Content type · 869 documents in this view · 3,843 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Filtering by Topic Clear filter Supervisory Authorities 3615 Processing 2657 Personal Data 2430 Controllers 2040 Processing Agreement 1116 Security 1025 Supervision 869 Healthcare 624 Public Authority 577 Law Enforcement 576 Monitoring 552 Consent 511
€40,000 Orange Romania SA: Non-compliance with general data processing principles The Romanian DPA has imposed a fine of EUR 40,000 on Orange Romania SA. The controller failed to fulfil a request for the erasure of data. The controller also execsevly stored and… ·Art. 5, 6, 7 +2 ·Non-compliance with general data processing principles Jan 27, 2025
€5,000 Softehnica S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 5,000 on Softehnica S.R.L. The controller had suffered a ransomware attack, which allowed unauthorized third parties to gain access to… ROMANIA · ·Art. 32 Jan 23, 2025
€15,000 Vodafone Romania S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 15,000 on Vodafone Romania S.A. Personal data such as names, email addresses and customer numbers were repeatedly disclosed due to… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Jan 20, 2025
€2,000 DELIVERY SOLUTIONS S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on DELIVERY SOLUTIONS S.A. A security incident led to the unauthorized disclosure of personal data (name, address, telephone… ROMANIA · ·Art. 32 Jan 17, 2025
€2,000 Unirea Medical Center S.R.L.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on Unirea Medical Center S.R.L. The controller publicly exposed the access credentials for a data subject's email account on a… ROMANIA · ·Art. 24, 32 Jan 3, 2025
€2,000 AUTOMOCIÓN 1972, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 2,000 on AUTOMOCIÓN 1972, S.L. for failing to prove compliance with an order issued by the DPA SPAIN · ·Art. 58 Dec 23, 2024
€15,000 HSSERVICE LIZCON SOLUTIONS, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 15,000 on HSSERVICE LIZCON SOLUTIONS, S.L. for failing to prove compliance with an order issued by the DPA SPAIN · ·Art. 58 Dec 23, 2024
€9,000 CRIDOLMA BARCELONA S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 9,000 on CRIDOLMA BARCELONA S.L. for failing to prove compliance with an order issued by the DPA SPAIN · ·Art. 58 Dec 23, 2024
€40,000 Coolblue B.V: Insufficient legal basis for data processing The Dutch DPA has imposed a fine of €40,000 on Coolblue. The company collected personal data via cookies without users' explicit consent, relying on pre-ticked consent boxes. THE NETHERLANDS · ·Art. 5, 6 Dec 23, 2024
€600 ENERGY WINNER, S.L.: Insufficient cooperation with supervisory authority Fine of EUR 600 for failure to provide information to the Spanish DPA within the required timeframe SPAIN · ·Art. 58 Dec 23, 2024
€4.8M Netflix International B.V.: Insufficient fulfilment of information obligations The Dutch DPA has imposed a fine of EUR 4.75 million on Netflix. This fine is based on a complaint filed by the Austrian organization 'noyb'. During its investigation, the DPA… THE NETHERLANDS · ·Art. 5, 12, 13 +1 Nov 26, 2024
€1,000 Blackcab Systems SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on Blackcab Systems SRL. A individual lodged a complaint with the DPA, alleging that the controller had failed to properly respond… ROMANIA · ·Art. 12, 15 Nov 4, 2024
€12,000 NEGOCIOS R&R 2020 S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined NEGOCIOS R&R 2020 S.L. EUR 12,000 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Oct 31, 2024
€900 RIVENDELL TECHNOLOGY, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 900 on RIVENDELL TECHNOLOGY, S.L. for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Oct 31, 2024
€4,000 GESTIÓN DE VENTAS IBERIA S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined GESTIÓN DE VENTAS IBERIA S.L. EUR 4000 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Oct 31, 2024
€15,000 Untold SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 15,000 on Untold SRL. During its investigation, the DPA found that the controller had failed to properly comply with a data subject's… ROMANIA · ·Art. 12, 15, 17 Oct 30, 2024
€5,000 Vodafone Romania S.A.: Insufficient technical and organisational measures to ensure information security The Romanian DPA fined Vodafone Romania S.A. EUR 5,000 for sending emails to different recipients without including them in the blind carbon copy (BCC) list. This resulted in the… ·Art. 32 ·Insufficient technical and organisational measures to ensure information security Oct 28, 2024
€10,000 Profi Rom Food SRL: Insufficient legal basis for data processing The Romanian DPA has imposed a fine of EUR 10,000 on Profi Rom Food SRL. During its investigation, the DPA found that the controller had forwarded copies of several employees' ID… ROMANIA · ·Art. 5, 6 Oct 23, 2024
€20,800 Grue municipality: Insufficient technical and organisational measures to ensure information security The Norwegian DPA fined Grue municipality EUR 20,800 following the municipality's notification of a data breach. The municipality reported that personal data of students had been… NORWAY · ·Art. 24, 32 Oct 21, 2024
€1,000 KUR KLINIKUM, S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 1000 on KUR KLINIKUM, S.L. for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Oct 17, 2024
€3,000 Your Consulting SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Your Consulting SRL. The controller had suffered a data breach involving the unauthorized disclosure of personal data. During… ROMANIA · ·Art. 25, 32 Oct 16, 2024
APD/GBA · 131/2024 On 10 February 2023 the data subject, a trainee working at noyb – European Center for Digital Rights, visited the website of the controller, a Belgian media company. The data… 131/2024 ·Belgium ·Art. 4, 5, 6 Oct 11, 2024
€900 Private individual: Insufficient cooperation with supervisory authority The Spanish DPA has imposed a fine of EUR 900 on a private individual for failing to prove compliance with an order issued by the DPA. SPAIN · ·Art. 58 Oct 4, 2024
€600 VOLTIUM CONSULTORES 2020: Insufficient cooperation with supervisory authority The Spanish DPA has fined VOLTIUM CONSULTORES 2020 EUR 600 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Oct 4, 2024
€600 SERVICIOS INMOBILIARIOS Y GESTIÓN RCL-MADRID, S.L.: Insufficient cooperation with supervisory authority Spanish Data Protection Authority (aepd) fined SERVICIOS INMOBILIARIOS Y GESTIÓN RCL-MADRID, S.L. €600 on 2024-09-23 for: Insufficient cooperation with supervisory authority. Spain · ·Art. 58 Sep 23, 2024
€2,000 PPC ENERGIE MUNTENIA S.A.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on PPC ENERGIE MUNTENIA S.A. for failing to respond to a data subject's request for the deletion of their personal data in a… ROMANIA · ·Art. 12, 17 Sep 23, 2024
€3,000 Constanța South Container Terminal SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Constanța South Container Terminal SRL. The controller had suffered a data breach in which personal data of employees had been… ROMANIA · ·Art. 32 Sep 17, 2024
€3,000 Vodafone România SA: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 3,000 on Vodafone România SA for failing to respond to a data subject's request for access and deletion of their personal data in a… ROMANIA · ·Art. 12, 15, 17 Sep 16, 2024
€1,000 SC Class IT Outsourcing SRL: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 1,000 on SC Class IT Outsourcing SRL for failing to respond to a data subject's request for the deletion of their personal data in a… ROMANIA · ·Art. 12, 17 Sep 16, 2024
€600 KVIKU SPAIN, S.L: Insufficient cooperation with supervisory authority The Spanish DPA has fined KVIKU SPAIN, S.L. EUR 600 for failing to provide information requested by the DPA. ·Art. 58 ·Insufficient cooperation with supervisory authority Sep 11, 2024
€25,000 Belgian DPA finds MediaHuis violated GDPR fairness over cookie banner design A data subject visited four website operated by MediaHuis, namely: Gazet van Antwerpen; De Standaard; Het Nieuwsblad; Het Belang van Limburg. On each website there was a cookie… Belgium · ·Art. 5, 6, 7 Sep 6, 2024
€20,900 Eidskog municipality: Insufficient legal basis for data processing The Norwegian DPA imposed a fine of EUR 20,900 on Eidskog municipality for giving two former employees access to a whistleblower’s report without redacting sensitive health and… NORWAY · ·Art. 6 Sep 6, 2024
€3,000 Senira Limited: Insufficient cooperation with supervisory authority The Cypriot DPA fined Senira Limited EUR 3,000 for failing to sufficiently cooperate with the DPA. CYPRUS · ·Art. 31 Sep 4, 2024
€12,700 University of Agder: Insufficient technical and organisational measures to ensure information security The Norwegian DPA has fined the University of Agder (UiA) EUR 12,700. An employee of UiA had discovered that documents containing personal data of employees, students and external… NORWAY · ·Art. 24, 32 Sep 4, 2024
€4,500 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 4,500 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Aug 30, 2024
€8,000 Ana Hotels SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has fined Ana Hotels SRL EUR 8,000. The controller had suffered a data breach which resulted in the unauthorized disclosure of personal data processed and stored… ROMANIA · ·Art. 32 Aug 20, 2024
€1,000 BEST ELAN ONLINE SRL: Insufficient cooperation with supervisory authority The Romanian DPA has fined BEST ELAN ONLINE SRL EUR 1,000 for failing to provide information requested by the DPA. ROMANIA · ·Art. 58 Aug 6, 2024
€290M Uber Technologies Inc., Uber B.V.: Non-compliance with general data processing principles The Dutch DPA has imposed a fine of EUR 290 million on Uber for transferring personal data of European drivers to the USA without sufficient privacy safeguards. The DPA launched… Jul 22, 2024
€200,000 Vodafone España, S.A.U.: Insufficient cooperation with supervisory authority The Spanish DPA has fined Vodafone España, S.A.U. EUR 200,000 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Jul 18, 2024
€5,000 POLAND DPA: Insufficient cooperation with supervisory authority The Polish DPA has fined a data controller EUR 5,000 for failing to provide information requested by the DPA during an investigation. ·Art. 31, 58 ·Insufficient cooperation with supervisory authority Jul 10, 2024
€4,000 ALTERNATIVA CORELLANA INDEPENDIENTE: Insufficient cooperation with supervisory authority The Spanish DPA has fined ALTERNATIVA CORELLANA INDEPENDIENTE EUR 4,000 for failing to provide information requested by the DPA. SPAIN · ·Art. 58 Jun 26, 2024
€3,000 Rețele Electrice Muntenia SA.: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 3,000 on Rețele Electrice Muntenia SA. A user who logged into their account was able to access the personal data of other customers.… ROMANIA · ·Art. 32 Jun 25, 2024
€1,000 Rețele Electrice Dobrogea SA: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on Rețele Electrice Dobrogea SA. A user who logged into their account was able to access the personal data of other customers.… ROMANIA · ·Art. 32 Jun 25, 2024
FRANCE DPA: Insufficient cooperation with supervisory authority The French DPA has imposed a fine on a data controller for failing to cooperate sufficiently with the DPA. ·Insufficient cooperation with supervisory authority Jun 5, 2024
€6,000 Ambitious People Group B.V.: Insufficient fulfilment of data subjects rights The Dutch DPA has imposed a fine of EUR 6,000 on the recruitment company Ambitious People Group B.V. . The controller had not deleted the data of data subjects after they had… THE NETHERLANDS · ·Art. 12, 17 Jun 4, 2024
€2,000 Corint Logistic SRL.: Insufficient fulfilment of data subjects rights The Romanian DPA has imposed a fine of EUR 2,000 on Corint Logistic SRL. A customer had filed a complaint with the DPA because they had received advertising text messages from the… ROMANIA · ·Art. 5, 17, 21 May 30, 2024
€96,000 WATIUM S.L.: Insufficient cooperation with supervisory authority The Spanish DPA has fined WATIUM S.L. for failing to provide information requested by the DPA. The original fine of EUR 160,000 was reduced to EUR 96,000 due to voluntary payment… SPAIN · ·Art. 58 May 22, 2024
€31M Clearview AI Inc.: Non-compliance with general data processing principles The Dutch DPA has fined Clearview Al Inc. EUR 30,500,000. Clearview, a company offering facial recognition services, holds a database of over 30 billion images, including those of… May 16, 2024
€1,000 MEDICOVER SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 1,000 on MEDICOVER SRL. The healthcare facility had mistakenly forwarded a patient file to the wrong patient. ROMANIA · ·Art. 32 May 9, 2024
€2,000 IRIDEX GROUP SALUBRIZARE SRL: Insufficient technical and organisational measures to ensure information security The Romanian DPA has imposed a fine of EUR 2,000 on IRIDEX GROUP SALUBRIZARE SRL. The controller had sent an e-mail to customers without using the blind copy option, revealing the… ROMANIA · ·Art. 32 May 9, 2024