Content type · 568 documents in this view · 3,813 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3589 Processing 2636 Personal Data 2395 Controllers 2018 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
€3,000 Aesse S.r.l.s.: Insufficient legal basis for data processing The Italian DPA has imposed a fine of EUR 3,000 on Aesse S.r.l.s.. An individual had filed a complaint with the DPA due to the fact that the controller had made an unsolicited… ITALY · ·Art. 5, 6, 7 +5 Mar 9, 2023
€50,000 DPC (Ireland) reprimands Kildare County Council over surveillance tech and CCTV compliance This case involves an own-volition investigation conducted by the Irish DPA (DPC) into Kildare County Council, the controller. In June 2018, Officers from the Special… Art. 2, 5, 6 +5 Jan 16, 2023
€2,000 BRISTOL LOGISTICS SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 10,000 on BRISTOL LOGISTICS SA. The DPA received a notification from BRISTOL LOGISTICS SA of a personal data breach under Art. 33 GDPR.… ROMANIA · ·Art. 32 Jan 12, 2023
€1,200 Police officer: Insufficient legal basis for data processing The DPA of Baden-Wuerttemberg has imposed a fine of EUR 1,200 on a police officer. The officer had accessed data in police databases for private research purposes without a valid… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Private individual: Non-compliance with general data processing principles The DPA of Bavaria has imposed a fine on an individual. The individual had been pulled over by a police officer and afterwards managed to obtain their telephone number in order to… GERMANY ·Non-compliance with general data processing principles Jan 1, 2023
Police officers: Insufficient legal basis for data processing The DPA of Bremen has imposed ten fines between EUR 100 and EUR 1,000 on police officers for unlawfully accessing police databases. GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
Police officer: Insufficient legal basis for data processing The DPA of Brandenburg has imposed a three-figure fine on a police officer. The police officer had used the telephone number of a person who had filed a criminal complaint for… GERMANY ·Insufficient legal basis for data processing Jan 1, 2023
€3M VOODOO ('provider') was a mobile game developer The investigation service of the French DPA (the investigation service) carried out several checks on voodoo.io and on several of the provider's mobile applications on iOS, in… SAN-2022-026 ·France · Dec 29, 2022
€5,000 Comune di Borgia: Insufficient legal basis for data processing The Italian DPA (Garante) imposed a fine of EUR 5,000 on Comune di Borgia. The municipality processed biometric data of employees for the purpose of registering their attendance.… ITALY · ·Art. 5, 6, 9 +1 Dec 15, 2022
€100,000 Lazio Region: Insufficient legal basis for data processing The Italian DPA has fined Lazio Region EUR 100,000. A trade union had filed a complaint with the DPA alleging that the Region had monitored the e-mail accounts of employees of the… ITALY · ·Art. 5, 6, 113 +1 Dec 1, 2022
€12,000 Comune di Salento: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 12,000 on Comune di Salento. An individual had lodged a complaint with the DPA for being recorded by a CCTV camera, which proved that he… ITALY · ·Art. 5, 6, 12 +3 Oct 20, 2022
€15,000 Servizio Idrico Integrato S.c.p.a.: Insufficient technical and organisational measures to ensure information security The Italian DPA has fined Servizio Idrico Integrato S.c.p.a. EUR 15,000. The controller had operated a website where personal data was being processed without using an SSL form.… ITALY · ·Art. 5, 32 Oct 6, 2022
€20,000 EUROBANK ERGASIAS S.A.: Insufficient fulfilment of information obligations The Hellenic DPA has imposed a fine of EUR 20,000 on EUROBANK ERGASIAS S.A.. In the context of the use of certain debit/credit cards, information of the last 10 transactions were… GREECE · ·Art. 13 Oct 3, 2022
€3,000 Gas station: Insufficient fulfilment of data subjects rights The Hellenic DPA has imposed a fine of EUR 3,000 on a gas station operator. A person had filed a complaint with the DPA due to the controller's failure to grant them access to… GREECE · ·Art. 12, 14 Sep 22, 2022
€405M Meta Platforms, Inc.: Non-compliance with general data processing principles The Irish DPA (DPC) has imposed a fine of EUR 405,000,000 on Meta Platforms, Inc. (Instagram). Following the investigation, the DPC submitted a draft decision under Art. 60 GDPR… IRELAND · ·Art. 5, 6, 12 +3 Sep 5, 2022
€240 MH VILASECA S.L.: Insufficient fulfilment of information obligations The Spanish DPA has imposed a fine on MH VILASECA S.L.. The controller had failed to provide a notice with information about video surveillance in its premises. The original fine… SPAIN · ·Art. 13 Sep 1, 2022
€20,000 Medical laboratory: Insufficient technical and organisational measures to ensure information security The Belgian DPA imposed a fine of EUR 20,000 on a medical laboratory. During its investigation, the DPA found that the laboratory had failed to conduct a data protection impact… BELGIUM · ·Art. 5, 12, 13 +3 Aug 19, 2022
€600 Private individual: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 600 on a private individual. The controller had installed video surveillance cameras which, among other things, also covered the… SPAIN · ·Art. 5, 13 Aug 8, 2022
Italy Garante: TikTok switch to legitimate interest for personalized ads violates Social media platform TikTok (the controller) provided personalized advertising to its users (the data subjects) on the legal basis of consent (Article 6(1)(a) GDPR). In June… 9788429 ·Art. 5, 6, 122 Jul 7, 2022
€45,000 Senseonics Inc.: Non-compliance with general data processing principles The Italian DPA has imposed a fine of EUR 45,000 on Senseonics Inc. The company had reported a data breach to the DPA pursuant to Art. 33 GDPR, involving an employee accidentally… ITALY · ·Art. 5, 6, 7 +4 Jul 7, 2022
Icelandic DPA: genetic research company violated DPO independence under Art. 38(3) GDPR The Icelandic DPA started an investigation into a genetic research company. More specifically, to assess the company's Data Protection Officer (DPO), as well as the performance of… 2020061979 ·Iceland · Jun 29, 2022
€1,000 SC Interactions Marketing SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on SC Interactions Marketing SRL. The controller had sent advertising messages by e-mail to several people on behalf of another… ROMANIA · ·Art. 32 Jun 20, 2022
€26,000 Italian DPA sanctions Municipality of Policoro for CCTV signage, retention and DPO The Municipality of Policoro (Basilicata), implemented the use of CCTV cameras to monitor and fight waste abandonment within its territory. A data subject complained the… Italy · ·Art. 5, 12, 13 +3 Jun 9, 2022
€2,000 Kaufland Romania SCS: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Kaufland România SCS. The controller had reported two data breaches to the DPA pursuant to Art. 33 GDPR. An employee who… ·Art. 29, 32 ·Insufficient technical and organisational measures to ensure information security Jun 3, 2022
€12,000 Comune di Napoli Corpo di Polizia Municipale: Insufficient legal basis for data processing The Italian DPA has fined the police authority 'Comune di Napoli Corpo di Polizia Municipale' EUR 12,000. The police authority had sent a list of names, addresses, tax numbers,… ITALY · ·Art. 5, 6, 88 +1 May 22, 2022
€2,000 Private individual: Insufficient legal basis for data processing The Spanish DPA has imposed a fine of EUR 2,000 on a private individual. The individual had taken photos of a group of minors as well as police officers without their consent and… SPAIN · ·Art. 6 May 20, 2022
€6,000 Homeowners Association: Non-compliance with general data processing principles The Spanish DPA (AEPD) has imposed a fine of EUR 6,000 on a homeowners' association. An apartment owner who had been a resident for 15 years had filed a complaint with the DPA due… SPAIN · ·Art. 5, 13 May 11, 2022
€1,000 IKEA România S.R.L.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on IKEA România S.R.L.. A data subject had complained to the DPA that IKEA had failed to comply with their requests to delete the… ROMANIA · ·Art. 12 Apr 18, 2022
€1,800 FLORAQUEEN FLOWERING THE WORLD S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined FLORAQUEEN FLOWERING THE WORLD S.L. for failing to provide information requested by the DPA during an investigation. The original fine of EUR 3,000 was… SPAIN · ·Art. 58 Apr 18, 2022
€9,000 JIMBO NETWORKS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on JIMBO NETWORKS, S.L.. During its investigation, the DPA found numerous deficiencies on a website operated by the controller. For… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€1,800 Website operator: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) has imposed a fine on the operator of the website link During its investigation, the DPA found numerous deficiencies on a website operated by the… SPAIN · ·Art. 6, 13, 22 Apr 18, 2022
€1.5M DEDALUS BIOLOGIE: Insufficient technical and organisational measures to ensure information security The French DPA (CNIL) has imposed a fine of EUR 1.5 million on DEDALUS BIOLOGIE. DEDALUS distributes software solutions for medical analysis laboratories. In February, the press… FRANCE · ·Art. 28, 29, 32 Apr 15, 2022
€8,000 RAMONA FILMS, S.L.: Insufficient fulfilment of information obligations The Spanish DPA (AEPD) fined RAMONA FILMS, S.L. for failing to ensure that the company's privacy policy complied with the requirements of Art. 13 GDPR. Specifically, the website… SPAIN · ·Art. 13, 22 Apr 13, 2022
€150,000 BASER COMERCIALIZADORA DE REFERENCIA, S.A.: Insufficient legal basis for data processing The Spanish DPA has fined BASER COMERCIALIZADORA DE REFERENCIA, S.A., EUR 150,000. A customer of the company had filed a complaint with the DPA since their electricity supply… SPAIN · ·Art. 6, 32 Apr 11, 2022
€3.7M Dutch Tax and Customs Administration: Non-compliance with general data processing principles The Dutch DPA has imposed a fine of EUR 3,7 million on the Dutch Tax and Customs Administration. This is the highest fine ever imposed by the Dutch DPA As part of its… THE NETHERLANDS · ·Art. 5, 6, 32 +1 Apr 7, 2022
€1.3M Danske Bank: Non-compliance with general data processing principles The Danish DPA has imposed a fine of EUR 1.3 million on Danske Bank. The DPA had opened an investigation against the bank after it informed the DPA that it had a problem with the… DENMARK · ·Art. 5 Apr 5, 2022
€10,000 Piraeus Bank: Non-compliance with general data processing principles The Hellenic DPA has imposed a fine of EUR 10,000 on Piraeus Bank. The bank had mistakenly sent a document containing data of the data subject to a third party. This error was… GREECE · ·Art. 5, 33, 34 Apr 4, 2022
€100,000 Brussels Airport Charleroi: Insufficient legal basis for data processing The Belgian DPA has fined Brussels Airport Charleroi EUR 100,000. The DPA had launched an investigation against the airport following media reports about temperature monitoring of… BELGIUM · ·Art. 5, 6, 9 +3 Apr 4, 2022
€200,000 Brussels Airport Zaventem: Insufficient legal basis for data processing The Belgian DPA has fined Brussels Airport Zaventem EUR 200,000. The DPA had launched an investigation against the airport following media reports about temperature monitoring of… BELGIUM · ·Art. 5, 6, 9 +3 Apr 4, 2022
€7,500 Company: Insufficient fulfilment of data subjects rights The Belgian DPA has imposed a fine of EUR 7,500 on a company. A former managing director had filed a complaint against the company with the DPA. In the context of being dismissed,… BELGIUM · ·Art. 5, 6, 15 +4 Apr 1, 2022
€720,000 Klarna Bank AB: Insufficient fulfilment of information obligations The Swedish DPA has imposed a fine of EUR 720,000 on Klarna Bank AB. Klarna is a financial company that processes a large number of personal data in various ways. As part of its… SWEDEN ·Art. 5, 12, 13 +1 ·Insufficient fulfilment of information obligations Mar 28, 2022
€2,000 Kaufland Romania SCS: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on Kaufland Romania SCS. A data subject had filed a complaint with the DPA concerning the controller's failure to comply with… ·Art. 15 ·Insufficient fulfilment of data subjects rights Mar 25, 2022
€6,700 Danish National Genome Center: Insufficient technical and organisational measures to ensure information security The Danish DPA has imposed a fine of EUR 6,700 on the Danish National Genome Center. The center had conducted a data protection impact assessment that revealed circumstances that… DENMARK · ·Art. 36 Mar 25, 2022
€4,000 English School Cyprus: Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 4,000 on the English School in Cyprus. The school had reported a data breach to the DPA under Art. 33 GDPR. A teacher had used the email… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Mar 22, 2022
€5,000 English School staff union (ESSA): Insufficient technical and organisational measures to ensure information security The Cypriot DPA has imposed a fine of EUR 5,000 on the English School staff union (ESSA). The school had notified the DPA of a data breach under Art. 33 GDPR. A teacher, also a… CYPRUS · ·Art. 32 Mar 21, 2022
€17M Meta Platforms Ireland Limited: Insufficient technical and organisational measures to ensure information security The Irish DPA (DPC) has imposed a fine of EUR 17 million on Meta Platforms Ireland Limited (former Facebook Ireland Limited). The decision is based on twelve notifications of data… ·Art. 5, 24 Mar 15, 2022
€2,000 Operatorul Briza Land S.R.L.: Insufficient fulfilment of data subjects rights The Romanian DPA (ANSPDCP) has fined Operatorul Briza Land S.R.L. EUR 2,000. The controller failed to properly respond to a request for information. ROMANIA · ·Art. 15 Mar 10, 2022
€115,000 Tuckers Solicitors LLP: Non-compliance with general data processing principles The UK DPA (ICO) has fined law firm Tuckers Solicitors LLP EUR 115,000. Tuckers suffered a ransomware attack on its systems, which resulted in a personal data breach. As part of… UNITED KINGDOM · ·Art. 5 Mar 10, 2022
€8,000 Agenzia Regionale per la Tutela dell'Ambiente dell'Abruzzo: Insufficient legal basis for data processing The Italian DPA (Garante) has fined the Agenzia Regionale per la Tutela dell'Ambiente dell'Abruzzo EUR 8,000. A former employee of the environmental agency had filed a complaint… ITALY · ·Art. 2, 5, 6 +1 Mar 10, 2022
€6,000 Azienda sanitaria provinciale di Caltanissetta: Insufficient legal basis for data processing The Italian DPA has fined Azienda sanitaria provinciale di Caltanissetta EUR 6,000. The data subject had asked the controller, in the context of legal proceedings, to send any… ITALY · ·Art. 2, 5, 6 +3 Mar 10, 2022