Content type · 487 documents in this view · 3,831 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3594 Processing 2644 Personal Data 2403 Controllers 2026 Processing Agreement 1114 Security 1018 Supervision 854 Healthcare 622 Law Enforcement 568 Monitoring 553 Public Authority 542 Consent 508
€2,400 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 2,400 on a company. The controller had installed a video surveillance system to protect the company's assets and prevent… ·Art. 5 ·Non-compliance with general data processing principles May 12, 2021
€2,600 LUXEMBOURG DPA: Non-compliance with general data processing principles The DPA from Luxembourg (CNPD) has imposed a fine of EUR 2,600 on a company. The controller had installed a video surveillance system to protect the company's assets and prevent… ·Art. 5, 13 ·Non-compliance with general data processing principles May 12, 2021
€1,500 Pub owner: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined the owner of a pub EUR 1,500 due to the unauthorized use of two video surveillance cameras covering parts of the public space. SPAIN · ·Art. 5 Apr 19, 2021
€5,000 S.C. Tip Top Food Industry S.R.L: Insufficient legal basis for data processing The Romanian DPA (ANSPDCP) has fined S.C. Tip Top Food Industry S.R.L. EUR 5,000. The controller had installed several video cameras in the food areas and changing rooms to… ROMANIA · ·Art. 5, 6, 7 Apr 15, 2021
€1,425 Operator of a care facility: Insufficient legal basis for data processing The Hungarian DPA (NAIH) has imposed a fine of EUR 1,425 on the operator of a care facility. The operator had installed a total of 25 cameras in all rooms of the facility, with… HUNGARY · ·Art. 5, 6, 13 Mar 25, 2021
€1,000 Laboratorio Octogón, S.L.: Non-compliance with general data processing principles Usage of CCTV camera systems that were also monitoring public space (breach of principle of data minimization). SPAIN · ·Art. 5 Mar 23, 2021
€19,900 Basaren Drift AS: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) has imposed a fine of EUR 19,900 on Basaren Drift AS. The controller had installed video cameras in its premises which recorded both its employees… NORWAY · ·Art. 5, 6, 13 Mar 21, 2021
€1,500 Private Person: Non-compliance with general data processing principles The Spanish DPA (AEPD) has fined a private individual EUR 1,500. The controller had installed a video surveillance camera facing a public thoroughfare and covering parts of the… SPAIN · ·Art. 5 Mar 12, 2021
€14,900 Dragefossen AS: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) imposed a fine of EUR 14,900 on the energy company Dragefossen AS. The latter had installed a webcam on the roof of its office building in the… NORWAY · ·Art. 5, 6 Mar 8, 2021
Security company (name not available at the moment): Insufficient technical and organisational measures to ensure information security A data controller using the services of the security company reported the breach of personal data to the DPA, arising after an employee of the security company recorded the video… CROATIA · ·Art. 32 Feb 22, 2021
€1,600 Ripobruna 207, S.L.: Non-compliance with general data processing principles The Spanish DPA (AEPD) imposed a fine of EUR 2,000 against Ripobruna 207, S.L. (restaurant) for the unauthorized use of two video surveillance cameras that also recorded parts of… SPAIN · ·Art. 5 Feb 12, 2021
€5,000 Private Person: Non-compliance with general data processing principles The Spanish DPA (AEPD) fined a private individual EUR 5,000 for illegal camera surveillance. The data subject had rented two rooms in the apartment of the controller. The… SPAIN · ·Art. 5 Feb 8, 2021
€2,000 Private Person: Non-compliance with general data processing principles Unauthorized use of two video surveillance cameras that also recorded parts of the public space, such as sidewalks and properties behind those. SPAIN · ·Art. 5 Feb 4, 2021
€1,200 Individual: Non-compliance with general data processing principles The controller installed cameras on his building, which were directed towards parts of the public space. However, no recording took place, as the cameras only served as a… SPAIN · ·Art. 5 Jan 20, 2021
€38,600 Coop Finnmark SA: Insufficient legal basis for data processing The Norwegian DPA (Datatilsynet) fined Coop Finnmark SA NOK 400,000 (EUR 38,600). The manager of the store in question recorded CCTV footage with a mobile phone and shared the… NORWAY · ·Art. 5, 6 Jan 14, 2021
€10M notebooksbilliger.de: Insufficient legal basis for data processing The DPA of Lower Saxony (LfD Niedersachsen) imposed a fine of EUR 10,4 million on the electronics retailer notebooksbilliger.de.The company had video-monitored its employees for… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 8, 2021
Beverage retailer: Data Protection Authority of Berlin The DPA from Berlin imposed a fine against a beverage retailer. The retailer operated a video surveillance system in which the observation angle of the cameras extended into the… GERMANY ·Unknown Jan 1, 2021
€100 SLOVAKIA DPA: €100 fine Unlawful video surveillance in a garden community. ·Unknown Jan 1, 2021
GERMANY DPA: Insufficient technical and organisational measures to ensure information security Live video surveillance which was accessible via the Internet and, due to a lack of sufficient pixelation or redaction, allowed persons to be recognized. Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 1, 2021
€16,000 Electronics store: Non-compliance with general data processing principles The DPA from Lower Saxony has imposed a fine of EUR 16,000 on an electronics store. The company had installed a video surveillance system which permanently recorded employees,… GERMANY ·Art. 5, 17, 35 ·Non-compliance with general data processing principles Jan 1, 2021
Medical clinic: Insufficient legal basis for data processing The DPA from Berlin has imposed a fine on a medical clinic. The clinic had installed 21 cameras in its premises for the purpose of protection against crime and property damage.… GERMANY ·Art. 5, 6 ·Insufficient legal basis for data processing Jan 1, 2021
Private individual: Non-compliance with general data processing principles A private individual had installed video surveillance cameras which, among other things, also covered the public space GERMANY ·Art. 5 ·Non-compliance with general data processing principles Jan 1, 2021
Private individual: Non-compliance with general data processing principles The Austrian DPA has fined a private individual. The individual had installed a video surveillance system which, among other things, also recorded the public space and stored the… AUSTRIA · ·Art. 5 Jan 1, 2021
€1,940 HUNGARY DPA: Insufficient fulfilment of information obligations The Hungarian DPA (NAIH) imposed a fine of HUF 700,000 (EUR 1,940) against a construction company. The controller had installed a video surveillance system at a construction site… ·Art. 5, 13 ·Insufficient fulfilment of information obligations Dec 16, 2020
€29,500 Uppsalahem AB: Insufficient legal basis for data processing The Swedish DPA (Integritetsskyddsmyndigheten) fined the housing company Uppsalahem AB SEK 300,000 (EUR 29,500). The housing company had installed surveillance cameras in an… SWEDEN · ·Art. 5, 6 Dec 15, 2020
€3,000 Charly Mike s.r.l.: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 3,000 on Charly Mike s.r.l.. The controller is the hotel operator of the Hotel Olimpo in Alberobello. Garante received a complaint… ITALY · ·Art. 5, 13 Nov 26, 2020
€19,500 Gnosjö Municipality: Insufficient legal basis for data processing The Swedish DPA imposed a fine on the municipality of Gnosjö for illegal video surveillance in a care home for persons with certain functional disabilities. SWEDEN · ·Art. 5, 6, 13 +2 Nov 25, 2020
€12,000 Recambios Villalegre S.L.: Insufficient legal basis for data processing The Spanish DPA (AEPD) fined the company for posting photos of a person on Facebook and WhatsApp and accusing the individual of theft in related posts. The photos were obtained… SPAIN · ·Art. 6, 13 Nov 23, 2020
€2,000 Comune di Collegno: Insufficient fulfilment of data subjects rights Fine for non-compliance with the right of the data subject to access to information because the municipality refused the data subjects' request for access to data from a camera… ITALY · ·Art. 12, 13, 14 Nov 17, 2020
€1,600 Homeowners Association: Non-compliance with general data processing principles Usage of CCTV camera systems that were also monitoring public space (breach of principle of data minimization). SPAIN · ·Art. 5 Nov 16, 2020
€1,500 BELGIUM DPA: Non-compliance with general data processing principles The Belgian DPA (APD/GBA) imposed a fine of EUR 1,500 on a social housing company for non-compliance with several principles of the GDPR such as data processing as well as the… ·Art. 5, 6, 12 +3 ·Non-compliance with general data processing principles Nov 13, 2020
€4,000 Borgo Fonte Scura s.r.l.: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 4,000 on Borgo Fonte Scura s.r.l.. The controller had installed a video surveillance system which also recorded the three data… ITALY · ·Art. 5, 13 Oct 29, 2020
€4,000 Play Orenes, S.L.: Non-compliance with general data processing principles The company used CCTV cameras outside its premises which also captured the public space resulting in a violation of the principle of data minimisation. SPAIN · ·Art. 5 Oct 28, 2020
€50,000 Conseguridad SL: Insufficient involvement of data protection officer The company (private security company for video surveillance systems) did not have a data protection officer in breach of Art. 37 GDPR. SPAIN · ·Art. 37 Oct 26, 2020
€54,800 Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak: Insufficient fulfilment of data subjects rights The data controller denied the data subject access to the video material recorded by CCTV in a local store, with which the data subject wanted to prove that he or she had not… HUNGARY · ·Art. 12, 15, 18 +1 Oct 23, 2020
€2,000 Private Person: Non-compliance with general data processing principles Usage of CCTV camera that was also capturing foreign private space of a neighbour. SPAIN · ·Art. 5, 6 Oct 9, 2020
€900 Café Restaurante B.B.B: Non-compliance with general data processing principles The cafe used CCTV cameras which also captured the public space outside resulting in a violation of the so called principle of data minimisation. SPAIN · ·Art. 5 Oct 9, 2020
€3,000 Grupo Carolizan: Non-compliance with general data processing principles Operation of CCTV camera systems in an arcade area in front of a building, i.e. also covering public space. This violated the principles of data minimization, as the surveillance… SPAIN · ·Art. 5 Sep 17, 2020
€8,000 Private Person: Non-compliance with general data processing principles Operation of a CCTV camera that also monitored public space outside the premises of the data controller. GREECE · ·Art. 5 Sep 11, 2020
€500 Apartment building owners association: Insufficient legal basis for data processing Export of a still image from a video surveillance system and posting of the image on the billboard of the building without sufficient legal basis. In addition, violation of the… ROMANIA · ·Art. 5, 6, 12 +3 Sep 1, 2020
€3,000 Restaurant: Non-compliance with general data processing principles Installation of CCTV surveillance cameras that were also monitoring the public space and without proper information. SPAIN · ·Art. 5, 12, 13 Aug 5, 2020
€1,500 Comercial Vigobrandy, SL: Insufficient fulfilment of information obligations Installation of CCTV surveillance without adequate information by using a sign SPAIN · ·Art. 12, 13, 14 Jul 20, 2020
€5,000 Operator of CCTV of a residential building: Insufficient legal basis for data processing The operator of video cameras on a residential property had installed cameras there to monitor the shared area of two blocks of flats. The data controller argued that the owners… BELGIUM · ·Art. 6, 7 Jul 14, 2020
€1,500 Auto Desguaces Iglesias S.L.: Non-compliance with general data processing principles The company had installed surveillance cameras that recorded the public road and therefore violated the principle of data minimization. SPAIN · ·Art. 5 Jul 10, 2020
€2,000 Comunidad de propietarios demelza beach: Non-compliance with general data processing principles Illegal use of CCTV cameras due to coverage of public space and recording of passing pedestrians. Furthermore, insufficient fulfilment of information obligations. SPAIN · ·Art. 5, 6, 13 +1 Jun 22, 2020
€2,000 Café Bar: Non-compliance with general data processing principles Illegal use of CCTV cameras (recording of third parties) and insufficient fulfilment of information obligations. SPAIN · ·Art. 5, 6, 13 +1 Jun 16, 2020
€1,900 Housing Association: Non-compliance with general data processing principles Unlawful usage of surveillance cameras. In the decision, the data protection authority stressed that sound recordings have additional privacy implications, especially in a… SWEDEN · ·Art. 5, 6 Jun 16, 2020
€2,000 Property Owner: Non-compliance with general data processing principles Usage of CCTV camera which also captured the public roads outside in a violation of the so called principle of data minimisation. SPAIN · ·Art. 5 Jun 9, 2020
€1,000 Property Owner: Non-compliance with general data processing principles Usage of CCTV camera which also captured the public roads outside in a violation of the so called principle of data minimisation. SPAIN · ·Art. 5 Jun 9, 2020
€540 Chenming Ye (Bazar Real): Insufficient fulfilment of information obligations Usage of CCTV camera in a shop without proper information. SPAIN · ·Art. 13, 14 Jun 9, 2020