insufficient legal basis for data processing A bank gained personal data concernign a student wihtout a legal basis. BULGARIA · ·Art. 5, 6 Jan 17, 2019
€388 Employer: Insufficient legal basis for data processing A former employee of a company requested the deletion of information relating to him/her which was published on the Facebook website of the employer and which was still available… CZECH REPUBLIC · ·Art. 6 Jan 10, 2019
€51,000 Facebook Germany GmbH: Insufficient involvement of data protection officer Whereas Facebook Ireland had appointed a data proteciton officer for all group companies located in the EU, this appontment was not notfied to the DPA Hamburg, competent for… ·Art. 37 ·Insufficient involvement of data protection officer Jan 1, 2019
€20,000 Hamburger Verkehrsverbund GmbH (HVV GmbH): Insufficient fulfilment of data breach notification obligations On July 6, 2018, HVV GmbH was informed by a customer about a security gap on the website www.hvv.de, which was caused by an update on February 5, 2018 and concerned the so-called… GERMANY · ·Art. 33, 34 Jan 1, 2019
€9,000 Employer: Non-compliance with general data processing principles Video surveillance cameras have not only been used to protect property, but have also monitored employees (violation of principle of data minimisation). SPAIN · ·Art. 5 Jan 1, 2019
€50,000 Unknown Company: Insufficient fulfilment of data subjects rights The data controller had engaged an external company to carry out the duties of access to data according to Art. 15 GDPR. However, the engaged company conducted the correspondence… GERMANY ·Art. 15, 28 ·Insufficient fulfilment of data subjects rights Jan 1, 2019