Regulatory actions, fines, warnings, and enforcement decisions
€1,800 fine - Spanish Data Protection Authority (aepd)
The Spanish DPA has imposed a fine of EUR 1,800 on a Landlord. The landlord used video surveillance in rental apartments without having a sufficient legal basis. The original fine of EUR 3,000 was reduced to EUR 1,800 due to immediate payment and admission of responsibility by the controller.
€284,450 fine - Information Commissioner (ICO)
The UK DPA has imposed a fine of GBP 247,590 (EUR 284,450) on MediaLab.AI, Inc.The controller of the image-sharing and hosting platform Imgur failed to implement age verification. This resulted in the controller processing children's data without sufficient legal basis, as the consent given was not provided by the children's parents or carers.
€20,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 20,000 onTensa Art Design S.A.The DPA began investigating the controller's data processing activities, but the controller failed to respond to the DPA's requests.
€10,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 10,000 on GENPACT ROMANIA SRL. The controller suffered a successful cyber attack due to insufficient technical and organisational measures. The attacker was able to exploit vulnerabilities in some passwords and in the way user accounts' authentication could be reset.
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Huizen. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Eindhoven. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Haarlemmermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism st
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Veenendaal. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism steppe
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Delft. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Tilburg. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped u
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Hilversum. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Zoetermeer. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism steppe
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Ede. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism stepped up me
€1,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 1,000 on the Alliance for the Union of Romanians (AUR) Party. The controller failed to react adequately to a data subject's request to exercise their rights regarding a personal letter containing electoral information.
€25,000 fine - Dutch Supervisory Authority for Data Protection (AP)
The Dutch DPA has imposed a fine of EUR 25,000 on the Municipality of Gooise Meren. The controller, one of ten municipalities that were fined, processed data regarding the Islamic community in its municipality using a force field analysis, for which it employed an external processor. This processing took place at a time of heightened societal concern about Islamic extremism and terrorism. During this period, the Dutch government and the National Coordinator for Security and Counterterrorism step
€10,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 10,000 on a natural person. The controller operated a website on which identity cards containing personal data, including special category data, possible criminal convictions, data on the intimate lives of data subjects and possible debts, were published. The processing of this data was not based on a sufficient legal basis, and the controller did not ensure that the data was correct, complete or transparent. Furthermore, the controller did not adequate
€15,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 15,000 on Continental Automotive Products SRL. The controller failed to implement adequate technical and organisational measures, resulting in a cyber incident.
Boete van €15.000 - Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP).
De Roemeense Autoriteit voor Persoonsgegevens heeft een boete van 15.000 euro opgelegd aan Continental Automotive Products SRL. De verantwoordelijke partij heeft onvoldoende technische en organisatorische maatregelen genomen, wat heeft geleid tot een cyberincident.
€1,200 fine - Spanish Data Protection Authority (aepd)
The Spanish DPA has imposed a fine of EUR 1,200 on a dental clinic. The controller used video surveillance in its clinic for security purposes, including a camera in the doctor's office where patients were treated. This resulted in excessive data processing. The original fine of EUR 2,000 was reduced to EUR 1,200 due to immediate payment and admission of responsibility by the controller.
8.000 euro boete - De Roemeense nationale toezichthoudende autoriteit voor de verwerking van persoonsgegevens (ANSPDCP).
De Roemeense autoriteit voor gegevensbescherming heeft PREMIER RESTAURANTS ROMANIA SRL een boete van 8.000 euro opgelegd. De verantwoordelijke partij heeft onvoldoende technische en organisatorische maatregelen genomen, wat heeft geleid tot een cyberincident.
€8,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 8,000 on PREMIER RESTAURANTS ROMANIA SRL. The controller failed to implement adequate technical and organisational measures, resulting in a cyber incident.
€8,000 fine - Spanish Data Protection Authority (aepd)
The Spanish DPA has imposed a fine of EUR 8,000 on KVIKU SPAIN, S.L.The controller requires customers to send a photo of themselves holding their ID card when verifying their identities, which violates the principle of data minimisation. The original fine of EUR 10,000 was reduced to EUR 8,000 due to immediate payment by the controller.
€500 fine - Spanish Data Protection Authority (aepd)
The Spanish DPA has imposed a fine of EUR 500 on VOX ESPAÑA. The controller, a political party, posted a picture of of a receipt on its Facebook page. The picture of the recipt included the full name, signature and personal ID number of a natural person. The controller had no legal basis to publish this personal data.
18.500 euro boete - Poolse nationale autoriteit voor de bescherming van persoonlijke gegevens (UODO).
De Poolse gegevensbeschermingsautoriteit heeft een boete van 18.500 euro opgelegd aan de regionale politie van Krakau. De autoriteit heeft persoonlijke gegevens, waaronder medische gegevens, van een betrokkene gepubliceerd die betrokken was bij een politieonderzoek. Deze publicatie was niet noodzakelijk voor het beoogde doel.
€18,500 fine - Polish National Personal Data Protection Office (UODO)
The Polish DPA has imposd a fine of EUR 18,500 on the Komendanta Miejskiego Policji w Krakowie. The controller published personal data, including health data, of a data subject that had been involved in a police investigation, which was not necessary for the purpose of the publication.
€10,000 fine - Hellenic Data Protection Authority (HDPA)
The Greek DPA has imposed a fine of EUR 10,000 on a Fire Brigade Head Quarter. The controller had stored health data of an employee which had been in relation with her sick leave. The controller stored every detail of the medical condition, treatment and other related data. The ammount of data processed had not been necessary for the purpose and therefore no legal basis.
€2,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 2,000 on Money Seeds S.R.L. The controller failed to fulfil a data subject's request to exercise their rights.
€80,000 fine - Hellenic Data Protection Authority (HDPA)
The Greek DPA has imposed a fine of EUR 80,000 on ONE WAY PRIVATE COMPANY. The fined entity is the processor of Thessaloniki–Thessaly Gas Supply Company S.A. (ETid-3016). The processor, a call center involved in direct marketing activities, had implemented a system to check whether consent had been given to contact a specific person. However, this system could be bypassed or ignored by the operator, resulting in data subjects being contacted without their consent. Furthermore, the controller had
€10,000 fine - Hellenic Data Protection Authority (HDPA)
The Greek DPA has imposed a fine of EUR 10,000 on Thessaloniki–Thessaly Gas Supply Company S.A. The controller, an energy provider, used external processors for direct marketing via telephone. The controller forwarded complaints by data subjects to the external processors, but failed to ensure, that the processors response was adequate, gernerally failing to adequatly controll processors.
€588 fine - Czech Data Protection Auhtority (UOOU)
The company obtained a copy of photographic ID of the personal data subject with his consent, however did not react to his consent withdrawal and continued in processing of his personal data.
€3,500,000 fine - French Data Protection Authority (CNIL)
The French DPA has imposed a fine of EUR 3,500,000 on a company. The controller operated a loyalty program in France and 16 other EU countries, using customer data obtained through the program to transfer it to a third party for marketing purposes. The controller had no sufficient legal basis for this transfer and also failed to inform the data subjects. Furthermore, the controller used an inadequate method to store passwords. Finally, the controller failed to conduct a data protection impact as
€50 fine - Data Protection Authority of Rhineland-Palatinate
Unlawful use of a dashcam
De Kroatische gegevensbeschermingsautoriteit (DPA) heeft een telecombedrijf een boete van 20.000 euro opgelegd. Een betrokkene had een klacht ingediend bij de DPA, waarin hij beweerde dat het bedrijf nog steeds zijn persoonlijke gegevens verwerkte, terwijl hij al meer dan tien jaar geen klant van het bedrijf was. Tijdens het onderzoek stelde de DPA vast dat het bedrijf de gegevens nog steeds bewaarde vanwege een vermeende schuld. Hoewel die schuld niet meer bestond, had het bedrijf de gegevens van de betrokkene niet verwijderd.
Slovaakse Autoriteit voor Gegevensbescherming.
Een verantwoordelijke voor de gegevensverwerking heeft niet voldaan aan het verzoek van een betrokkene om toegang te krijgen tot zijn of haar persoonlijke gegevens die zijn verwerkt via audio-opnamen.
Slovak Data Protection Office
Personal data have been unlawfully published on the website of a city within the framework of fulfilling its disclosure obligation under the Freedom of Information Act. However, the Data Protection Authority stated that the City had published the personal data in violation of the law and without the consent of the person concerned.
Slovaakse Autoriteit voor de Bescherming van Persoonsgegevens.
Persoonsgegevens zijn onrechtmatig gepubliceerd op de website van een gemeente, in het kader van de wettelijke verplichting om informatie te verstrekken op grond van de Wet openbaarheid van bestuur. De Autoriteit Persoonsgegevens heeft echter vastgesteld dat de gemeente deze persoonsgegevens heeft gepubliceerd in strijd met de wet en zonder de toestemming van de betreffende persoon.
Een boete van 5.000 euro - opgelegd door de Spaanse Autoriteit voor Gegevensbescherming (AEPD).
De Spaanse telecommunicatie- en informatiestructuur (SETSI) heeft besloten dat Vodafone een klant moest vergoeden voor kosten die ten onrechte aan hem waren doorbelast. Desondanks heeft Vodafone persoonlijke gegevens van deze betreffende klant doorgegeven aan een kredietregistratiebureau (BADEXCUG). De AEPD (Spaanse Autoriteit voor Gegevensbescherming) heeft geconstateerd dat dit gedrag in strijd is met het beginsel van juistheid.
€300 fine - Data Protection Authority of Rhineland-Palatinate
Unlawful use of a dashcam
€20,000 fine - Croatian Data Protection Authority (azop)
The Croatian DPA (azop) has imposed a fine of EUR 20,000 on a telecommunications company. A data subject had filed a complaint with the DPA claiming that the company was still processing their personal data even though they had not been a customer of the company for more than ten years. During its investigation, the DPA found that the company had still been storing the data due to an alleged debt. The debt was no longer outstanding, however, the company had failed to delete the data of the data
Boete van €3.140 - Tsjechische Autoriteit voor Gegevensbescherming (UOOU).
De bank heeft een persoonlijke bankrekening geopend voor een betrokkene zonder zijn toestemming of kennis. De bank beweerde zijn persoonlijke gegevens te hebben omdat de betrokkene een bedrijfsrekening van zijn werkgever had gesloten. De bank kon het Bureau voor Persoonsgegevens niet de benodigde documenten verstrekken om aan te tonen dat er een overeenkomst was gesloten met de betrokkene.
Boete van €9.600 - Spaanse Autoriteit voor Gegevensbescherming (AEPD).
Een restaurant wilde een werknemer disciplinaire maatregelen opleggen op basis van beelden van een mobiele telefoonvideo. Deze video was opgenomen door een andere werknemer in het restaurant en diende als bewijsmateriaal. De initiële boete van 12.000 euro is verlaagd naar 9.600 euro.
€118 fine - Data Protection Authority of Saarland
Illegal disclosure of personal data relating to a third party.
Een boete van 588 euro - opgelegd door de Tsjechische Autoriteit voor Gegevensbescherming (UOOU).
Het bedrijf heeft een kopie van een identiteitsbewijs met een foto van de betrokkene verkregen, met zijn toestemming. Echter, het bedrijf heeft niet gereageerd op zijn intrekking van die toestemming en is doorgegaan met de verwerking van zijn persoonlijke gegevens.
Een boete van 960 euro - van het Poolse nationale bureau voor de bescherming van persoonlijke gegevens (UODO).
€10,000 fine - Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
The Romanian DPA has imposed a fine of EUR 10,000 on Roumasport S.R.L The controller failed to implement adequate technical and organisational measures, resulting in multiple cyber incidents.
€9,600 fine - Spanish Data Protection Authority (aepd)
A restaurant wanted to impose disciplinary sanctions on an employee using images from a mobile phone video which was recorded by another employee in the restaurant for evidence purposes. The initial fine of EUR 12.000 was reduced to EUR 9.600.
Een boete van 60.000 euro - opgelegd door de Spaanse autoriteit voor gegevensbescherming (AEPD).
De bankrekening van de klager werd belast door ENDESA, waarbij de begunstigde een derde partij was. Deze derde partij was veroordeeld volgens het strafrecht en had een bevel van twee jaar gekregen dat betrekking had op de klager, haar woonplaats en werkplek. In plaats van de contractgegevens zoals gevraagd door de klager aan te passen, heeft ENDESA per ongeluk haar gegevens verwijderd en de gegevens van de derde partij ingevoerd. De AEPD (Spaanse Autoriteit voor Gegevensbescherming) heeft geconstateerd dat de openbaarmaking van de gegevens van de klager aan de derde partij een ernstige schending was van het principe van vertrouwelijkheid.
Boete van €10.000 - Spaanse Autoriteit voor Gegevensbescherming (AEPD).
Het bedrijf heeft cookies geplaatst op het apparaat van de eindgebruiker zonder voorafgaande toestemming van de betrokkene.
Boete van 60.000 euro - Spaanse Autoriteit voor Gegevensbescherming (AEPD).
Naar verluidt heeft de betrokkene een microkrediet niet terugbetaald aan een online kredietverstrekker, waarna de vordering werd overgedragen aan een incassobureau. Vervolgens begon dit incassobureau e-mails te versturen, niet alleen naar e-mailadressen die door de betrokkene waren opgegeven, maar ook naar een institutioneel e-mailadres van zijn werkplek, dat toegankelijk was voor alle collega's en dat nooit door de betrokkene was verstrekt.
€60,000 fine - Spanish Data Protection Authority (aepd)
The complainant's bank account was charged by ENDESA, the beneficiary of which was a third party, who had been convicted under criminal law and imposed with a two-year restraining order regarding the claimant, her domicile and work. Instead amending the contract details as requested by the claimant ENDESA deleted her data erroneously and fillid in the data of the third party. The AEPD found the disclosure of the claimant's data to the third party was a severe violation of the principle of confid