Enforcement

€10,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 10,000 on GENPACT ROMANIA SRL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures. The attacker was able to exploit vulnerabilities in some passwords and in the way user accounts' authentication could be reset.

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Zoetermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism steppe

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Ede. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up me

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Hilversum. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Tilburg. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped u

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Gooise Meren. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism step

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Eindhoven. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Haarlemmermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism st

€10,000 fine - Spanish Data Protection Authority (aepd)

The Spanish DPA has imposed a fine of EUR 10,000 on FREE TECHNOLOGIES EXCOM, S.L. The controller had reset user passwords and communicated the new passwords to the clients via email. However, the email was not encrypted and did not implement any other appropriate security measures.

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Veenendaal. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism steppe

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Huizen. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up

€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Delft. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up

€565,000 fine - Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)

The Swedish DPA has imposed a fine of EUR 565,500 on Sportadmin i Skandinavien AB. The controller suffered a sucessfull cyber attack, resulting in personal and special category data of 2,126,075 individuals, including minors, beeing published in the darknet. The attack happend due to an succesfull SQL injection on one of the controllers websites, which had not been protected against this kind of attack, granting the attacker access to the controllers server, allowing him to exfiltrate said data.

€5,000,000 fine - French Data Protection Authority (CNIL)

The French DPA has imposed a fine of EUR 5,000,000 on FRANCE TRAVAIL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures, resulting in the leak of personal and special category data concerning 38,820,828 individuals. The attack was carried out using the 'social engineering' method, meaning that the attacker obtained goods or information by exploiting the trust, ignorance or credulity of third parties.

Boete van €15.000 - Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP).

De Roemeense Autoriteit voor Persoonsgegevens heeft een boete van 15.000 euro opgelegd aan Continental Automotive Products SRL. De verantwoordelijke partij heeft onvoldoende technische en organisatorische maatregelen genomen, wat heeft geleid tot een cyberincident.

€15,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 15,000 on Continental Automotive Products SRL. The controller failed to implement adequate technical and organisational measures, resulting in a cyber incident.

€1,200 fine - Spanish Data Protection Authority (aepd)

The Spanish DPA has imposed a fine of EUR 1,200 on a dental clinic. The controller used video surveillance in its clinic for security purposes, including a camera in the doctor's office where patients were treated. This resulted in excessive data processing. The original fine of EUR 2,000 was reduced to EUR 1,200 due to immediate payment and admission of responsibility by the controller.

€8,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 8,000 on PREMIER RESTAURANTS ROMANIA SRL. The controller failed to implement adequate technical and organisational measures, resulting in a cyber incident.

8.000 euro boete - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP).

De Roemeense autoriteit voor gegevensbescherming heeft PREMIER RESTAURANTS ROMANIA SRL een boete van 8.000 euro opgelegd. De verantwoordelijke partij heeft onvoldoende technische en organisatorische maatregelen genomen, wat heeft geleid tot een cyberincident.

€15,000,000 fine - French Data Protection Authority (CNIL)

The French DPA has imposed a fine of EUR 15,000,000 on FREE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email.

27 miljoen euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL).

De Franse autoriteit voor gegevensbescherming (CNIL) heeft FREE een boete van 15.000.000 euro opgelegd. Het bedrijf heeft een datalek geleden als gevolg van onvoldoende technische en organisatorische maatregelen. Dit werd veroorzaakt door het gebruik van een ontoereikende authenticatiemethode om verbinding te maken met hun VPN voor thuiswerken. Bovendien heeft het bedrijf de betrokken personen niet voldoende geïnformeerd, omdat essentiële informatie ontbrak in de e-mail waarin de datalek werd gemeld.

€27,000,000 fine - French Data Protection Authority (CNIL)

The French DPA has imposed a fine of EUR 27,000,000 on FREE MOBILE. The controller suffered a data breach due to insufficient technical and organisational measures. This was caused by using an inadequate authentication procedure to connect to their VPN for remote working. Additionally, the controller failed to adequately inform the affected data subjects due to necessary information being missing from the information email. Lastly, the controller failed to adequately sort data and retain persona

€232,379 fine - Polish National Personal Data Protection Office (UODO)

The Polish DPA has imposed a fine of EUR 232,379 on the Polish Postal Service. The controller appointed a person as DPO who also held a managerial position with authority over security and classified information protection issues. However, the controller failed to conduct an analysis to ensure the DPO's independence. Furthermore, the controller was unable to ensure that the DPO could fulfil their role without any conflicts of interest.

€5,000 fine - Hellenic Data Protection Authority (HDPA)

The Greek DPA has imposed a fine of EUR 5,000 on REVMA PLUS Retail S.A.. The fined entity is the processor of Thessaloniki–Thessaly Gas Supply Company S.A. (ETid-3016). The processor, a call center involved in direct marketing activities, suffered a technical error in its system that prevented operators from calling data subjects that had not given their consent for direct marketing calls. The processor also failed to inform the controller of the technical error.

€10,000 fine - Hellenic Data Protection Authority (HDPA)

The Greek DPA has imposed a fine of EUR 10,000 on SIGMA & KAPPA IMPORTING SOCIÉTÉ ANONYME. The fined entity is the processor of Thessaloniki–Thessaly Gas Supply Company S.A. (ETid-3016). The processor, a call center involved in direct marketing activities, had not implemented sufficient technical and organisational measures to prevent operators from calling data subjects who had not given their consent for direct marketing calls.

Een boete van 40.000 euro - van het Slowaakse databeschermingskantoor.

De verantwoordelijke partij heeft onvoldoende beveiligingsmaatregelen genomen bij de verwerking van persoonsgegevens, waardoor de verplichting om de verwerkte persoonsgegevens te beschermen is geschonden.

Een boete van €10.000 - De Roemeense nationale toezichthouder op de verwerking van persoonsgegevens (ANSPDCP).

De Roemeense autoriteit voor gegevensbescherming (DPA) heeft een boete van 10.000 euro opgelegd aan Roumasport S.R.L. Het bedrijf heeft nagelaten voldoende technische en organisatorische maatregelen te implementeren, wat heeft geleid tot meerdere cyberincidenten.

Slovaakse Autoriteit voor Gegevensbescherming.

Overtreding van maatregelen ter bescherming van de informatiebeveiliging (op dit moment zijn er geen verdere details beschikbaar).

Slovak Data Protection Office

Violation of information security measures (no further information available at the moment)

12.000 euro boete - Spaanse Autoriteit voor Gegevensbescherming (AEPD).

Het gasbedrijf had geen passende maatregelen getroffen om de identiteit van de betrokkene te verifiëren. De persoon die de klacht heeft ingediend, beweert dat het bedrijf zijn gegevens per e-mail naar een derde partij heeft gestuurd als reactie op een verzoek.

€10,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

The Romanian DPA has imposed a fine of EUR 10,000 on Roumasport S.R.L The controller failed to implement adequate technical and organisational measures, resulting in multiple cyber incidents.

Slovaakse Autoriteit voor de Bescherming van Persoonsgegevens.

Documenten die persoonlijke gegevens bevatten, zijn op het gebied van de gemeentelijke afvalverwerkingsplaats vernietigd.

Een boete van 50.000 euro - van het Slowaakse databeschermingskantoor.

Aanvragen voor sociale uitkeringen van Slovakische burgers werden per post naar buitenlandse instanties verzonden. Deze post is onderweg verloren gegaan, waardoor de locatie van deze persoonlijke gegevens niet kon worden achterhaald.

Slovak Data Protection Office

Documents containing personal data were disposed of in the area of the municipal garbage dump.

€50,000 fine - Slovak Data Protection Office

Applications for social benefits from Slovak citizens were sent by post to foreign authorities. These were lost by post, with the result that the whereabouts of these personal data could not be clarified.

€980 fine - Czech Data Protection Auhtority (UOOU)

The operator of an online game was exposed to several DDoS attacks which caused the malfunctioning of the servers. The attacker blackmailed the operator stating that the attacks will not stop unless he pays money. As part of the blackmail, the attacker offered the operator that he will create an upgraded and better firewall protection to the servers of the operator. The operator agreed and paid the attacker. The operator implemented the new code from the attacker which proved better than the old

€12,000 fine - Spanish Data Protection Authority (aepd)

The gas company did not have appropriate measures in place to verify the identity of the data subject. The person who filed the complaint alleges that the company e-mailed his information to a third party in response to a request.

Boete van €980 - Tsjechische Autoriteit voor Gegevensbescherming (UOOU).

De beheerder van een online spel is het slachtoffer geworden van meerdere DDoS-aanvallen, wat resulteerde in storingen van de servers. De aanvaller chanteerde de beheerder en dreigde dat de aanvallen niet zouden stoppen tenzij er geld werd betaald. Als onderdeel van de chantage bood de aanvaller aan om een verbeterde en betere firewallbescherming voor de servers van de beheerder te implementeren. De beheerder stemde ermee in en betaalde de aanvaller. De beheerder implementeerde de nieuwe code van de aanvaller, wat bleek beter te zijn dan de oude.

€40,000 fine - Slovak Data Protection Office

The controller did not take adequate security measures when processing personal data, thereby breaching the obligation to protect the processed personal data.

Een boete van 2.000 euro - van de Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP).

De Roemeense autoriteit voor gegevensbescherming heeft een boete van 2.000 euro opgelegd aan de Roemeense vereniging van algemene verpleegkundigen, verloskundigen en medische assistenten, afdeling Neamt. De verantwoordelijke partij heeft videobewaking gebruikt op een manier die niet in overeenstemming is met de Algemene Verordening Gegevensbescherming (AVG).

1.700.000 euro boete - Frans Nationaal Instituut voor Gegevensbescherming (CNIL).

De Franse autoriteit voor gegevensbescherming (CNIL) heeft NEXPUBLICA FRANCE een boete van 1.700.000 euro opgelegd. De verantwoordelijke, die een softwareontwikkelaar was, heeft een softwarepakket ontwikkeld en aangeboden dat bedoeld is om de relaties met gebruikers te beheren in de sector van maatschappelijke activiteiten. Onvoldoende technische en organisatorische maatregelen hebben geleid tot een cyberincident dat de software heeft getroffen.

€500,000 fine - Spanish Data Protection Authority (aepd)

The Spanish DPA has imposed a fine of EUR 500,000 on CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. The controller used a communication tool that was not designed in accordance with the privacy-by-design principle. This resulted in an unaffiliated third party receiving messages containing personal data intended for another customer.

Een boete van 500.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD).

De Spaanse gegevensbeschermingsautoriteit heeft CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. een boete van 500.000 euro opgelegd. De verantwoordelijke partij heeft een communicatietool gebruikt die niet was ontworpen in overeenstemming met het "privacy by design"-principe. Hierdoor zijn berichten met persoonlijke gegevens, die bestemd waren voor een andere klant, in handen gekomen van een onafhankelijke derde partij.

€1,700,000 fine - French Data Protection Authority (CNIL)

The French DPA has imposed a fine of EUR 1,700,000 on NEXPUBLICA FRANCE. The controller, who was a software developer, created and offered a software package designed to manage user relations in the social action sector. Insufficient technical and organisational measures resulted in a cyber incident affecting the software.

Een boete van 32.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD).

De Spaanse autoriteit voor gegevensbescherming (DPA) heeft EXCEL HOTELS & RESORTS, S.A. een boete van 32.000 euro opgelegd. Het bedrijf gebruikte beveiligingspersoneel om de toegang tot haar faciliteit te controleren. Dit beveiligingspersoneel liet regelmatig documenten met persoonlijke gegevens achter op hun post, waardoor deze toegankelijk werden voor derden. De oorspronkelijke boete van 40.000 euro is verlaagd naar 32.000 euro vanwege de onmiddellijke betaling.

€32,000 fine - Spanish Data Protection Authority (aepd)

The Spanish DPA has imposed a fine of EUR 32,000 on EXCEL HOTELS & RESORTS, S.A. The controller used guards to control access to its facility. The guards regularly left documents containing personal data in their post, making them accessible to third parties. The original fine of EUR 40,000 was reduced to EUR 32,000 due to immediate payment.

€175,000 fine - Dutch Supervisory Authority for Data Protection (AP)

The Dutch DPA has imposed a fine of EUR 175,000 on Arnhem and Nijmegen University of Applied Sciences. The controller suffered a data breach due to insufficient technical and organisational measures.

175.000 euro boete - Nederlandse Autoriteit Persoonsgegevens (AP).

De Nederlandse Autoriteit Persoonsgegevens heeft een boete van 175.000 euro opgelegd aan de Hogeschool Arnhem en Nijmegen. De verantwoordelijke partij heeft een datalek geleden als gevolg van onvoldoende technische en organisatorische maatregelen.

Een boete van €1.000 - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP).

De Roemeense autoriteit voor gegevensbescherming (DPA) heeft een boete van 1.000 euro opgelegd aan Compania de Apa Oltenia S.A. De verantwoordelijke partij heeft nagelaten om adequate technische en organisatorische maatregelen te implementeren om de gegevensbeveiliging te waarborgen, wat heeft geresulteerd in het uitlekken van persoonlijke gegevens op sociale media.