{"meta":{"generated_at":"2026-10-07 12:51:05","licence":"CC BY-NC-SA 4.0 — https://creativecommons.org/licenses/by-nc-sa/4.0/","sources":["enforcementtracker.com, provided by CMS (CC BY-NC-SA 4.0)","GDPRhub, noyb (CC BY-NC-SA 4.0)"],"stats":{"cases":4992,"countries":34,"total_fines_eur":9033230564,"latest_decision":"2026-09-22","last_run":"2026-10-07 12:51:04","total_fines_eur_converted":93003971},"last_fetch":"2026-10-06 10:24:26","moved":{"2026/HR/001":"ND/HR/003","2026/PL/002":"ND/PL/001","2026/DE/001":"ND/DE/002","2026/DE/002":"ND/DE/003","2026/DE/003":"ND/DE/004","2026/ES/001":"ND/ES/096","2026/CZ/001":"ND/CZ/002","2026/CZ/002":"ND/CZ/003","2026/SK/001":"ND/SK/001","2026/ES/002":"ND/ES/097","2026/SK/002":"ND/SK/002","2026/SK/003":"ND/SK/003","2026/SK/004":"ND/SK/004","2026/SK/005":"ND/SK/005","2026/SK/006":"ND/SK/006","2026/ES/003":"ND/ES/098","2026/ES/004":"ND/ES/099","2026/ES/005":"ND/ES/100","2026/ES/006":"ND/ES/101","2026/ES/007":"ND/ES/102","2026/DE/004":"ND/DE/005","2026/CZ/003":"ND/CZ/004","2025/XX/001":"2025/NL/002","2025/XX/002":"2025/NL/003","2025/DE/004":"2024/DE/022","2024/XX/001":"2024/NL/007","2024/XX/002":"2024/NL/008","2024/XX/004":"2024/NL/009","2024/XX/006":"2024/NL/010","2024/XX/003":"2024/NL/011","2024/XX/005":"2024/NL/012","2024/XX/007":"2024/NL/013","2024/SK/001":"2025/SK/001","2024/SK/002":"2025/SK/002","2024/SK/003":"2025/SK/003","2024/LT/001":"2025/LT/013","2023/XX/001":"2023/NL/007","2023/XX/002":"2023/NL/008","2023/XX/003":"2023/NL/009","2022/XX/001":"2022/IM/001","2022/XX/002":"2022/NL/006","2022/XX/003":"2022/NL/007","2022/XX/004":"2022/NL/008","2021/XX/001":"2021/NL/009","2021/XX/002":"2021/NL/010","2021/XX/004":"2021/NL/011","2021/XX/003":"2021/NL/012","2021/XX/006":"2021/NL/013","2021/XX/007":"2021/NL/014","2021/XX/005":"2021/NL/015","2020/XX/003":"2020/NL/006","2020/XX/001":"2020/IM/001","2020/XX/005":"2020/NL/007","2020/XX/006":"2020/NL/008","2020/XX/007":"2020/IM/002","2020/XX/004":"2020/NL/009","2020/XX/008":"2020/NL/010","2020/XX/002":"2020/NL/011","2020/XX/009":"2020/NL/012","2019/XX/001":"2019/NL/003","2019/XX/002":"2019/NL/004","2019/XX/003":"2019/NL/005","2026/AT/005":"ND/AT/001","ND/GB/001":"2019/GB/008","ND/GB/004":"2020/GB/024","ND/RO/009":"2021/RO/029","ND/GB/005":"2021/GB/033","ND/CZ/001":"2023/CZ/008","ND/RO/017":"2026/RO/030","ND/RO/018":"2026/RO/031","ND/RO/019":"2026/RO/032","ND/RO/020":"2026/RO/033"},"fields":["pharos_id","case_id","source","country","country_code","authority","decision_date","date_precision","fine_eur","fine_original","currency","controller","sector_tag","articles","categories","violation_type","best_outcome","source_url","source_page","gdprhub_page","summary_by","parties_named","controller_note","org","org_group","fine_amount","fine_eur_est","fx","party_kind","status","status_note","status_source","fine_before"],"summary_shard":250,"groups":{"Google (Alphabet)":"Google LLC (US parent), Google Ireland Limited (EU headquarters) and national Google companies.","Meta":"Meta Platforms, Inc. (US parent), Meta Platforms Ireland (EU headquarters, formerly Facebook Ireland); Instagram and WhatsApp are Meta companies.","Amazon":"Amazon Europe Core (Luxembourg, EU headquarters), Amazon Web Services and national logistics companies.","Microsoft":"Microsoft Corporation (US parent), Microsoft Ireland Operations; LinkedIn has been a Microsoft company since 2016.","TikTok (ByteDance)":"TikTok Technology Limited (Ireland, EU headquarters) and TikTok Limited.","Uber":"Uber Technologies, Inc. (US parent) and Uber B.V. (Netherlands, EU headquarters).","Clearview AI":"Clearview AI, Inc. (US); some sources spell it 'Clearview Al'.","OpenAI":"OpenAI OpCo, LLC and OpenAI, L.L.C. (US).","X (Twitter)":"Twitter International (Ireland) and its national companies.","Airbnb":"Airbnb Ireland UC (EU headquarters).","Glovo":"Foodinho is Glovo's Italian company.","Klarna":"Klarna Bank AB (Sweden).","Vinted":"Vinted UAB (Lithuania).","Experian":"National Experian companies.","Equifax":"National Equifax companies.","CaixaBank":"CaixaBank and its consumer finance company.","BBVA":"Banco Bilbao Vizcaya Argentaria and its branches.","Santander":"Santander group banks in several countries.","Intesa Sanpaolo":"Intesa Sanpaolo and its insurance company.","UniCredit":"UniCredit and its banks in other countries.","ING":"ING Bank N.V. and its branches.","Iberdrola":"Iberdrola and Iberdrola Clientes.","Free (Iliad)":"Free and Free Mobile (Iliad group); other companies called 'Free ...' are not included.","Vodafone":"Same brand, but ownership differs: Vodafone Spain was sold to Zegona (2024) and Vodafone Italy to Swisscom (2025).","Orange":"Same brand; check Orange Bank (sold in 2024) and the year of each decision.","Telefonica":"Telefonica companies; check each one.","Enel":"Enel sold its Romanian companies in 2023; check the year of each decision.","Digi":"Digi sold its Hungarian company in 2022; check the year of each decision.","Raiffeisen":"Raiffeisen Bank International and the Austrian Raiffeisen banks are separate groups.","Carrefour":"Some Carrefour finance companies are joint ventures with banks."}},"rows":[["2026/SE/005","IMY (Sweden) - IMY-2025-21177","gdprhub","Sweden","SE","IMY (Sweden)","2026-09-22","day",null,"1800000.0","SEK","Miljödata i Karlskrona Aktiebolag",null,"Art. 32(1)","Data security",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2026/beslut-efter-tillsyn-enligt-dataskyddsforordningen--miljodata-i-karlskrona-aktiebolag.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2025-21177",null,"gdprhub",null,null,"SE: miljodata i karlskrona aktiebolag",null,1800000.0,160053,"day 2026-09-22|11.2463|SEK",null,null,null,null,null],["2026/IE/005","ETid-3281","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2026-09-21","day",403000000,null,"EUR","Google Ireland Limited","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location","https://www.enforcementtracker.com/ETid-3281",null,null,null,null,"google ireland ltd","Google (Alphabet)",null,null,null,null,null,null,null,null],["2026/CY/001","Commissioner (Cyprus) - Online Platform “Agora”","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2026-09-17","day",6000,"6,000","EUR",null,null,"Art. 31, Art. 35, Art. 36, Art. 58(2)(i), Art. 83(4)(a)","DPIA",null,"Violation found","https://www.gov.cy/media/sites/67/2026/09/AGORA-17-09-2026.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_Online_Platform_%E2%80%9CAgora%E2%80%9D",null,"gdprhub",null,"Member of Parliament",null,null,null,null,null,"person",null,null,null,null],["2026/IS/005","Persónuvernd (Iceland) - 2025020567","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2026-09-17","day",null,null,null,"NPA MIÐSTÖÐIN",null,"Art. 5(1)(a), Art. 6(1)(c), Art. 9","Data principles, Special categories, Unlawful processing",null,null,"https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/alit-a-fyrirhugadri-oflun-reykjavikurborgar-a-fjarhagsupplysingum-notenda-npa-17-9-2026","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2025020567",null,"gdprhub",null,null,"IS: npa mistoin",null,null,null,null,null,null,null,null,null],["2026/AT/012","DSB (Austria) - 2026-0.690.562","gdprhub","Austria","AT","DSB (Austria)","2026-09-16","day",null,null,null,null,null,"Art. 10, Art. 5(1)(c), Art. 58(2)(b), Art. 83(5)(a), Art. 85","Data principles, Special categories",null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260916_2026_0_690_562_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2026-0.690.562",null,"gdprhub",null,"Journalist",null,null,null,null,null,"person",null,null,null,null],["2026/GR/021","HDPA (Greece) - 17/2026","gdprhub","Greece","GR","HDPA (Greece)","2026-09-15","day",null,null,null,"Υπουργείου Υποδομών και Μεταφορών",null,"Art. 14, Art. 5(1)","Data principles, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2026-09/17_2026%20anonym_0.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_17/2026",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/ES/037","AEPD (Spain) - ps-00028-2025","gdprhub","Spain","ES","AEPD (Spain)","2026-09-10","day",408000,"408000.0","EUR","CAIXABANK, S.A.",null,"Art. 13, Art. 25, Art. 30","Accountability, Transparency",null,"Violation found","https://www.aepd.es/documento/ps-00028-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_ps-00028-2025",null,"gdprhub",null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2026/RO/033","ANSPDCP (Romania) - Fine against Dormeo Home S.R.L","gdprhub","Romania","RO","ANSPDCP (Romania)","2026-09-08","day",null,"10517.0","RON","Dormeo Home SRL",null,"Art. 21","Data subject rights",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_08_09_2026&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Dormeo_Home_S.R.L",null,"gdprhub",null,null,"dormeo home srl",null,10517.0,2003,"day 2026-09-08|5.2500|RON",null,null,null,null,null],["2026/FI/009","Tietosuojavaltuutetun toimisto (Finland) - TSV/40/2018","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-09-04","day",null,null,null,"Espoon kaupunki",null,"Art. 6(1)(c)","Unlawful processing",null,null,"https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/27","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/40/2018",null,"gdprhub",null,null,"FI: espoon kaupunki",null,null,null,null,null,null,null,null,null],["2026/IT/106","ETid-3267","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-09-03","day",5508000,null,"EUR","Banco Bilbao Vizcaya Argentaria S.A.","Finance, Insurance and Consulting","Art. 12, Art. 21, Art. 24, Art. 5(1)(a)","Accountability, Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10291895","https://www.enforcementtracker.com/ETid-3267",null,"cms_tracker",null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2026/IT/107","ETid-3268","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-09-03","day",24000,null,"EUR","Friuli Centrale University Health Authority","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10293994","https://www.enforcementtracker.com/ETid-3268",null,"cms_tracker",null,null,"IT: friuli centrale university health authority",null,null,null,null,null,null,null,null,null],["2026/IT/108","ETid-3269","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-09-03","day",8000,null,"EUR","Azienda Speciale per la Gestione degli Impianti Sportivi del Comune di Trento","Public Sector and Education","Art. 12, Art. 13","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10294255","https://www.enforcementtracker.com/ETid-3269",null,"cms_tracker",null,null,"IT: azienda speciale per la gestione degli impianti sportivi del comune di trento",null,null,null,null,null,null,null,null,null],["2026/PL/027","UODO (Poland) - DKE.561.7.2026","gdprhub","Poland","PL","UODO (Poland)","2026-09-01","day",null,null,null,null,null,"Art. 58",null,null,null,"https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content?query=","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.7.2026",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2026/RO/032","ANSPDCP (Romania) - Fine against GEROCOSSEN S.R.L.","gdprhub","Romania","RO","ANSPDCP (Romania)","2026-08-28","day",null,"26236.50","RON","GEROCOSSEN S.R.L.",null,"Art. 32(1)(b), Art. 32(2)","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_28.08.2026&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_GEROCOSSEN_S.R.L.",null,"gdprhub",null,null,"gerocossen srl",null,26236.5,4989,"day 2026-08-28|5.2584|RON",null,null,null,null,null],["2026/RO/029","ETid-3291","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-08-28","day",5000,null,"EUR","GEROCOSSEN S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_28.08.2026","https://www.enforcementtracker.com/ETid-3291",null,null,null,null,"gerocossen srl",null,null,null,null,null,null,null,null,null],["2026/NL/012","ETid-3232","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-08-21","day",824990000,null,"EUR","Uber Technologies Inc.","Transportation and Energy","Art. 13, Art. 14, Art. 22","Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.autoriteitpersoonsgegevens.nl/actueel/uber-krijgt-boete-van-bijna-825-miljoen-euro-voor-geautomatiseerd-blokkeren-van-chauffeurs","https://www.enforcementtracker.com/ETid-3232","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Uber_B.V_%26_Uber_Technologies_Inc.","gdprhub",null,null,"uber technologies inc","Uber",null,null,null,null,null,null,null,null],["2026/RO/031","ANSPDCP (Romania) - Fine against Poliserv JG (PJG) SRL","gdprhub","Romania","RO","ANSPDCP (Romania)","2026-08-19","day",null,"15728.0","RON","Poliserv JG (PJG) SRL",null,"Art. 32(1)(b), Art. 32(2)","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_19_08_2026&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Poliserv_JG_%28PJG%29_SRL",null,"gdprhub",null,null,"poliserv jg srl",null,15728.0,2998,"day 2026-08-19|5.2464|RON",null,null,null,null,null],["2026/RO/028","ETid-3290","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-08-19","day",3000,null,"EUR","Poliserv JG (PJG) SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_19_08_2026","https://www.enforcementtracker.com/ETid-3290",null,null,null,null,"poliserv jg srl",null,null,null,null,null,null,null,null,null],["2026/NO/005","Datatilsynet (Norway) - 23/00435-62","gdprhub","Norway","NO","Datatilsynet (Norway)","2026-08-12","day",null,"205000.0","NOK","Lab Pharma AS",null,"Art. 17, Art. 21, Art. 31, Art. 6(1)(b), Art. 6(1)(f)","Data subject rights, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/8c9c5cceb6d14481ad668d222035cf83/2026-08-12-vedtak---lab-pharma-offentlig.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_23/00435-62",null,"gdprhub",null,null,"lab pharma as",null,205000.0,18745,"day 2026-08-12|10.9360|NOK",null,null,null,null,null],["2026/GB/009","ICO (UK) - ACRO Criminal Records Office","gdprhub","United Kingdom","GB","ICO (UK)","2026-08-07","day",null,null,null,"ACRO Criminal Records Office",null,null,null,null,"Violation found","https://ico.org.uk/media2/njrjayzm/acro-reprimand-202608.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_ACRO_Criminal_Records_Office",null,"gdprhub",null,null,"GB: acro criminal records office",null,null,null,null,null,null,null,null,null],["2026/FI/008","Tietosuojavaltuutetun toimisto (Finland) - TSV/1319/2025","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-08-07","day",null,null,null,null,null,"Art. 25(1), Art. 5(1)(c), Art. 5(1)(e)","Accountability, Data principles",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/26","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/1319/2025",null,"gdprhub",null,"Real estate agency",null,null,null,null,null,null,null,null,null,null],["2026/RO/027","ETid-3225","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-08-06","day",45000,null,"EUR","AMATO BESTSELLER S.R.L","Industry and Commerce","Art. 14, Art. 32(4), Art. 5(1)(c), Art. 9","Data principles, Data security, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_06.08.2026","https://www.enforcementtracker.com/ETid-3225",null,null,null,null,"amato bestseller srl",null,null,null,null,null,null,null,null,null],["2026/IT/144","ETid-3292","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-08-06","day",1000,null,"EUR","Leontinoi Società Cooperativa Sociale","Individuals and Private Associations","Art. 15, Art. 31","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10297109","https://www.enforcementtracker.com/ETid-3292",null,null,null,null,"IT: leontinoi societa cooperativa sociale",null,null,null,null,null,null,null,null,null],["2026/FI/007","Tietosuojavaltuutetun toimisto (Finland) - TSV/179/2021","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-08-04","day",null,null,null,"Suomen urheilun eettinen keskus SUEK ry",null,"Art. 2(2)(a), Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)(a), Art. 6(1)(b), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/23","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/179/2021",null,"gdprhub",null,null,"FI: suomen urheilun eettinen keskus suek ry",null,null,null,null,null,null,null,null,null],["2026/FI/010","Tietosuojavaltuutetun toimisto (Finland) - TSV/5059/2023","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-08-04","day",null,null,null,null,null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/20","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/5059/2023",null,"gdprhub",null,"Pension insurance company",null,null,null,null,null,null,null,null,null,null],["2026/RO/030","ANSPDCP (Romania) - Fine against Homelux SRL","gdprhub","Romania","RO","ANSPDCP (Romania)","2026-07-31","day",null,"108570.0","RON","HOMELUX S.R.L.",null,"Art. 32(1)(d), Art. 32(2)","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_31.07.2026&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Homelux_SRL",null,"gdprhub",null,null,"homelux srl",null,108570.0,20693,"day 2026-07-31|5.2467|RON",null,null,null,null,null],["2026/RO/026","ETid-3224","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-07-31","day",15000,null,"EUR","HOMELUX S.R.L","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_31.07.2026","https://www.enforcementtracker.com/ETid-3224",null,null,null,null,"homelux srl",null,null,null,null,null,null,null,null,null],["2026/GR/013","HDPA (Greece) - 15/2026","gdprhub","Greece","GR","HDPA (Greece)","2026-07-28","day",null,"200,000 + 150,000","EUR","Υπουργείο Κοινωνικής Συνοχής και Οικογένειας",null,"Art. 28(3), Art. 32, Art. 5(1)(f)","Data principles, Data security, Processor obligations",null,null,"https://www.dpa.gr/sites/default/files/2026-09/15_2026%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_15/2026",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/IT/101","ETid-3262","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-23","day",8000,null,"EUR","Municipality of Terralba","Public Sector and Education","Art. 24, Art. 25, Art. 6, Art. 88","Accountability, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10287511","https://www.enforcementtracker.com/ETid-3262",null,"cms_tracker",null,null,"IT: municipality of terralba",null,null,null,null,null,null,null,null,null],["2026/IT/102","ETid-3263","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-23","day",2000,null,"EUR","Ancel Keys Comprehensive School Castelnuovo Cilento","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10287044","https://www.enforcementtracker.com/ETid-3263",null,"cms_tracker",null,null,"IT: ancel keys comprehensive school castelnuovo cilento",null,null,null,null,null,null,null,null,null],["2026/IT/109","ETid-3270","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-23","day",30000,null,"EUR","Emiglia-Romagna Regional Employment Agency","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10287084","https://www.enforcementtracker.com/ETid-3270",null,"cms_tracker",null,null,"IT: emiglia romagna regional employment agency",null,null,null,null,null,null,null,null,null],["2026/IT/140","ETid-3271","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-23","day",9516000,null,"EUR","TIM S.p.A.","Media, Telecoms and Broadcasting","Art. 15, Art. 22, Art. 24, Art. 25, Art. 28, Art. 32, Art. 5, Art. 6","Accountability, Data principles, Data security, Data subject rights, Processor obligations, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10277005","https://www.enforcementtracker.com/ETid-3271","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_556/2026","gdprhub",null,null,"tim spa",null,null,null,null,null,null,null,null,null],["2026/IT/141","ETid-3272","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-23","day",6500,null,"EUR","Top Secrert Investigazioni e sicurezza s.r.l.",null,"Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10287400","https://www.enforcementtracker.com/ETid-3272",null,null,null,null,"top secrert investigazioni e sicurezza srl",null,null,null,null,null,null,null,null,null],["2026/IT/142","ETid-3273","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-23","day",10000,null,"EUR","Bologna University Hospital IRCCS","Health Care","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10287326","https://www.enforcementtracker.com/ETid-3273",null,null,null,null,"IT: bologna university hospital irccs",null,null,null,null,null,null,null,null,null],["2026/IT/143","ETid-3274","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-23","day",10000,null,"EUR","Monza and Brianza Local Education Authority","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10287373","https://www.enforcementtracker.com/ETid-3274",null,null,null,null,"IT: monza and brianza local education authority",null,null,null,null,null,null,null,null,null],["2026/IT/139","Garante per la protezione dei dati personali (Italy) - 577/2026","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-07-23","day",null,null,null,"RTI S.p.a.",null,"Art. 25, Art. 5(1)(a)","Accountability, Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10281021","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_577/2026",null,"gdprhub",null,null,"rti spa",null,null,null,null,null,null,null,null,null],["2026/HU/011","NAIH (Hungary) - NAIH-11443-3/2026","gdprhub","Hungary","HU","NAIH (Hungary)","2026-07-22","day",null,"2,000,000","HUF",null,null,"Art. 12(1), Art. 13(1)(c), Art. 13(1)(d), Art. 13(1)(f), Art. 13(2)(a)","Transparency",null,"Violation found","https://naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-11443-3/2026",null,"gdprhub",null,"Online store",null,null,2000000.0,5496,"day 2026-07-22|363.9000|HUF",null,null,null,null,null],["2026/FI/006","Tietosuojavaltuutetun toimisto (Finland) - TSV/4630/2023","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-07-22","day",null,null,null,null,null,"Art. 12(2), Art. 12(6), Art. 25(2), Art. 5(1)(c)","Accountability, Data principles, Transparency",null,"Rejected","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2023/2205","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/4630/2023",null,"gdprhub",null,"Comparison platform",null,null,null,null,null,null,null,null,null,null],["2026/FR/012","CNIL (France) - SAN-2026-010","gdprhub","France","FR","CNIL (France)","2026-07-21","day",300000,"300000.0","EUR","EXIA",null,"Art. 12, Art. 17","Data subject rights, Transparency",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054810440?fonds=CNIL&page=1&pageSize=10&query=2016%2F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2026-010",null,"gdprhub",null,null,"FR: exia",null,null,null,null,null,null,null,null,null],["2026/FR/005","ETid-3233","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2026-07-21","day",500000,null,"EUR","Hôpital privé de la Loire","Health Care","Art. 32, Art. 34","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnil.fr/en/sanction-fine-hopital-prive-loire","https://www.enforcementtracker.com/ETid-3233","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2026-009","gdprhub",null,null,"FR: hopital prive de la loire",null,null,null,null,null,null,null,null,null],["2026/ES/039","APDCAT (Catalonia) - PS-0036/2026","gdprhub","Spain","ES","APDCAT (Catalonia)","2026-07-17","day",null,null,null,"Ajuntament de Madremanya",null,"Art. 31, Art. 5(1)(c), Art. 5(1)(f)","Data principles",null,"Violation found","https://seu.apdcat.cat/ca/documentPublic/download/8342","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_PS-0036/2026",null,"gdprhub",null,null,"ES: ajuntament de madremanya",null,null,null,null,null,null,null,null,null],["2026/RO/025","ETid-3223","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-07-17","day",100000,null,"EUR","Orange Romania SA","Media, Telecoms and Broadcasting","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_17.07.2026","https://www.enforcementtracker.com/ETid-3223",null,null,null,null,"orange romania sa","Orange",null,null,null,null,null,null,null,null],["2026/IT/103","ETid-3264","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-14","day",120000,null,"EUR","NIER Ingegneria S.p.A. SB","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10292124","https://www.enforcementtracker.com/ETid-3264",null,"cms_tracker",null,null,"nier ingegneria spa sb",null,null,null,null,null,null,null,null,null],["2026/IT/104","ETid-3265","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-14","day",6000,null,"EUR","Municipality of Rieti","Public Sector and Education","Art. 12(1), Art. 24, Art. 25, Art. 32, Art. 34","Accountability, Data breach, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10286417","https://www.enforcementtracker.com/ETid-3265","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10286417","cms_tracker",null,null,"IT: municipality of rieti",null,null,null,null,null,null,null,null,null],["2026/IT/105","ETid-3266","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-14","day",700,null,"EUR","La Terrazza","Accommodation and Hospitality","Art. 13, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10292148","https://www.enforcementtracker.com/ETid-3266",null,"cms_tracker",null,null,"IT: la terrazza",null,null,null,null,null,null,null,null,null],["2026/IT/134","Garante per la protezione dei dati personali (Italy) - 542/2026","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-07-14","day",2000000,"2000000.0","EUR","Lusha Systems Inc.",null,"Art. 12, Art. 25, Art. 3(2)(a), Art. 3(2)(b), Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)(f)","Accountability, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10275035","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_542/2026",null,"gdprhub",null,null,"lusha systems inc",null,null,null,null,null,null,null,null,null],["2026/IT/089","ETid-3250","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",120000,null,"EUR","Experian Italia S.p.A.","Finance, Insurance and Consulting","Art. 12, Art. 15, Art. 25","Accountability, Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10273659","https://www.enforcementtracker.com/ETid-3250",null,"cms_tracker",null,null,"experian italia spa","Experian",null,null,null,null,null,null,null,null],["2026/IT/090","ETid-3251","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",10000,null,"EUR","Giuliano Isontina University Health Authority","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10272963","https://www.enforcementtracker.com/ETid-3251",null,"cms_tracker",null,null,"IT: giuliano isontina university health authority",null,null,null,null,null,null,null,null,null],["2026/IT/091","ETid-3252","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",15000,null,"EUR","University of Pisa","Public Sector and Education","Art. 25, Art. 32, Art. 5(1)(a)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10272950","https://www.enforcementtracker.com/ETid-3252",null,"cms_tracker",null,null,"IT: university of pisa",null,null,null,null,null,null,null,null,null],["2026/IT/094","ETid-3255","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",5800000,null,"EUR","Hera Comm S.p.A.","Transportation and Energy","Art. 12, Art. 13, Art. 14, Art. 15, Art. 28","Data principles, Data subject rights, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10273926","https://www.enforcementtracker.com/ETid-3255","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_483/2026","cms_tracker",null,null,"hera comm spa",null,null,null,null,null,null,null,null,null],["2026/IT/095","ETid-3256","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",1400000,null,"EUR","EstEnergy S.p.A.","Transportation and Energy","Art. 12, Art. 13, Art. 14, Art. 15, Art. 28","Data principles, Data subject rights, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10273954","https://www.enforcementtracker.com/ETid-3256","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_484/2026","cms_tracker",null,null,"estenergy spa",null,null,null,null,null,null,null,null,null],["2026/IT/096","ETid-3257","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",400000,null,"EUR","Cerved Group S.p.A.","Finance, Insurance and Consulting","Art. 12, Art. 15, Art. 5(1)(a)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10273976","https://www.enforcementtracker.com/ETid-3257","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_485/2026","cms_tracker",null,null,"cerved group spa",null,null,null,null,null,null,null,null,null],["2026/IT/097","ETid-3258","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",23750,null,"EUR","Società Editoriale Il Fatto S.p.A.","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10273039","https://www.enforcementtracker.com/ETid-3258",null,"cms_tracker",null,null,"societa editoriale il fatto spa",null,null,null,null,null,null,null,null,null],["2026/IT/098","ETid-3259","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",158000,null,"EUR","Character Technologies Inc.","Media, Telecoms and Broadcasting","Art. 12(1), Art. 24(1), Art. 25(2), Art. 27(1), Art. 35(1), Art. 5(2)","Accountability, DPIA, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10269571","https://www.enforcementtracker.com/ETid-3259","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_487/2026","cms_tracker",null,null,"character technologies inc",null,null,null,null,null,null,null,null,null],["2026/IT/099","ETid-3260","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",2000,null,"EUR","Municipality of San Genesio and Uniti","Public Sector and Education","Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10280770","https://www.enforcementtracker.com/ETid-3260",null,"cms_tracker",null,null,"IT: municipality of san genesio and uniti",null,null,null,null,null,null,null,null,null],["2026/IT/100","ETid-3261","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-07-03","day",2000,null,"EUR","Municipality of Villaputzu","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10280790","https://www.enforcementtracker.com/ETid-3261",null,"cms_tracker",null,null,"IT: municipality of villaputzu",null,null,null,null,null,null,null,null,null],["2026/SE/004","IMY (Sweden) - IMY-2024-2904","gdprhub","Sweden","SE","IMY (Sweden)","2026-07-03","day",null,null,null,"Polismyndigheten",null,"Art. 13","Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2026/beslut-tillsyn-polismyndigheten.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2024-2904",null,"gdprhub",null,null,"SE: polismyndigheten",null,null,null,null,null,null,null,null,null],["2026/RO/024","ETid-3210","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-07-02","day",5000,null,"EUR","Banca Transilvania S.A.","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_02_07_2026","https://www.enforcementtracker.com/ETid-3210",null,null,null,null,"banca transilvania sa",null,null,null,null,null,null,null,null,null],["2026/RO/023","ETid-3209","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-07-01","day",11000,null,"EUR","Ascendex Technology SRL","Finance, Insurance and Consulting","Art. 17(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_01_07_2026","https://www.enforcementtracker.com/ETid-3209",null,null,null,null,"ascendex technology srl",null,null,null,null,null,null,null,null,null],["2026/IS/003","Persónuvernd (Island) - 2025010358","gdprhub","Iceland","IS","Persónuvernd (Island)","2026-07-01","day",null,null,null,null,null,"Art. 32(1), Art. 5(1)(f), Art. 5(2)","Data principles, Data security",null,"Rejected","https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/a-etlud-netvoktun-starfsmanns-af-halfu-bl-ehf-1-7-2026","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2025010358",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2026/IS/004","Persónuvernd (Iceland) - 2025010364","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2026-06-24","day",null,null,null,"Borgarholtsskóli",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(d), Art. 6(1)","Data principles, Unlawful processing",null,null,"https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/vinnsla-borgarholtsskola-a-personuupplysingum-i-tengslum-vid-abendingarhnapp-a-vefsidu-skolans-24-6-2026","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2025010364",null,"gdprhub",null,null,"IS: borgarholtsskoli",null,null,null,null,null,null,null,null,null],["2026/EE/003","AKI (Estonia) - 2.1.-4/26/1106-2333-4","gdprhub","Estonia","EE","AKI (Estonia)","2026-06-19","day",null,null,null,null,null,"Art. 24, Art. 25, Art. 5(2), Art. 6(1)(f), Art. 9","Accountability, Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2026-09/Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-4/26/1106-2333-4",null,"gdprhub",null,"Private website operator",null,null,null,null,null,"person",null,null,null,null],["2026/LT/002","ETid-3212","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2026-06-19","day",450000,null,"EUR","InMedica UAB","Health Care","Art. 24(1), Art. 32(1)(b), Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://vdai.lrv.lt/public/canonical/1782465015/1462/2026-06-19%20sprendimas%20Nr.%203R-1143%20%282.13-1.E%29.pdf","https://www.enforcementtracker.com/ETid-3212","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-1143","gdprhub",null,null,"inmedica uab",null,null,null,null,null,null,null,null,null],["2026/RO/022","ETid-3208","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-06-18","day",10000,null,"EUR","Altex Romania S.R.L","Industry and Commerce","Art. 33(1), Art. 34(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_18_06_2026","https://www.enforcementtracker.com/ETid-3208",null,null,null,null,"altex romania srl",null,null,null,null,null,null,null,null,null],["2026/IT/086","ETid-3247","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-18","day",6600,null,"EUR","Cosmint S.p.A.","Employment","Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10268633","https://www.enforcementtracker.com/ETid-3247","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_462/2026","cms_tracker",null,null,"cosmint spa",null,null,null,null,null,null,null,null,null],["2026/IT/087","ETid-3248","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-18","day",20000,null,"EUR","Enna Provincial Health Authority","Health Care","Art. 10, Art. 12, Art. 5, Art. 6","Data principles, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10268727","https://www.enforcementtracker.com/ETid-3248","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_471/2026","cms_tracker",null,null,"IT: enna provincial health authority",null,null,null,null,null,null,null,null,null],["2026/IT/088","ETid-3249","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-18","day",2075,null,"EUR","Edizioni Grandangolo di Giuseppe Castaldo","Individuals and Private Associations","Art. 13, Art. 24, Art. 25, Art. 32, Art. 33","Accountability, Data breach, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10268672","https://www.enforcementtracker.com/ETid-3249",null,"cms_tracker",null,null,"IT: edizioni grandangolo di giuseppe castaldo",null,null,null,null,null,null,null,null,null],["2026/IT/092","ETid-3253","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-18","day",10000,null,"EUR","Docplanner Italy S.r.l.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10280177","https://www.enforcementtracker.com/ETid-3253",null,"cms_tracker",null,null,"docplanner italy srl",null,null,null,null,null,null,null,null,null],["2026/IT/093","ETid-3254","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-18","day",90000,null,"EUR","Acquirente Unico S.p.A.","Public Sector and Education","Art. 12, Art. 16, Art. 28","Data subject rights, Processor obligations, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10281706","https://www.enforcementtracker.com/ETid-3254",null,"cms_tracker",null,null,"acquirente unico spa",null,null,null,null,null,null,null,null,null],["2026/IT/135","Garante per la protezione dei dati personali (Italy) - 476/2026","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-06-18","day",460000,"460000.0","EUR","Piaggio",null,"Art. 12(3), Art. 17, Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(e), Art. 6, Art. 88","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10272529","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_476/2026",null,"gdprhub",null,null,"IT: piaggio",null,null,null,null,null,null,null,null,null],["2026/ES/032","ETid-3204","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-06-16","day",3000,null,"EUR","SILVANERGIA 2022, S.L.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00201-2025.pdf","https://www.enforcementtracker.com/ETid-3204",null,null,null,null,"silvanergia 2022 sl",null,null,null,null,null,null,null,null,null],["2026/RO/021","ETid-3207","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-06-16","day",1000,null,"EUR","Dormeo Home SRL","Industry and Commerce","Art. 21(3), Art. 6","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_16.06.2026","https://www.enforcementtracker.com/ETid-3207",null,null,null,null,"dormeo home srl",null,null,null,null,null,null,null,null,null],["2026/SE/003","IMY (Sweden) - 2025-10429","gdprhub","Sweden","SE","IMY (Sweden)","2026-06-16","day",null,null,null,null,null,"Art. 32(1), Art. 58(2), Art. 6(1)","Data security, Unlawful processing",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/beslut-securitas-sverige-ab.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_2025-10429",null,"gdprhub",null,"Security services company",null,null,null,null,null,null,null,null,null,null],["2026/RO/020","ETid-3196","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-06-15","day",2000,null,"EUR","SSG SELECT SOLUTIONS S.R.L","Industry and Commerce","Art. 29","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_15_06_2026","https://www.enforcementtracker.com/ETid-3196",null,null,null,null,"ssg select solutions srl",null,null,null,null,null,null,null,null,null],["2026/PL/023","ETid-3275","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-06-13","day",2760,null,"EUR","Sole trader providing accounting and tax advisory services","Finance, Insurance and Consulting","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2023:dkn_5131_34/content","https://www.enforcementtracker.com/ETid-3275","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.34.2023","gdprhub",null,null,"PL: sole trader providing accounting and tax advisory services",null,null,null,null,null,null,null,null,null],["2026/RO/019","ETid-3195","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-06-12","day",5000,null,"EUR","Națională Poșta Română","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_12.06.2026","https://www.enforcementtracker.com/ETid-3195",null,null,null,null,"RO: nationala posta romana",null,null,null,null,null,null,null,null,null],["2026/GR/004","ETid-3205","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-12","day",65000,null,"EUR","MEDE S.A.","Industry and Commerce","Art. 37","Data principles, Data protection officer","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2026-06/10_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3205",null,null,null,null,"mede sa",null,null,null,null,null,null,null,null,null],["2026/GR/005","ETid-3206","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-12","day",95000,null,"EUR","Market-In","Industry and Commerce","Art. 12(1), Art. 12(2), Art. 13, Art. 31","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2026-06/10_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3206",null,null,null,null,"GR: market in",null,null,null,null,null,null,null,null,null],["2026/GR/009","HDPA (Greece) - 10/2026","gdprhub","Greece","GR","HDPA (Greece)","2026-06-12","day",160000,"160,000","EUR",null,null,"Art. 12(1), Art. 12(2), Art. 13(1), Art. 13(3), Art. 15(1), Art. 15(3), Art. 31, Art. 37(7), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(2)","Data principles, Data protection officer, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2026-06/10_2026%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_10/2026",null,"gdprhub","MEDE S.A.; MARKET IN S.A.",null,null,null,null,null,null,null,null,null,null,null],["2026/IE/002","ETid-3200","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2026-06-11","day",300000,null,"EUR","Midlands Regional Hospital Tullamore, County Offaly","Health Care","Art. 28, Art. 30, Art. 32(1), Art. 34, Art. 5(1)(f)","Data breach, Data principles, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-final-decision-midlands-regional-hospital-tullamore-inquiry","https://www.enforcementtracker.com/ETid-3200",null,null,null,null,"IE: midlands regional hospital tullamore county offaly",null,null,null,null,null,null,null,null,null],["2026/IT/079","ETid-3240","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-11","day",1000,null,"EUR","Pietro d'Abano State Vocational School","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10266168","https://www.enforcementtracker.com/ETid-3240",null,null,null,null,"IT: pietro d abano state vocational school",null,null,null,null,null,null,null,null,null],["2026/IT/083","ETid-3244","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-11","day",15300,null,"EUR","Green Partner S.r.l.s.",null,"Art. 12, Art. 15, Art. 28, Art. 5, Art. 6, Art. 7","Consent, Data principles, Data subject rights, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10266250","https://www.enforcementtracker.com/ETid-3244",null,null,null,null,"green partner srls",null,null,null,null,null,null,null,null,null],["2026/IT/085","ETid-3246","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-11","day",4500,null,"EUR","Lecce Local Health Authority","Health Care","Art. 29, Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10266338","https://www.enforcementtracker.com/ETid-3246",null,"cms_tracker",null,null,"IT: lecce local health authority",null,null,null,null,null,null,null,null,null],["2026/PL/019","UODO (Poland) - DKN.5131.12.2022","gdprhub","Poland","PL","UODO (Poland)","2026-06-11","day",null,null,null,null,null,"Art. 24(1), Art. 25(1), Art. 28(1), Art. 32(1), Art. 35(1), Art. 5(1)(f), Art. 5(2)","Accountability, DPIA, Data principles, Data security, Processor obligations",null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2022:dkn_5131_12/content?query=","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.12.2022",null,"gdprhub",null,"Hospital",null,null,null,null,null,null,null,null,null,null],["2026/IE/004","DPC (Ireland) - IN-19-9-4","gdprhub","Ireland","IE","DPC (Ireland)","2026-06-10","day",null,null,null,"Health Service Executive (HSE)",null,"Art. 28, Art. 30, Art. 32(1), Art. 34, Art. 5(1)(f)","Data breach, Data principles, Data security, Processor obligations",null,null,"https://www.dataprotection.ie/sites/default/files/uploads/2026-08/05.08.2026%20IN-19-9-4%20FD%20redacted.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-19-9-4",null,"gdprhub",null,null,"IE: health service executive",null,null,null,null,null,null,null,null,null],["2026/BE/030","APD/GBA (Belgium) - DOS-2025-04652","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-06-08","day",null,null,null,null,null,"Art. 10, Art. 17(3)(a)","Data subject rights, Special categories",null,null,"https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-217-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_DOS-2025-04652",null,"gdprhub",null,"Search engine",null,null,null,null,null,null,null,null,null,null],["2026/IT/084","ETid-3245","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-06-08","day",5000,null,"EUR","Municipality of Vasto","Public Sector and Education","Art. 13, Art. 35","DPIA, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10267254","https://www.enforcementtracker.com/ETid-3245","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_457/2026","gdprhub",null,null,"IT: municipality of vasto",null,null,null,null,null,null,null,null,null],["2026/LT/001","ETid-3199","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2026-06-05","day",1153,null,"EUR",null,"Health Care","Art. 5(1)(a), Art. 6(1), Art. 9(2)","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://vdai.lrv.lt/public/canonical/1780997432/1430/2026-06-05%20sprendimas%20Nr.%203R-1040%20(2.13-1.E).pdf","https://www.enforcementtracker.com/ETid-3199","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-1040","gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2026/GR/014","ETid-3279","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-05","day",100000,null,"EUR","Thessaloniki-Thessalia Gas Supply Company S.A.","Transportation and Energy","Art. 15(1), Art. 28(1), Art. 5(1)(d)","Data principles, Data subject rights, Processor obligations","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2026-07/8_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3279",null,null,null,"ZeniΘ","thessaloniki thessalia gas supply company sa",null,null,null,null,null,null,null,null,null],["2026/GR/015","ETid-3280","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-05","day",10000,null,"EUR","Piraeus Bank S.A.","Finance, Insurance and Consulting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2026-07/8_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3280",null,null,null,null,"GR: piraeus bank",null,null,null,null,null,null,null,null,null],["2026/GR/010","HDPA (Greece) - 8/2026","gdprhub","Greece","GR","HDPA (Greece)","2026-06-05","day",110000,"110,000","EUR",null,null,"Art. 12(1), Art. 12(3), Art. 15(1), Art. 28(1), Art. 5(1)(d)","Data principles, Data subject rights, Processor obligations, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2026-07/8_2026%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_8/2026",null,"gdprhub","ZENITH SA (ΖΕΝΙΘ ΑΕ); PIRAEUS BANK (ΤΡΑΠΕΖΑ ΠΕΙΡΑΙΩΣ)",null,null,null,null,null,null,null,null,null,null,null],["2026/PL/009","ETid-3188","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-06-02","day",23540,null,"EUR","Minister of Justice","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/4410","https://www.enforcementtracker.com/ETid-3188",null,null,null,null,"PL: minister of justice",null,null,null,null,null,null,null,null,null],["2026/GR/016","ETid-3282","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-02","day",320000,null,"EUR","Public Power Corporation S.A. (DEI)","Transportation and Energy","Art. 32","Data security, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2026-07/7_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3282",null,null,null,null,"public power corp sa",null,null,null,null,null,null,null,null,null],["2026/GR/017","ETid-3283","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-02","day",45000,null,"EUR","MEDIATEL Telephone Information Services S.A.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2026-07/7_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3283",null,null,null,null,"mediatel telephone information services sa",null,null,null,null,null,null,null,null,null],["2026/GR/018","ETid-3284","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-02","day",90000,null,"EUR","Ypiresia 800 Teleperformance Single Member S.A.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2026-07/7_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3284",null,null,null,null,"ypiresia 800 teleperformance single member sa",null,null,null,null,null,null,null,null,null],["2026/GR/019","ETid-3285","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-02","day",80000,null,"EUR","PRELUDE GROUP E.E.","Industry and Commerce","Art. 28, Art. 29, Art. 32","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2026-07/7_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3285",null,null,null,null,"GR: prelude group ee",null,null,null,null,null,null,null,null,null],["2026/GR/020","ETid-3286","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-06-02","day",20000,null,"EUR","CQS S.A. Customer-Centric Services","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2026-07/7_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3286",null,null,null,null,"cqs sa customer centric services",null,null,null,null,null,null,null,null,null],["2026/GR/012","HDPA (Greece) - 7/2026","gdprhub","Greece","GR","HDPA (Greece)","2026-06-02","day",880000,"880000.0","EUR","DEI S.A.",null,"Art. 28, Art. 29, Art. 32, Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(d), Art. 5(1)(e)","Data principles, Data security, Processor obligations",null,"Violation found","https://www.dpa.gr/sites/default/files/2026-07/7_2026%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_7/2026",null,"gdprhub",null,null,"dei sa",null,null,null,null,null,null,null,null,null],["2026/NO/002","ETid-3193","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2026-06-01","day",1820000,null,"EUR","Elkjøp AS","Industry and Commerce","Art. 12(3)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/c8d0551d2a64403285e006f76170b8b6/elkjop---vedtak-om-overtredelsesgebyr---kundeklubb-og-de-registrertes-rettigheter.pdf","https://www.enforcementtracker.com/ETid-3193","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_22/00049-13","gdprhub",null,null,"elkjp as",null,null,null,null,null,null,null,null,null],["2026/PL/021","UODO (Poland) - DKE.561.1.2026","gdprhub","Poland","PL","UODO (Poland)","2026-06-01","day",null,null,null,null,null,"Art. 31, Art. 58(1)(a), Art. 58(1)(e)",null,null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_1/content?query=","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.1.2026",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/RO/018","ETid-3184","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-05-29","day",12000,null,"EUR","Unicredit Bank SA","Finance, Insurance and Consulting","Art. 33(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_29_05_2026","https://www.enforcementtracker.com/ETid-3184",null,null,null,null,"unicredit bank sa","UniCredit",null,null,null,null,null,null,null,null],["2026/HU/006","ETid-3194","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-05-29","day",70300,null,"EUR","Blikk Kft.","Media, Telecoms and Broadcasting","Art. 12(4), Art. 6(1)(f), Art. 9(1)","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=1499:nem-kozszereplo-szemelyes-es-kulonleges-adatainak-online-sajtotermekben-torteno-nyilvanossagra-hozatala","https://www.enforcementtracker.com/ETid-3194",null,null,null,null,"blikk kft",null,null,null,null,null,null,null,null,null],["2026/HU/009","NAIH (Hungary) - NAIH-359-10/2026","gdprhub","Hungary","HU","NAIH (Hungary)","2026-05-29","day",null,"25,000,000","HUF","Blikk Kft.",null,"Art. 12(4), Art. 17, Art. 6(1), Art. 9(1)","Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-359-10/2026",null,"gdprhub",null,null,"blikk kft",null,25000000.0,70683,"day 2026-05-29|353.6900|HUF",null,null,null,null,null],["2026/EU/001","EDPB - Binding Decision 1/2026","gdprhub","European Union","EU","EDPB","2026-05-28","day",null,null,null,"Vlaamse Radio - en Televisieomroeporganisatie",null,"Art. 4(24), Art. 57(1)(f), Art. 57(4), Art. 60(3), Art. 60(4), Art. 65(1)(a), Art. 77, Art. 80(1)",null,null,null,"https://www.edpb.europa.eu/documents/edpb-binding-decisions/binding-decision-12026-on-the-dispute-submitted-by-the-belgian-sa_en","https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_1/2026",null,"gdprhub",null,null,"EU: vlaamse radio en televisieomroeporganisatie",null,null,null,null,null,null,null,null,null],["2026/IT/073","ETid-3234","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-28","day",3930,null,"EUR","Action Fit di Milano","Accommodation and Hospitality","Art. 12, Art. 21(2), Art. 6(1)(a)","Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10262499","https://www.enforcementtracker.com/ETid-3234",null,null,null,null,"IT: action fit di milano",null,null,null,null,null,null,null,null,null],["2026/IT/074","ETid-3235","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-28","day",6000,null,"EUR","Liguria Health Protection Authority","Employment","Art. 25, Art. 35, Art. 6, Art. 88","Accountability, DPIA, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10259916","https://www.enforcementtracker.com/ETid-3235","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_382/2026","gdprhub",null,null,"IT: liguria health protection authority",null,null,null,null,null,null,null,null,null],["2026/IT/075","ETid-3236","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-28","day",1400,null,"EUR","Ristorante Carlo Menta s.r.l.","Accommodation and Hospitality","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10265423","https://www.enforcementtracker.com/ETid-3236",null,null,null,null,"ristorante carlo menta srl",null,null,null,null,null,null,null,null,null],["2026/IT/076","ETid-3237","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-28","day",700,null,"EUR","Rosetta Trastervere s.r.l.s.","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10265450","https://www.enforcementtracker.com/ETid-3237",null,null,null,null,"rosetta trastervere srls",null,null,null,null,null,null,null,null,null],["2026/IT/080","ETid-3241","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-28","day",6000,null,"EUR","Municipality of Sciacca","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10262588","https://www.enforcementtracker.com/ETid-3241",null,null,null,null,"IT: municipality of sciacca",null,null,null,null,null,null,null,null,null],["2026/IT/081","ETid-3242","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-28","day",3000,null,"EUR","Autonomous Region of Sardinia","Public Sector and Education","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10262614","https://www.enforcementtracker.com/ETid-3242",null,null,null,null,"IT: autonomous region of sardinia",null,null,null,null,null,null,null,null,null],["2026/IT/082","ETid-3243","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-28","day",700,null,"EUR","Italian Red Cross","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10262455","https://www.enforcementtracker.com/ETid-3243","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_385/2026","gdprhub",null,null,"IT: italian red cross",null,null,null,null,null,null,null,null,null],["2026/IT/125","Garante per la protezione dei dati personali (Italy) - 419/2026","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-05-28","day",55000,"55,000","EUR","AgID",null,"Art. 12, Art. 14, Art. 25, Art. 5(1)(a), Art. 5(1)(b), Art. 5(2)","Accountability, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10259701","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_419/2026",null,"gdprhub",null,null,"IT: agid",null,null,null,null,null,null,null,null,null],["2026/FR/004","ETid-3186","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2026-05-26","day",5000000,null,"EUR","IQVIA OPERATIONS FRANCE","Health Care","Art. 14, Art. 25","Accountability, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054136834","https://www.enforcementtracker.com/ETid-3186",null,null,null,null,"FR: iqvia operations france",null,null,null,null,null,null,null,null,null],["2026/HU/005","ETid-3187","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-05-26","day",140500,null,"EUR","Mediaworks Hungary Zrt.","Media, Telecoms and Broadcasting","Art. 6(1), Art. 9(1)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=1497:a-tisza-partot-erinto-adatszivargas-alapjan-keszitett-terkep-elerhetosegenek-a-mediaworks-hungary-zrt-hirportaljain-megjelent-cikkekben-valo-kozzetetele","https://www.enforcementtracker.com/ETid-3187",null,null,null,null,"mediaworks hungary zrt",null,null,null,null,null,null,null,null,null],["2026/PL/024","ETid-3276","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-05-25","day",4958,null,"EUR","District Governor of Lubartów","Public Sector and Education","Art. 25(1), Art. 28(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_5/content?query=","https://www.enforcementtracker.com/ETid-3276",null,null,null,null,"PL: district governor of lubartow",null,null,null,null,null,null,null,null,null],["2026/PL/025","ETid-3277","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-05-25","day",2951,null,"EUR","Land-surveying office","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_5/content?query=","https://www.enforcementtracker.com/ETid-3277",null,null,null,null,"PL: land surveying office",null,null,null,null,null,null,null,null,null],["2026/PL/020","UODO (Poland) - DKN.5131.5.2025","gdprhub","Poland","PL","UODO (Poland)","2026-05-25","day",null,"21000.0","PLN",null,null,"Art. 24(1), Art. 25(1), Art. 28(1), Art. 28(3), Art. 32(1), Art. 32(2)","Accountability, Data security, Processor obligations",null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_5/content?query=","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.5.2025",null,"gdprhub",null,null,null,null,21000.0,4959,"day 2026-05-25|4.2345|PLN",null,null,null,null,null],["2026/PL/026","ETid-3278","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-05-22","day",6292,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)(d), Art. 83(6)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_4/content?query=","https://www.enforcementtracker.com/ETid-3278",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2026/PL/018","UODO (Poland) - DKE.561.4.2026","gdprhub","Poland","PL","UODO (Poland)","2026-05-22","day",null,"26,711","PLN",null,null,"Art. 5(1)(a), Art. 5(2)","Data principles",null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_4/content?query","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.4.2026",null,"gdprhub",null,"Individual",null,null,26711.0,6297,"day 2026-05-22|4.2420|PLN","person",null,null,null,null],["2026/HU/002","ETid-3170","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-05-20","day",1400,null,"EUR","Elektronikus Egészségügyi Szolgáltatási Tér","Health Care","Art. 12(2), Art. 5(2), Art. 6(1), Art. 9(2)","Data principles, Data security, Special categories, Transparency, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=1450:jogalap-nelkuli-hozzaferes-az-eeszt-rendszerehez-es-hozzaferesi-kerelem-nemteljesitese","https://www.enforcementtracker.com/ETid-3170",null,null,null,null,"HU: elektronikus egeszsegugyi szolgaltatasi ter",null,null,null,null,null,null,null,null,null],["2026/GB/008","ICO (UK) - KRA Consultancy Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2026-05-20","day",null,"300.000","GBP","KRA Consultancy Ltd",null,null,null,null,"Violation found","https://ico.org.uk/media2/vkalw544/monetary-penalty-notice-kra-consultancy-ltd.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_KRA_Consultancy_Ltd",null,"gdprhub",null,null,"kra consultancy ltd",null,300000.0,346600,"day 2026-05-20|0.8656|GBP",null,null,null,null,null],["2026/PL/017","UODO (Poland) - DKN.5131.27.2023","gdprhub","Poland","PL","UODO (Poland)","2026-05-19","day",null,"33,700","PLN",null,null,"Art. 24(1), Art. 25(1), Art. 32(1), Art. 32(2), Art. 33(1), Art. 34(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data breach, Data principles, Data security",null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2023:dkn_5131_27/content?query=","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.27.2023",null,"gdprhub",null,"Municipal social welfare unit",null,null,33700.0,7942,"day 2026-05-19|4.2435|PLN",null,null,null,null,null],["2026/PL/022","UODO (Poland) - DS.523.2582.2024","gdprhub","Poland","PL","UODO (Poland)","2026-05-18","day",null,null,null,null,null,"Art. 5(1)(a), Art. 5(1)(f), Art. 6(1)(c)","Data principles, Unlawful processing",null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2024:ds_523_2582/content?query=#","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DS.523.2582.2024",null,"gdprhub",null,"Mayor",null,null,null,null,null,"person",null,null,null,null],["2026/LT/005","VDAI (Lithuania) - 3R-882","gdprhub","Lithuania","LT","VDAI (Lithuania)","2026-05-15","day",null,null,null,"UAB Whitebridge.ai",null,"Art. 12(3), Art. 15(1)","Data subject rights, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1779773126/1413/2026-05-15%20sprendimas%20Nr.%203R-882%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-882",null,"gdprhub",null,null,"uab whitebridge ai",null,null,null,null,null,null,null,null,null],["2026/IT/062","ETid-3217","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",1000,null,"EUR","Danta di Cadore Hunting Reserve","Public Sector and Education","Art. 13, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10269222","https://www.enforcementtracker.com/ETid-3217",null,null,null,null,"IT: danta di cadore hunting reserve",null,null,null,null,null,null,null,null,null],["2026/IT/063","ETid-3218","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",1500,null,"EUR","Francesco Gagliardi","Industry and Commerce","Art. 14, Art. 5(1)(a)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10263918","https://www.enforcementtracker.com/ETid-3218","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_351/2026","gdprhub",null,null,"IT: francesco gagliardi",null,null,null,null,null,null,null,null,null],["2026/IT/064","ETid-3219","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",1000,null,"EUR","FeGi M&A Services s.r.l.","Finance, Insurance and Consulting","Art. 14, Art. 5(1)(a)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10262367","https://www.enforcementtracker.com/ETid-3219",null,null,null,null,"fegi m and a services srl",null,null,null,null,null,null,null,null,null],["2026/IT/065","ETid-3220","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",180000,null,"EUR","Emirates","Transportation and Energy","Art. 12, Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10259296","https://www.enforcementtracker.com/ETid-3220","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_347/2026","gdprhub",null,null,"IT: emirates",null,null,null,null,null,null,null,null,null],["2026/IT/066","ETid-3221","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",8000,null,"EUR","Municipality of Ventasso","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10259162","https://www.enforcementtracker.com/ETid-3221",null,null,null,null,"IT: municipality of ventasso",null,null,null,null,null,null,null,null,null],["2026/IT/070","ETid-3229","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",43000,null,"EUR","Lidl Italia S.r.l.","Industry and Commerce","Art. 15(1), Art. 18(1)(c), Art. 5(1)(a)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10268800","https://www.enforcementtracker.com/ETid-3229",null,null,null,null,"lidl italia srl",null,null,null,null,null,null,null,null,null],["2026/IT/071","ETid-3230","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",30000,null,"EUR","Vortika s.r.l.","Health Care","Art. 13, Art. 14, Art. 37, Art. 5(1)(a)","Data principles, Data protection officer, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10263774","https://www.enforcementtracker.com/ETid-3230",null,null,null,null,"vortika srl",null,null,null,null,null,null,null,null,null],["2026/IT/072","ETid-3231","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",100000,null,"EUR","Energia Sostenibile S.r.l.","Transportation and Energy","Art. 12, Art. 13, Art. 15, Art. 24, Art. 28, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10262507","https://www.enforcementtracker.com/ETid-3231",null,null,null,null,"energia sostenibile srl",null,null,null,null,null,null,null,null,null],["2026/IT/077","ETid-3238","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",15000,null,"EUR","Monaldi-Cotugno-CTO","Health Care","Art. 13, Art. 25, Art. 32, Art. 9","Accountability, Data principles, Data security, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10262049","https://www.enforcementtracker.com/ETid-3238",null,null,null,null,"IT: monaldi cotugno cto",null,null,null,null,null,null,null,null,null],["2026/IT/078","ETid-3239","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-05-14","day",1800,null,"EUR","Municipality of Mirabella Imbaccari","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10259523","https://www.enforcementtracker.com/ETid-3239",null,null,null,null,"IT: municipality of mirabella imbaccari",null,null,null,null,null,null,null,null,null],["2026/IT/123","Garante per la protezione dei dati personali (Italy) - 342/2026","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-05-14","day",null,null,null,"Myndoor S.r.l.",null,"Art. 24, Art. 25, Art. 5, Art. 6, Art. 88(2), Art. 9","Accountability, Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10255494#","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_342/2026",null,"gdprhub",null,null,"myndoor srl",null,null,null,null,null,null,null,null,null],["2026/GR/011","HDPA (Greece) - 12/2026","gdprhub","Greece","GR","HDPA (Greece)","2026-05-13","day",null,null,null,null,null,"Art. 23(1)(a), Art. 23(1)(c)",null,null,"Rejected","https://www.dpa.gr/sites/default/files/2023-06/4624_2019%20%CE%BC%CE%B5%20%CF%84%CF%81%CE%BF%CF%80%CE%BF%CF%80%CE%BF%CE%B9%CE%AE%CF%83%CE%B5%CE%B9%CF%82.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_12/2026",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/BE/003","ETid-3172","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2026-05-12","day",177000,null,"EUR","Technology Company","Employment","Art. 12, Art. 13, Art. 5(1)(a), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-101-2026.pdf","https://www.enforcementtracker.com/ETid-3172","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_101/2026","gdprhub",null,null,"BE: technology company",null,null,null,null,null,null,null,null,null],["2026/BE/004","ETid-3173","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2026-05-12","day",86000,null,"EUR","Société Wallonne des Eaux","Public Sector and Education","Art. 13, Art. 28(3), Art. 5(1)(a)","Data principles, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-102-2026.pdf","https://www.enforcementtracker.com/ETid-3173","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_102/2026","gdprhub",null,null,"BE: societe wallonne des eaux",null,null,null,null,null,null,null,null,null],["2026/BE/005","ETid-3174","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2026-05-12","day",120000,null,"EUR","Isabel SA","Finance, Insurance and Consulting","Art. 12(1), Art. 13, Art. 15(1), Art. 25(2)","Accountability, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-103-2026.pdf","https://www.enforcementtracker.com/ETid-3174","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_103/2026","gdprhub",null,null,"isabel sa",null,null,null,null,null,null,null,null,null],["2026/HU/015","ETid-3288","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-05-12","day",42052,null,"EUR","Operator of an online marketplace","Industry and Commerce","Art. 12(1), Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=1559:tajekoztatasi-hianyossagok-webaruhaz-adatkezelese-soran","https://www.enforcementtracker.com/ETid-3288","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-450-7-2026","gdprhub",null,null,"HU: operator of an online marketplace",null,null,null,null,null,null,null,null,null],["2026/IS/002","Persónuvernd (Island) - 2025020471","gdprhub","Iceland","IS","Persónuvernd (Island)","2026-05-12","day",null,null,null,null,null,"Art. 6(1), Art. 9(2)","Special categories, Unlawful processing",null,"Other Outcome","https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/uppflettingar-landspitala-og-serfraedilaeknis-i-sjukraskra","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2025020471",null,"gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2026/BE/025","APD/GBA (Belgium) - 100/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-05-11","day",null,null,null,null,null,"Art. 12(2), Art. 15, Art. 24(1), Art. 28(3), Art. 4(11), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(2), Art. 6(1)(a), Art. 6(1)(f)","Accountability, Data principles, Data subject rights, Processor obligations, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-100-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_100/2026",null,"gdprhub",null,"Management of an apartment complex",null,null,null,null,null,null,null,null,null,null],["2026/BE/002","ETid-3145","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2026-05-08","day",4920,null,"EUR","Law Firm","Finance, Insurance and Consulting","Art. 13, Art. 14, Art. 15, Art. 5(1)(a)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-99-2026.pdf","https://www.enforcementtracker.com/ETid-3145","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_99/2026","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/IE/001","ETid-3146","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2026-05-08","day",277500,null,"EUR","Permanent TSB","Finance, Insurance and Consulting","Art. 32(1), Art. 33(1), Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-in-pemanent-tsb-inquiry","https://www.enforcementtracker.com/ETid-3146",null,null,null,null,"IE: permanent tsb",null,null,null,null,null,null,null,null,null],["2026/LT/004","VDAI (Lithuania) - 3R-830","gdprhub","Lithuania","LT","VDAI (Lithuania)","2026-05-08","day",null,null,null,"Lietuvos draudimas",null,"Art. 14(1), Art. 14(2), Art. 14(3)(a), Art. 14(3)(b), Art. 28(3), Art. 5(1)(c)","Data principles, Processor obligations, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1778564010/1394/2026-05-08%20sprendimas%20Nr.%203R-830%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-830",null,"gdprhub",null,null,"LT: lietuvos draudimas",null,null,null,null,null,null,null,null,null],["2026/GB/003","ETid-3147","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2026-05-07","day",1112100,null,"EUR","South Staffordshire Plc","Industry and Commerce","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/xdrfahsw/south-staffordshire-plc-and-south-staffordshire-water-plc-monetary-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-3147",null,null,null,null,"south staffordshire plc",null,null,null,null,null,null,null,null,null],["2026/GB/012","ICO (UK) - South Staffordshire Plc & South Staffordshire Water Plc","gdprhub","United Kingdom","GB","ICO (UK)","2026-05-07","day",null,"963,900","GBP","South Staffordshire Plc and South Staffordshire Water Plc",null,null,null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/2026/05/south-staffordshire-plc-and-south-staffordshire-water-plc/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_South_Staffordshire_Plc_%26_South_Staffordshire_Water_Plc",null,"gdprhub",null,null,"south staffordshire plc and south staffordshire water plc",null,963900.0,1115496,"day 2026-05-07|0.8641|GBP",null,null,null,null,null],["2026/BE/029","APD/GBA (Belgium) - 97/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-05-06","day",null,null,null,null,null,"Art. 12(2), Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(3), Art. 15(4)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-97-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_97/2026",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2026/SI/007","IP (Slovenia) - 0609-42/2026/7","gdprhub","Slovenia","SI","IP (Slovenia)","2026-05-01","day",2802,"2,802","EUR",null,null,"Art. 32","Data security",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0609-42/2026/7",null,"gdprhub",null,"Online store maintenance provider",null,null,null,null,null,null,null,null,null,null],["2026/RO/017","ETid-3136","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-04-30","day",2500,null,"EUR","BLUE PROJECTS INDUSTRIES S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_30_04_2026","https://www.enforcementtracker.com/ETid-3136",null,null,null,null,"blue projects industries srl",null,null,null,null,null,null,null,null,null],["2026/PL/010","ETid-3198","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-04-30","day",1790,null,"EUR","Mayor of the City and Municipality of Myślenice","Public Sector and Education","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_17/content?query=","https://www.enforcementtracker.com/ETid-3198","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.17.2025","gdprhub",null,null,"PL: mayor of the city and municipality of myslenice",null,null,null,null,null,null,null,null,null],["2026/IE/003","ETid-3213","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2026-04-30","day",277500,null,"EUR","Permanent TSB plc","Finance, Insurance and Consulting","Art. 32(1), Art. 33(1), Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2026-07/20260430_PTSB_Final_Decision_redacted_IN-22-7-3.pdf","https://www.enforcementtracker.com/ETid-3213",null,null,null,null,"IE: permanent tsb",null,null,null,null,null,null,null,null,null],["2026/HU/014","ETid-3287","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-04-30","day",27319,null,"EUR","Operator of an online shop for alcoholic beverages","Industry and Commerce","Art. 12(1), Art. 5(1)(a), Art. 5(2)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=1558:tajekoztatasi-hianyossagok-webaruhaz-adatkezelese-soran","https://www.enforcementtracker.com/ETid-3287","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-4462-5-2026","gdprhub",null,null,"HU: operator of an online shop for alcoholic beverages",null,null,null,null,null,null,null,null,null],["2026/IT/058","ETid-3211","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-29","day",100000,null,"EUR","Lepida S.c.p.A.","Media, Telecoms and Broadcasting","Art. 13(1)(a), Art. 25, Art. 32","Accountability, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10263964","https://www.enforcementtracker.com/ETid-3211",null,null,null,null,"IT: lepida scpa",null,null,null,null,null,null,null,null,null],["2026/IT/059","ETid-3214","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-29","day",5000,null,"EUR",null,"Health Care","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10251858","https://www.enforcementtracker.com/ETid-3214",null,null,null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2026/IT/060","ETid-3215","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-29","day",4000,null,"EUR","Montelibretti State Comprehensive School","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10251650","https://www.enforcementtracker.com/ETid-3215",null,null,null,null,"IT: montelibretti state comprehensive school",null,null,null,null,null,null,null,null,null],["2026/IT/061","ETid-3216","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-29","day",12000,null,"EUR","Ministry of Justice","Public Sector and Education","Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10254256","https://www.enforcementtracker.com/ETid-3216",null,null,null,null,"IT: ministry of justice",null,null,null,null,null,null,null,null,null],["2026/IT/067","ETid-3226","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-29","day",8600,null,"EUR","Matera Local Health Authority","Health Care","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10251777","https://www.enforcementtracker.com/ETid-3226",null,null,null,null,"IT: matera local health authority",null,null,null,null,null,null,null,null,null],["2026/IT/068","ETid-3227","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-29","day",34000,null,"EUR","Pianeta S.r.l.","Industry and Commerce","Art. 12, Art. 13, Art. 14, Art. 15, Art. 17, Art. 28(3), Art. 6","Data principles, Data subject rights, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10255164","https://www.enforcementtracker.com/ETid-3227",null,null,null,null,"pianeta srl",null,null,null,null,null,null,null,null,null],["2026/IT/069","ETid-3228","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-29","day",15000,null,"EUR","Nouva Corrente S.r.l.","Transportation and Energy","Art. 1, Art. 15, Art. 2, Art. 5, Art. 6, Art. 7","Consent, Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10255198","https://www.enforcementtracker.com/ETid-3228","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_312/2026","gdprhub",null,null,"nouva corrente srl",null,null,null,null,null,null,null,null,null],["2026/ES/024","ETid-3133","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-04-28","day",6000,null,"EUR","GATIGOS, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00278-2025.pdf","https://www.enforcementtracker.com/ETid-3133",null,null,null,null,"gatigos sl",null,null,null,null,null,null,null,null,null],["2026/RO/016","ETid-3135","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-04-28","day",35000,null,"EUR","Crowd Entertainment Ltd","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_28_04_2026","https://www.enforcementtracker.com/ETid-3135",null,null,null,null,"crowd entertainment ltd",null,null,null,null,null,null,null,null,null],["2026/ES/025","ETid-3167","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-04-28","day",4000,null,"EUR","SIPHONE 2020, S.L.","Employment","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00615-2025.pdf","https://www.enforcementtracker.com/ETid-3167",null,null,null,null,"siphone 2020 sl",null,null,null,null,null,null,null,null,null],["2026/ES/026","ETid-3168","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-04-28","day",1800,null,"EUR","RESIDENCIAL ETXE-LAN, S.L.","Real Estate","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00643-2025.pdf","https://www.enforcementtracker.com/ETid-3168",null,null,null,null,"residencial etxe lan sl",null,null,null,null,null,null,null,null,null],["2026/BE/006","ETid-3175","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2026-04-28","day",1000,null,"EUR","Non-Profit Foundation","Individuals and Private Associations","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-94-2026.pdf","https://www.enforcementtracker.com/ETid-3175","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_94/2026","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/ES/027","ETid-3185","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-04-28","day",240,null,"EUR","Posada del León de Oro","Employment","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00598-2025.pdf","https://www.enforcementtracker.com/ETid-3185",null,null,null,null,"ES: posada del leon de oro",null,null,null,null,null,null,null,null,null],["2026/FR/010","CNIL (France) - SAN-2026-008","gdprhub","France","FR","CNIL (France)","2026-04-26","day",5000000,"5.000.000","EUR","IQVIA Operations France",null,"Art. 14, Art. 25","Accountability, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000054136834?fonds=CNIL&page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2026-008",null,"gdprhub",null,null,"FR: iqvia operations france",null,null,null,null,null,null,null,null,null],["2026/BE/001","ETid-3112","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2026-04-23","day",8500,null,"EUR","Accountancy Firm","Employment","Art. 17(1), Art. 5(1)(a), Art. 6(1)","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-86-2026.pdf","https://www.enforcementtracker.com/ETid-3112","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_86/2026","gdprhub",null,null,"BE: accountancy firm",null,null,null,null,null,null,null,null,null],["2026/BE/023","APD/GBA (Belgium) - 84/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-04-22","day",null,null,null,null,null,"Art. 12(3), Art. 12(5), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-84-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_84/2026",null,"gdprhub",null,"Real estate agency",null,null,null,null,null,null,null,null,null,null],["2026/BE/020","APD/GBA (Belgium) - 85/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-04-22","day",null,null,null,null,null,"Art. 12, Art. 17, Art. 21","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-85-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_85/2026",null,"gdprhub",null,"Soccer club",null,null,null,null,null,null,null,null,null,null],["2026/ES/029","ETid-3191","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-04-22","day",300000,null,"EUR","KONECTA BTO, S.L.","Industry and Commerce","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00613-2025.pdf","https://www.enforcementtracker.com/ETid-3191",null,null,null,null,"konecta bto sl",null,null,null,null,null,null,null,null,null],["2026/GR/008","HDPA (Greece) - 6/2026","gdprhub","Greece","GR","HDPA (Greece)","2026-04-21","day",22000,"22,000","EUR","Vodafone Greece – ΠΑΝΑΦΟΝ Ανώνυμη Ελληνική Εταιρεία Τηλεπικοινωνιών",null,"Art. 14(3)(c), Art. 2(2)(c), Art. 6(1)(f)","Transparency, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2026-05/6_2026_anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_6/2026",null,"gdprhub",null,null,"GR: vodafone greece","Vodafone",null,null,null,null,null,null,null,null],["2026/ES/038","APDCAT (Catalonia) - PS-0127/2025","gdprhub","Spain","ES","APDCAT (Catalonia)","2026-04-20","day",null,null,null,null,null,"Art. 5(1)(c), Art. 5(1)(f)","Data principles",null,"Violation found","https://seu.apdcat.cat/ca/resolucioDictamensInformesPublic/listPublicacions?categorias=21","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_PS-0127/2025",null,"gdprhub",null,"Catalan city council",null,null,null,null,null,null,null,null,null,null],["2026/IT/052","ETid-3176","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-17","day",2000,null,"EUR","Io e te s.r.l.s.","Industry and Commerce","Art. 13, Art. 5(1)(a), Art. 88","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10250607","https://www.enforcementtracker.com/ETid-3176",null,null,null,null,"io e te srls",null,null,null,null,null,null,null,null,null],["2026/IT/053","ETid-3177","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-17","day",5000,null,"EUR","Framos Italia s.r.l.","Employment","Art. 12, Art. 13, Art. 17, Art. 29, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10250265","https://www.enforcementtracker.com/ETid-3177",null,null,null,null,"framos italia srl",null,null,null,null,null,null,null,null,null],["2026/IT/054","ETid-3178","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-17","day",6624000,null,"EUR","Poste Italiane S.p.a.","Finance, Insurance and Consulting","Art. 13, Art. 25, Art. 28, Art. 32, Art. 35, Art. 5, Art. 6","Accountability, DPIA, Data principles, Data security, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10241537","https://www.enforcementtracker.com/ETid-3178",null,null,null,null,"poste italiane spa",null,null,null,null,null,null,null,null,null],["2026/IT/055","ETid-3179","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-17","day",5877000,null,"EUR","Postepay S.p.a.","Finance, Insurance and Consulting","Art. 13, Art. 25, Art. 28, Art. 32, Art. 35, Art. 5, Art. 6","Accountability, DPIA, Data principles, Data security, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10241537","https://www.enforcementtracker.com/ETid-3179",null,null,null,null,"postepay spa",null,null,null,null,null,null,null,null,null],["2026/IT/056","ETid-3180","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-17","day",2000,null,"EUR","Business Owner","Industry and Commerce","Art. 13, Art. 32","Data security, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10251701","https://www.enforcementtracker.com/ETid-3180",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/IT/057","ETid-3181","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-04-17","day",6000,null,"EUR","Comune di Campo Calabro","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10251748","https://www.enforcementtracker.com/ETid-3181",null,null,null,null,"IT: comune di campo calabro",null,null,null,null,null,null,null,null,null],["2026/IT/122","Garante per la protezione dei dati personali (Italy) - 10241537","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-04-17","day",12501000,"12,501,000","EUR",null,null,"Art. 13, Art. 25, Art. 32, Art. 35, Art. 5(1)(a), Art. 5(1)(e), Art. 6, Art. 6(1)(f)","Accountability, DPIA, Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10241537","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10241537",null,"gdprhub","Poste Italiane S.p.a.; PostePay S.p.a.",null,null,null,null,null,null,null,null,null,null,null],["2026/IT/110","Garante per la protezione dei dati personali (Italy) - 280/2026","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-04-17","day",85000,"85,000","EUR","Ambrosetti S.p.A.",null,"Art. 32, Art. 33, Art. 34, Art. 5(1)(e), Art. 5(1)(f)","Data breach, Data principles, Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10252460","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_280/2026",null,"gdprhub",null,null,"ambrosetti spa",null,null,null,null,null,null,null,null,null],["2026/EE/002","AKI (Estonia) - No. 2.1-1/24/397-890-38","gdprhub","Estonia","EE","AKI (Estonia)","2026-04-16","day",null,null,null,"OÜ Dr Mõttus Hambaravi",null,"Art. 12, Art. 13, Art. 14, Art. 25, Art. 26, Art. 28, Art. 4(11), Art. 4(7), Art. 5(1)(a), Art. 5(2), Art. 58(2)(b), Art. 6(1)(a), Art. 6(1)(b), Art. 9(2)(a)","Accountability, Data principles, Processor obligations, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2026-07/Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas%20%2817%29.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_No._2.1-1/24/397-890-38",null,"gdprhub",null,null,"ou dr mottus hambaravi",null,null,null,null,null,null,null,null,null],["2026/ES/034","AEPD (Spain) - EXP202309453","gdprhub","Spain","ES","AEPD (Spain)","2026-04-15","day",200000,"200,000","EUR","AXA SEGUROS GENERALES, S.A. DE SEGUROS Y REASEGUROS",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00337-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202309453",null,"gdprhub",null,null,"axa seguros generales sa de seguros y reaseguros",null,null,null,null,null,null,null,null,null],["2026/SI/005","ETid-3111","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2026-04-15","day",6600,null,"EUR","Utility Company","Industry and Commerce","Art. 5","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ip-rs.si/novice/nezakonito-gps-sledenje-zaposlenim-informacijski-poobla%C5%A1%C4%8Denec-javnemu-komunalnemu-podjetju-izrekel-globo-v-vi%C5%A1ini-6000-eur-1776238559","https://www.enforcementtracker.com/ETid-3111",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/ES/030","ETid-3201","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-04-15","day",400000,null,"EUR","CAIXABANK, S.A.","Finance, Insurance and Consulting","Art. 25, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00143-2025.pdf","https://www.enforcementtracker.com/ETid-3201",null,null,null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2026/PL/011","ETid-3203","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-04-13","day",2415,null,"EUR","Sub Agent","Industry and Commerce","Art. 28(4)","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2022:dkn_5131_7/content?query=","https://www.enforcementtracker.com/ETid-3203","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.7.2022","gdprhub",null,null,"PL: sub agent",null,null,null,null,null,null,null,null,null],["2026/EE/001","AKI (Estonia) - 2.1-1/25/724-1566-19","gdprhub","Estonia","EE","AKI (Estonia)","2026-04-09","day",null,null,null,null,null,"Art. 12(1), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2026-06/09.04.2026%20ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas%20eraisik%20vs%20kohtut%C3%A4itur.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-1/25/724-1566-19",null,"gdprhub",null,"Bailiff",null,null,null,null,null,"person",null,null,null,null],["2026/DK/002","Datatilsynet (Denmark) - 2025-31-1972","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2026-04-09","day",null,null,null,null,null,"Art. 6(1)(f), Art. 9(2)(f)","Special categories, Unlawful processing",null,"Rejected","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2026/apr/arbejdsgivers-videregivelse-af-personoplysninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2025-31-1972",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2026/BE/019","APD/GBA (Belgium) - 75/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-04-08","day",null,null,null,null,null,"Art. 35(3)","DPIA",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-75-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_75/2026",null,"gdprhub",null,"Insurer",null,null,null,null,null,null,null,null,null,null],["2026/PL/008","ETid-3114","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-04-07","day",2350,null,"EUR","Housing Associaction","Real Estate","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_16/content","https://www.enforcementtracker.com/ETid-3114",null,null,null,null,"PL: housing associaction",null,null,null,null,null,null,null,null,null],["2026/RO/015","ETid-3134","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-04-03","day",2500,null,"EUR","BLUE PROJECTS S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_03_04_2026","https://www.enforcementtracker.com/ETid-3134",null,null,null,null,"blue projects srl",null,null,null,null,null,null,null,null,null],["2026/NL/011","ETid-3171","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-04-01","day",100000000,null,"EUR","Ridetech International B.V.","Transportation and Energy","Art. 44, Art. 46","International transfers, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://autoriteitpersoonsgegevens.nl/system/files?file=2026-05/Besluit%20boete%20Yango.pdf","https://www.enforcementtracker.com/ETid-3171","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_2025-005323","gdprhub",null,null,"ridetech international bv",null,null,null,null,null,null,null,null,null],["2026/BE/017","APD/GBA (Belgium) - 72/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-03-31","day",null,null,null,null,null,"Art. 2(1)",null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-72-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_72/2026",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/FI/005","Tietosuojavaltuutetun toimisto (Finland) - TSV/5875/2024","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-03-31","day",null,null,null,null,null,"Art. 25(1), Art. 5(1)(f), Art. 58(2)(b)","Accountability, Data principles",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/10","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/5875/2024",null,"gdprhub",null,"Insurance company",null,null,null,null,null,null,null,null,null,null],["2026/SI/004","ETid-3110","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2026-03-27","day",13491,null,"EUR","Legal Person",null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_10_2026_7.docx","https://www.enforcementtracker.com/ETid-3110",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/IT/041","ETid-3156","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",1000,null,"EUR","Euro Bangla Minimarket in Jesi","Employment","Art. 5(1)(a), Art. 88","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10246294","https://www.enforcementtracker.com/ETid-3156",null,null,null,null,"IT: euro bangla minimarket in jesi",null,null,null,null,null,null,null,null,null],["2026/IT/042","ETid-3157","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",2000,null,"EUR","Copacabana s.r.l.","Accommodation and Hospitality","Art. 13, Art. 5(1)(a), Art. 88","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10246082","https://www.enforcementtracker.com/ETid-3157",null,null,null,null,"copacabana srl",null,null,null,null,null,null,null,null,null],["2026/IT/043","ETid-3158","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",2000,null,"EUR","Business Owner","Industry and Commerce","Art. 13, Art. 5(1)(a), Art. 88","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10246060","https://www.enforcementtracker.com/ETid-3158",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/IT/044","ETid-3159","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",5000,null,"EUR","Esselunga S.p.A.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10246008","https://www.enforcementtracker.com/ETid-3159",null,null,null,null,"esselunga spa",null,null,null,null,null,null,null,null,null],["2026/IT/045","ETid-3160","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",2500,null,"EUR","Comune di Cassino","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10246037","https://www.enforcementtracker.com/ETid-3160",null,null,null,null,"IT: comune di cassino",null,null,null,null,null,null,null,null,null],["2026/IT/046","ETid-3161","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",96000,null,"EUR","Eni S.p.A.","Industry and Commerce","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10238270","https://www.enforcementtracker.com/ETid-3161","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10238270","gdprhub",null,null,"eni spa",null,null,null,null,null,null,null,null,null],["2026/IT/047","ETid-3162","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",31800000,null,"EUR","Intesa Sanpaolo S.p.A.","Finance, Insurance and Consulting","Art. 24, Art. 32, Art. 34","Accountability, Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10234984","https://www.enforcementtracker.com/ETid-3162","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10234984","gdprhub",null,null,"intesa sanpaolo spa","Intesa Sanpaolo",null,null,null,null,null,null,null,null],["2026/IT/048","ETid-3163","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",3000,null,"EUR","Piacenza Bar Association","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10243835","https://www.enforcementtracker.com/ETid-3163",null,null,null,null,"IT: piacenza bar association",null,null,null,null,null,null,null,null,null],["2026/IT/049","ETid-3164","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",3000,null,"EUR","Municipality","Employment","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10242571","https://www.enforcementtracker.com/ETid-3164",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/IT/050","ETid-3165","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",5000,null,"EUR","Municipality","Employment","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10243180","https://www.enforcementtracker.com/ETid-3165",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/IT/051","ETid-3166","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-26","day",2000,null,"EUR","Physician","Health Care",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10241477","https://www.enforcementtracker.com/ETid-3166",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/BE/016","APD/GBA (Belgium) - 68/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-03-25","day",null,null,null,"Walloon Economic, Social, and Environmental Council (Rural Affairs Division)",null,"Art. 12(3), Art. 12(4), Art. 15, Art. 17, Art. 17(3)(a), Art. 17(3)(b), Art. 5(1)(a), Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-68-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_68/2026",null,"gdprhub",null,null,"BE: walloon economic social and environmental council",null,null,null,null,null,null,null,null,null],["2026/RO/014","ETid-3071","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-03-25","day",125000,null,"EUR","RENAULT COMMERCIAL ROUMANIE S.R.L.","Industry and Commerce","Art. 28(1)","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_25.03.2026","https://www.enforcementtracker.com/ETid-3071",null,null,null,null,"renault commercial roumanie srl",null,null,null,null,null,null,null,null,null],["2026/AT/001","ETid-3143","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2026-03-24","day",6300,null,"EUR","Advertising Agency","Industry and Commerce","Art. 13, Art. 5(1), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ris.bka.gv.at/Dokumente/Bvwg/BVWGT_20260324_W298_2323263_1_00/BVWGT_20260324_W298_2323263_1_00.pdf","https://www.enforcementtracker.com/ETid-3143",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/RO/013","ETid-3070","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-03-23","day",4000,null,"EUR","ING Bank NV Amsterdam – Sucursala București S.A.","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_23.03.2026","https://www.enforcementtracker.com/ETid-3070",null,null,null,null,"ing bank nv amsterdam sucursala bucuresti","ING",null,null,null,null,null,null,null,null],["2026/GB/006","ICO (UK) - Enforcement notice to The University Hospitals Birmingham NHS Foundation Trust","gdprhub","United Kingdom","GB","ICO (UK)","2026-03-23","day",null,null,null,"The University Hospitals Birmingham NHS Foundation Trust",null,null,null,null,"Violation found","https://ico.org.uk/media2/yjapygen/university-hospital-birmingham-en-20260323.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Enforcement_notice_to_The_University_Hospitals_Birmingham_NHS_Foundation_Trust",null,"gdprhub",null,null,"GB: the university hospitals birmingham nhs foundation trust",null,null,null,null,null,null,null,null,null],["2026/GB/007","ICO (UK) - Enforcement notice to the Queen Elizabeth Hospital King's Lynn NHS Foundation Trust","gdprhub","United Kingdom","GB","ICO (UK)","2026-03-23","day",null,null,null,"The Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust",null,null,null,null,"Violation found","https://ico.org.uk/media2/r4tdn1wi/queen-elizabeth-hospital-en-20260323.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Enforcement_notice_to_the_Queen_Elizabeth_Hospital_King%27s_Lynn_NHS_Foundation_Trust",null,"gdprhub",null,null,"GB: the queen elizabeth hospital kings lynn nhs foundation trust",null,null,null,null,null,null,null,null,null],["2026/BE/015","APD/GBA (Belgium) - 66/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-03-20","day",null,null,null,null,null,"Art. 12, Art. 17(1), Art. 6","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-66-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_66/2026",null,"gdprhub",null,"Travel blogger",null,null,null,null,null,"person",null,null,null,null],["2026/AT/009","DSB (Austria) - 2025-0.960.016","gdprhub","Austria","AT","DSB (Austria)","2026-03-20","day",null,null,null,null,null,"Art. 6(1)(b), Art. 6(1)(f), Art. 88","Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260320_2025_0_960_016_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.960.016",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2026/RO/010","ETid-3065","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-03-20","day",3000,null,"EUR","Public and Private Domain SA","Employment","Art. 12, Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_20_03_2026","https://www.enforcementtracker.com/ETid-3065",null,null,null,null,"public and private domain sa",null,null,null,null,null,null,null,null,null],["2026/RO/012","ETid-3069","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-03-20","day",3000,null,"EUR","Domeniul Public și Privat SA","Public Sector and Education","Art. 12, Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_20_03_2026","https://www.enforcementtracker.com/ETid-3069",null,null,null,null,"domeniul public si privat sa",null,null,null,null,null,null,null,null,null],["2026/ES/031","ETid-3202","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-20","day",150000,null,"EUR","ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L.","Industry and Commerce","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00511-2025.pdf","https://www.enforcementtracker.com/ETid-3202",null,null,null,null,"alia gestion integral de servicios sl",null,null,null,null,null,null,null,null,null],["2026/FI/004","Tietosuojavaltuutetun toimisto (Finland) - TSV/206/2021","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-03-19","day",null,null,null,"Lepus Asset Management Oy",null,"Art. 4(11), Art. 7, Art. 95","Consent",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/8","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/206/2021",null,"gdprhub",null,null,"lepus asset management oy",null,null,null,null,null,null,null,null,null],["2026/ES/020","ETid-3129","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-13","day",600,null,"EUR","CENTRO MEDICO REY FERNANDO, S.L.P.","Health Care","Art. 12","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00560-2025.pdf","https://www.enforcementtracker.com/ETid-3129",null,null,null,null,"centro medico rey fernando slp",null,null,null,null,null,null,null,null,null],["2026/ES/021","ETid-3130","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-13","day",18000,null,"EUR","RAMÓN GRAU, S.L.","Employment","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00264-2024.pdf","https://www.enforcementtracker.com/ETid-3130",null,null,null,null,"ramon grau sl",null,null,null,null,null,null,null,null,null],["2026/ES/022","ETid-3131","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-13","day",450,null,"EUR","Housing Association","Real Estate","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00104-2025.pdf","https://www.enforcementtracker.com/ETid-3131",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/ES/023","ETid-3132","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-13","day",600,null,"EUR","SERVICIOS INMOBILIARIOS Y GESTIÓN RCL MADRID, S.L.","Real Estate","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00211-2025.pdf","https://www.enforcementtracker.com/ETid-3132",null,null,null,null,"servicios inmobiliarios y gestion rcl madrid sl",null,null,null,null,null,null,null,null,null],["2026/IT/033","ETid-3148","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",563052,null,"EUR","Enel Energia S.p.A.","Transportation and Energy","Art. 24, Art. 28, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10233396","https://www.enforcementtracker.com/ETid-3148","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10233396","gdprhub",null,null,"enel energia spa","Enel",null,null,null,null,null,null,null,null],["2026/IT/034","ETid-3149","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",50000,null,"EUR","ITAS Mutua","Employment","Art. 12, Art. 13, Art. 15, Art. 88","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10233328","https://www.enforcementtracker.com/ETid-3149",null,null,null,null,"IT: itas mutua",null,null,null,null,null,null,null,null,null],["2026/IT/035","ETid-3150","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",40000,null,"EUR","La7 S.p.A.","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10242600","https://www.enforcementtracker.com/ETid-3150",null,null,null,null,"la7 spa",null,null,null,null,null,null,null,null,null],["2026/IT/036","ETid-3151","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",800,null,"EUR","Barber Shop","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10240388","https://www.enforcementtracker.com/ETid-3151",null,null,null,null,"IT: barber shop",null,null,null,null,null,null,null,null,null],["2026/IT/037","ETid-3152","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",2000,null,"EUR","Liceo Scientifico Morgagni di Roma","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10240343","https://www.enforcementtracker.com/ETid-3152",null,null,null,null,"IT: liceo scientifico morgagni di roma",null,null,null,null,null,null,null,null,null],["2026/IT/038","ETid-3153","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",40000,null,"EUR","INPS – Istituto nazionale previdenza sociale","Public Sector and Education","Art. 10, Art. 25, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10240688","https://www.enforcementtracker.com/ETid-3153",null,null,null,null,"IT: inps istituto nazionale previdenza sociale",null,null,null,null,null,null,null,null,null],["2026/IT/039","ETid-3154","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",2000,null,"EUR","Hanako s.r.l.","Accommodation and Hospitality","Art. 13, Art. 32","Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10240451","https://www.enforcementtracker.com/ETid-3154",null,null,null,null,"hanako srl",null,null,null,null,null,null,null,null,null],["2026/IT/040","ETid-3155","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-03-12","day",2000,null,"EUR","Comune di Sutri","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10240362","https://www.enforcementtracker.com/ETid-3155",null,null,null,null,"IT: comune di sutri",null,null,null,null,null,null,null,null,null],["2026/IT/118","Garante per la protezione dei dati personali (Italy) - 10233345","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-03-12","day",5000,"5,000","EUR","Bakeca S.r.l.",null,"Art. 24, Art. 25, Art. 32, Art. 5, Art. 6, Art. 9","Accountability, Data principles, Data security, Special categories, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10233345","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10233345",null,"gdprhub",null,null,"bakeca srl",null,null,null,null,null,null,null,null,null],["2026/IT/120","Garante per la protezione dei dati personali (Italy) - 10233368","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-03-12","day",null,null,null,"Sagitter S.p.a.",null,"Art. 5(1)(a), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10233368","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10233368",null,"gdprhub",null,null,"sagitter spa",null,null,null,null,null,null,null,null,null],["2026/ES/028","ETid-3189","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-11","day",650000,null,"EUR","IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA","Transportation and Energy","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00437-2024.pdf","https://www.enforcementtracker.com/ETid-3189",null,null,null,null,"iberia lineas aereas de espana sa operadora",null,null,null,null,null,null,null,null,null],["2026/ES/019","ETid-3128","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-10","day",6000,null,"EUR","CUMACA MOTOR, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00488-2024.pdf","https://www.enforcementtracker.com/ETid-3128",null,null,null,null,"cumaca motor sl",null,null,null,null,null,null,null,null,null],["2026/FI/003","Tietosuojavaltuutetun toimisto (Finland) - TSV/3375/2023","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-03-10","day",null,null,null,"Dun & Bradstreet Finland Oy",null,"Art. 12(1), Art. 12(2), Art. 12(3), Art. 12(4), Art. 12(5), Art. 12(6), Art. 15(1), Art. 15(3), Art. 15(4), Art. 58(2)(b), Art. 58(2)(d)","Data subject rights, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/7","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/3375/2023",null,"gdprhub",null,null,"dun and bradstreet finland oy",null,null,null,null,null,null,null,null,null],["2026/ES/036","AEPD (Spain) - PS-00008-2025","gdprhub","Spain","ES","AEPD (Spain)","2026-03-09","day",60000,"60000.0","EUR","RAMONA FILMS, S.L.",null,"Art. 28(3), Art. 58(2)","Processor obligations",null,"Violation found","https://www.aepd.es/documento/ps-00008-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00008-2025",null,"gdprhub",null,null,"ramona films sl",null,null,null,null,null,null,null,null,null],["2026/BE/018","APD/GBA (Belgium) - 45/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-03-05","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-45-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_45/2026",null,"gdprhub",null,"Individuals",null,null,null,null,null,"person",null,null,null,null],["2026/RO/011","ETid-3068","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-03-05","day",8000,null,"EUR","Altex Romania S.R.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_05_03_2026","https://www.enforcementtracker.com/ETid-3068",null,null,null,null,"altex romania srl",null,null,null,null,null,null,null,null,null],["2026/BE/014","APD/GBA (Belgium) - 44/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-03-04","day",null,null,null,null,null,"Art. 15(1), Art. 15(3)","Data subject rights",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-44-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_44/2026",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2026/FR/009","CNIL (France) - SAN-2026-004","gdprhub","France","FR","CNIL (France)","2026-03-04","day",null,null,null,"KASPR",null,"Art. 12, Art. 14, Art. 15, Art. 5(1)(e), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053623597","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2026-004",null,"gdprhub",null,null,"FR: kaspr",null,null,null,null,null,null,null,null,null],["2026/ES/018","ETid-3127","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-04","day",200000,null,"EUR","ARES CAPITAL, S.A.","Employment","Art. 13, Art. 5(1)(c), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00454-2024.pdf","https://www.enforcementtracker.com/ETid-3127","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202411411","gdprhub",null,null,"ares capital sa",null,null,null,null,null,null,null,null,null],["2026/IT/116","Garante per la protezione dei dati personali (Italy) - 10230206","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-03-04","day",1250000,"1,250,000","EUR","Italia Trasporto Aereo S.p.a.",null,"Art. 12, Art. 13, Art. 14, Art. 15, Art. 5(1)(a), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10230206","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10230206",null,"gdprhub",null,null,"italia trasporto aereo spa",null,null,null,null,null,null,null,null,null],["2026/ES/015","ETid-3095","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-02","day",2000,null,"EUR","MALAGASUITE SHOWROOM, S.L.","Accommodation and Hospitality","Art. 13","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00524-2025.pdf","https://www.enforcementtracker.com/ETid-3095",null,null,null,null,"malagasuite showroom sl",null,null,null,null,null,null,null,null,null],["2026/ES/016","ETid-3096","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-02","day",900,null,"EUR","ORNITOLÓGICA DE ANDALUCÍA FOA","Individuals and Private Associations","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00200-2024.pdf","https://www.enforcementtracker.com/ETid-3096",null,null,null,null,"ES: ornitologica de andalucia foa",null,null,null,null,null,null,null,null,null],["2026/FI/001","ETid-3104","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2026-03-02","day",5000,null,"EUR","Suomen Numerokeskus Oy","Industry and Commerce",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/5","https://www.enforcementtracker.com/ETid-3104",null,null,null,null,"suomen numerokeskus oy",null,null,null,null,null,null,null,null,null],["2026/ES/017","ETid-3126","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-02","day",8500,null,"EUR","HIGHCLIFFE ESTATES MARBELLA, S.L.","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00294-2024.pdf","https://www.enforcementtracker.com/ETid-3126",null,null,null,null,"highcliffe estates marbella sl",null,null,null,null,null,null,null,null,null],["2026/ES/013","ETid-3093","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-01","day",1000,null,"EUR",null,"Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00292-2024.pdf","https://www.enforcementtracker.com/ETid-3093",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/ES/014","ETid-3094","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-03-01","day",12000,null,"EUR","HOLY MARY CATHOLIC SCHOOL, S.L.","Public Sector and Education","Art. 35, Art. 5(1)(a), Art. 6(1)","DPIA, Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00607-2025.pdf","https://www.enforcementtracker.com/ETid-3094",null,null,null,null,"holy mary catholic school sl",null,null,null,null,null,null,null,null,null],["2026/IT/021","ETid-3092","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",1000,null,"EUR","Ciemme S.r.l.s.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10232549","https://www.enforcementtracker.com/ETid-3092",null,null,null,null,"ciemme srls",null,null,null,null,null,null,null,null,null],["2026/IT/022","ETid-3115","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",5000,null,"EUR","Conservatory","Public Sector and Education","Art. 10, Art. 6","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10232961","https://www.enforcementtracker.com/ETid-3115",null,null,null,null,"IT: conservatory",null,null,null,null,null,null,null,null,null],["2026/IT/023","ETid-3116","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",15000,null,"EUR","Ministero delle Imprese e del Made in Italy","Public Sector and Education","Art. 12, Art. 6, Art. 9","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10235715","https://www.enforcementtracker.com/ETid-3116",null,null,null,null,"IT: ministero delle imprese e del made in italy",null,null,null,null,null,null,null,null,null],["2026/IT/024","ETid-3117","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",15000,null,"EUR","Depac Società Cooperativa Sociale a r.l.","Employment","Art. 13, Art. 30, Art. 35, Art. 9","DPIA, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10233224","https://www.enforcementtracker.com/ETid-3117",null,null,null,null,"IT: depac societa cooperativa sociale arl",null,null,null,null,null,null,null,null,null],["2026/IT/025","ETid-3118","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",15000,null,"EUR","Flamel S.r.l.","Industry and Commerce","Art. 11, Art. 25, Art. 39, Art. 42, Art. 43, Art. 8","Accountability, Consent, Data principles, Data protection officer","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10234589","https://www.enforcementtracker.com/ETid-3118",null,null,null,null,"flamel srl",null,null,null,null,null,null,null,null,null],["2026/IT/026","ETid-3119","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",15000,null,"EUR","Ministero delle Imprese e del Made in Italy","Public Sector and Education","Art. 28(3)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10234213","https://www.enforcementtracker.com/ETid-3119",null,null,null,null,"IT: ministero delle imprese e del made in italy",null,null,null,null,null,null,null,null,null],["2026/IT/027","ETid-3120","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",2000,null,"EUR","Istituto Tecnico Statale “Luigi Einaudi” di Correggio","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10233242","https://www.enforcementtracker.com/ETid-3120",null,null,null,null,"IT: istituto tecnico statale luigi einaudi di correggio",null,null,null,null,null,null,null,null,null],["2026/IT/028","ETid-3121","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",12000,null,"EUR","Ministero dell’Economia e delle Finanze","Public Sector and Education","Art. 28(3), Art. 5(1)(a)","Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10234960","https://www.enforcementtracker.com/ETid-3121",null,null,null,null,"IT: ministero delleconomia e delle finanze",null,null,null,null,null,null,null,null,null],["2026/IT/029","ETid-3122","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",3000,null,"EUR","Groupharma s.r.l.s.","Employment","Art. 12, Art. 15, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10233201","https://www.enforcementtracker.com/ETid-3122",null,null,null,null,"groupharma srls",null,null,null,null,null,null,null,null,null],["2026/IT/030","ETid-3123","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",10000,null,"EUR","Radio Immagine Uno S.r.l.","Media, Telecoms and Broadcasting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10232840","https://www.enforcementtracker.com/ETid-3123",null,null,null,null,"radio immagine uno srl",null,null,null,null,null,null,null,null,null],["2026/IT/031","ETid-3124","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",32000,null,"EUR","Dedalus Italia S.p.A.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10234928","https://www.enforcementtracker.com/ETid-3124",null,null,null,null,"dedalus italia spa",null,null,null,null,null,null,null,null,null],["2026/IT/032","ETid-3125","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-26","day",30000,null,"EUR","S.M. Trattamento Acqua di XX","Industry and Commerce","Art. 12, Art. 15, Art. 22, Art. 24, Art. 28, Art. 4, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10236228","https://www.enforcementtracker.com/ETid-3125",null,null,null,null,"IT: sm trattamento acqua di xx",null,null,null,null,null,null,null,null,null],["2026/BE/013","APD/GBA (Belgium) - 37/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-02-24","day",null,null,null,null,null,"Art. 12(2), Art. 12(4), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-37-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_37/2026",null,"gdprhub",null,"Employee of a company",null,null,null,null,null,"person",null,null,null,null],["2026/IT/115","Garante per la protezione dei dati personali (Italy) - 10224096","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2026-02-24","day",null,null,null,"Amazon Italia Logistica s.r.l.",null,"Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(e), Art. 58(2)(f), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10224096#english","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10224096",null,"gdprhub",null,null,"amazon italia logistica srl","Amazon",null,null,null,null,null,null,null,null],["2026/GB/002","ETid-3074","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2026-02-23","day",16610000,null,"EUR","Reddit, Inc.","Media, Telecoms and Broadcasting","Art. 35, Art. 5(1)(a), Art. 8","Consent, DPIA, Data principles","Non-compliance with general data processing principles","Fine issued","https://ico.org.uk/media2/hrlmvj14/reddit-mpn-20260223.pdf","https://www.enforcementtracker.com/ETid-3074","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Reddit%2C_Inc","gdprhub",null,null,"reddit inc",null,null,null,null,null,null,null,null,null],["2026/RO/009","ETid-3058","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-02-20","day",2000,null,"EUR","SC Hayat Dent SRL","Health Care","Art. 83(5)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_20_02_2026","https://www.enforcementtracker.com/ETid-3058",null,null,null,null,"hayat dent srl",null,null,null,null,null,null,null,null,null],["2026/GR/003","ETid-3144","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-02-20","day",5000,null,"EUR","KEAT - Centre for Education & Rehabilitation of the Blind","Public Sector and Education","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2026-03/5_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-3144",null,null,null,null,"GR: keat centre for education and rehabilitation of the blind",null,null,null,null,null,null,null,null,null],["2026/HU/001","ETid-3169","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-02-20","day",5570,null,"EUR","University of Szeged","Public Sector and Education","Art. 6(1), Art. 9(2)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=1443:kollegiumi-felveteli-eljaras-adatkezelese","https://www.enforcementtracker.com/ETid-3169",null,null,null,null,"HU: university of szeged",null,null,null,null,null,null,null,null,null],["2026/GB/010","ICO (UK) - Reprimand against the City of London Police","gdprhub","United Kingdom","GB","ICO (UK)","2026-02-20","day",null,null,null,"The Commissioner of Police for the City of London",null,null,null,null,"Violation found","https://ico.org.uk/media2/tljf2hfb/20260220-city-of-london-police-reprimand.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Reprimand_against_the_City_of_London_Police",null,"gdprhub",null,null,"GB: the commissioner of police for the city of london",null,null,null,null,null,null,null,null,null],["2026/HU/007","NAIH (Hungary) - NAIH-3443-1/2026","gdprhub","Hungary","HU","NAIH (Hungary)","2026-02-20","day",null,"2,000,000","HUF","University of Szeged",null,"Art. 13(1), Art. 13(1)(b), Art. 13(1)(c), Art. 13(1)(d), Art. 13(1)(e), Art. 13(1)(f), Art. 13(2), Art. 5(1)(a), Art. 5(1)(c), Art. 6(1), Art. 6(1)(a), Art. 6(1)(e), Art. 9(1), Art. 9(2), Art. 9(2)(b), Art. 9(2)(g)","Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-3443-1/2026",null,"gdprhub",null,null,"HU: university of szeged",null,2000000.0,5268,"day 2026-02-20|379.6500|HUF",null,null,null,null,null],["2026/RO/008","ETid-3057","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-02-19","day",3000,null,"EUR","Your Consulting SRL","Industry and Commerce","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_19_02_2026","https://www.enforcementtracker.com/ETid-3057",null,null,null,null,"your consulting srl",null,null,null,null,null,null,null,null,null],["2026/PL/007","ETid-3113","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-02-19","day",1393300,null,"EUR","Restaurant Partner Polska","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2022:dkn_5112_33/content?query=","https://www.enforcementtracker.com/ETid-3113","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.33.2022","gdprhub",null,null,"PL: restaurant partner polska",null,null,null,null,null,null,null,null,null],["2026/SI/006","IP (Slovenia) - 0609-143/2025/4","gdprhub","Slovenia","SI","IP (Slovenia)","2026-02-18","day",200,"200","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0609-143/2025/4",null,"gdprhub",null,"Police officer",null,null,null,null,null,"person",null,null,null,null],["2026/SI/003","ETid-3109","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2026-02-16","day",5500,null,"EUR",null,null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_118_2025_5.docx","https://www.enforcementtracker.com/ETid-3109",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/PL/006","ETid-3066","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-02-13","day",8470,null,"EUR","Election Committee of Karol Nawrocki","Individuals and Private Associations","Art. 5(1), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_12/content","https://www.enforcementtracker.com/ETid-3066",null,null,null,null,"PL: election committee of karol nawrocki",null,null,null,null,null,null,null,null,null],["2026/LT/003","VDAI (Lithuania) - 3R-252","gdprhub","Lithuania","LT","VDAI (Lithuania)","2026-02-13","day",6000,"6,000","EUR","VšĮ Biržų ligoninė",null,"Art. 5(1)(a), Art. 5(1)(e), Art. 5(1)(f), Art. 6(1), Art. 9(1)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://vdai.lrv.lt/public/canonical/1771410765/1286/2026-02-13%20sprendimas%20Nr.%203R-252%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-252",null,"gdprhub",null,null,"LT: vsi birzu ligonine",null,null,null,null,null,null,null,null,null],["2026/IT/007","ETid-3078","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",2000,null,"EUR","Comune di Velletri","Public Sector and Education","Art. 13, Art. 28(1), Art. 5(1)(a), Art. 6","Data principles, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10225225","https://www.enforcementtracker.com/ETid-3078",null,null,null,null,"IT: comune di velletri",null,null,null,null,null,null,null,null,null],["2026/IT/008","ETid-3079","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",6000,null,"EUR","Comune di Coccaglio","Employment","Art. 12(1), Art. 13, Art. 35, Art. 88","DPIA, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10226611","https://www.enforcementtracker.com/ETid-3079",null,null,null,null,"IT: comune di coccaglio",null,null,null,null,null,null,null,null,null],["2026/IT/009","ETid-3080","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",4000,null,"EUR","Order of Physicians, Surgeons and Dentists of the Province of Macerata","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10223675","https://www.enforcementtracker.com/ETid-3080",null,null,null,null,"IT: order of physicians surgeons and dentists of the province of macerata",null,null,null,null,null,null,null,null,null],["2026/IT/010","ETid-3081","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",2000,null,"EUR","Comune di Monterotondo","Public Sector and Education","Art. 13, Art. 5(1)(a), Art. 88","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10225084","https://www.enforcementtracker.com/ETid-3081",null,null,null,null,"IT: comune di monterotondo",null,null,null,null,null,null,null,null,null],["2026/IT/011","ETid-3082","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",1500,null,"EUR",null,"Accommodation and Hospitality","Art. 13, Art. 25, Art. 5(1)(a)","Accountability, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10226120","https://www.enforcementtracker.com/ETid-3082",null,null,null,"Sole trader",null,null,null,null,null,"person",null,null,null,null],["2026/IT/012","ETid-3083","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",12000,null,"EUR","Based s.r.l.","Employment","Art. 12, Art. 13, Art. 15, Art. 17, Art. 5(1)(a)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10230220","https://www.enforcementtracker.com/ETid-3083",null,null,null,null,"based srl",null,null,null,null,null,null,null,null,null],["2026/IT/013","ETid-3084","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",5000,null,"EUR","Unleadmited S.r.l.","Media, Telecoms and Broadcasting","Art. 24, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10232061","https://www.enforcementtracker.com/ETid-3084",null,null,null,null,"unleadmited srl",null,null,null,null,null,null,null,null,null],["2026/IT/014","ETid-3085","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",15000,null,"EUR","Depurazione Acqua S.r.l.","Industry and Commerce","Art. 24, Art. 28, Art. 4, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10227081","https://www.enforcementtracker.com/ETid-3085",null,null,null,null,"depurazione acqua srl",null,null,null,null,null,null,null,null,null],["2026/IT/015","ETid-3086","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",15000,null,"EUR","Bressanelli Galli Gelpi Porta & C. S.r.l.","Finance, Insurance and Consulting","Art. 13, Art. 15, Art. 5(1)(a), Art. 6(1)(a), Art. 7","Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10227039","https://www.enforcementtracker.com/ETid-3086",null,null,null,null,"IT: bressanelli galli gelpi porta and csrl",null,null,null,null,null,null,null,null,null],["2026/IT/016","ETid-3087","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",4000,null,"EUR","Comune di Mazara del Vallo","Public Sector and Education","Art. 12(1), Art. 13, Art. 35, Art. 5(1)(a)","DPIA, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10227910","https://www.enforcementtracker.com/ETid-3087",null,null,null,null,"IT: comune di mazara del vallo",null,null,null,null,null,null,null,null,null],["2026/IT/017","ETid-3088","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",1000,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10225110","https://www.enforcementtracker.com/ETid-3088",null,null,null,"Sole trader",null,null,null,null,null,"person",null,null,null,null],["2026/IT/018","ETid-3089","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",30000,null,"EUR","Sportitalia Società Sportiva Dilettantistica a.r.l.","Industry and Commerce","Art. 12(3), Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10224627","https://www.enforcementtracker.com/ETid-3089","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10224627","gdprhub",null,null,"IT: sportitalia societa sportiva dilettantistica arl",null,null,null,null,null,null,null,null,null],["2026/IT/019","ETid-3090","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",15000,null,"EUR","Lex Iuris S.r.l.","Public Sector and Education","Art. 15, Art. 6(1)(a)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10225019","https://www.enforcementtracker.com/ETid-3090",null,null,null,null,"lex iuris srl",null,null,null,null,null,null,null,null,null],["2026/IT/020","ETid-3091","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-02-12","day",2000,null,"EUR",null,"Accommodation and Hospitality","Art. 13, Art. 6, Art. 88","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10226658","https://www.enforcementtracker.com/ETid-3091",null,null,null,"Sole trader",null,null,null,null,null,"person",null,null,null,null],["2026/GR/002","ETid-3106","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-02-11","day",30000,null,"EUR","Vodafone – PANAFON A.E.E.T.","Media, Telecoms and Broadcasting","Art. 15, Art. 18","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2026-02/2_2026%20anonym_0.pdf","https://www.enforcementtracker.com/ETid-3106","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_2/2026","gdprhub",null,null,"GR: vodafone panafon aeet","Vodafone",null,null,null,null,null,null,null,null],["2026/BE/012","APD/GBA (Belgium) - 28/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-02-10","day",null,null,null,null,null,"Art. 15(1)","Data subject rights",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-28-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_28/2026",null,"gdprhub",null,"Laundry company",null,null,null,null,null,null,null,null,null,null],["2026/PL/005","ETid-3064","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-02-10","day",5220,null,"EUR","Fundację Lumus","Individuals and Private Associations","Art. 33(1), Art. 34(1), Art. 37(7), Art. 38(6)","Data breach, Data principles, Data protection officer","Non-compliance with general data processing principles","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_15/content?query=","https://www.enforcementtracker.com/ETid-3064",null,null,null,null,"PL: fundacje lumus",null,null,null,null,null,null,null,null,null],["2026/ES/012","ETid-3056","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-02-06","day",1800,null,"EUR","Landlord","Accommodation and Hospitality","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00484-2025.pdf","https://www.enforcementtracker.com/ETid-3056",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/LT/008","VDAI (Lithuania) - Nr. 3R-219 (2.13-1.E)","gdprhub","Lithuania","LT","VDAI (Lithuania)","2026-02-06","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 15, Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(d), Art. 5(1)(f)","Data principles, Data subject rights, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1770722929/1274/2026-02-06%20Sprendimas%20Nr.%203R-219%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_Nr._3R-219_%282.13-1.E%29",null,"gdprhub",null,"Travel company",null,null,null,null,null,null,null,null,null,null],["2026/BE/011","APD/GBA (Belgium) - 25/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-02-05","day",null,null,null,"FPS Finances Belgium",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-25-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_25/2026",null,"gdprhub",null,null,"BE: fps finances belgium",null,null,null,null,null,null,null,null,null],["2026/RO/007","ETid-3029","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-02-05","day",20000,null,"EUR","Tensa Art Design S.A","Industry and Commerce","Art. 83(5)(e)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_05_02_2026","https://www.enforcementtracker.com/ETid-3029",null,null,null,null,"tensa art design sa",null,null,null,null,null,null,null,null,null],["2026/GB/001","ETid-3030","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2026-02-05","day",284450,null,"EUR","MediaLab.AI, Inc.","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/imgur-owner-medialab-fined-over-children-s-privacy-failures/","https://www.enforcementtracker.com/ETid-3030",null,null,null,null,"medialab ai inc",null,null,null,null,null,null,null,null,null],["2026/PL/004","ETid-3063","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-02-05","day",2682000,null,"EUR","DPD Polska sp. z o.o.","Transportation and Energy","Art. 29",null,"Insufficient data processing agreement","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2023:dkn_5112_1/content?query=","https://www.enforcementtracker.com/ETid-3063",null,null,null,null,"dpd polska spzoo",null,null,null,null,null,null,null,null,null],["2026/HU/004","ETid-3183","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-02-05","day",4200,null,"EUR","Obuda University","Public Sector and Education","Art. 6(1), Art. 9(2)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=1444:kollegiumi-felveteli-eljaras-adatkezelese","https://www.enforcementtracker.com/ETid-3183",null,null,null,null,"HU: obuda university",null,null,null,null,null,null,null,null,null],["2026/IS/001","Persónuvernd (Island) - 2025041148","gdprhub","Iceland","IS","Persónuvernd (Island)","2026-02-05","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/vinnsla-stettarfelags-a-upplysingum-um-idgjaldagreidslur-kvartanda-i-thagu-kjaravidraedna-5-2-2026","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2025041148",null,"gdprhub",null,"Trade union",null,null,null,null,null,null,null,null,null,null],["2026/RO/006","ETid-3028","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-02-04","day",10000,null,"EUR","GENPACT ROMANIA SRL","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_04_02_2026&lang=ro","https://www.enforcementtracker.com/ETid-3028",null,null,null,null,"genpact romania srl",null,null,null,null,null,null,null,null,null],["2026/GB/005","ICO (UK) - MediaLab.AI, Inc","gdprhub","United Kingdom","GB","ICO (UK)","2026-02-04","day",null,"247,590","GBP","MediaLab.AI, Inc",null,null,null,null,"Violation found","https://ico.org.uk/media2/bghpp40j/medialab-penalty-notice-20260204.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_MediaLab.AI%2C_Inc",null,"gdprhub",null,null,"medialab ai inc",null,247590.0,287361,"day 2026-02-04|0.8616|GBP",null,null,null,null,null],["2026/HU/010","NAIH (Hungary) - 4094-1/2026","gdprhub","Hungary","HU","NAIH (Hungary)","2026-02-04","day",null,null,null,null,null,"Art. 5(1)(c), Art. 58(2)(d), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_4094-1/2026",null,"gdprhub",null,"Guardianship authority",null,null,null,null,null,null,null,null,null,null],["2026/RO/001","ETid-3015","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-02-03","day",1000,null,"EUR","Alliance for the Union of Romanians (AUR) Party","Individuals and Private Associations","Art. 15, Art. 17, Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_03_02_2026","https://www.enforcementtracker.com/ETid-3015",null,null,null,null,"RO: alliance for the union of romanians party",null,null,null,null,null,null,null,null,null],["2026/NL/001","ETid-3032","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Delft","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3032",null,null,null,null,"NL: municipality of delft",null,null,null,null,null,null,null,null,null],["2026/NL/002","ETid-3033","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Ede","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3033",null,null,null,null,"NL: municipality of ede",null,null,null,null,null,null,null,null,null],["2026/NL/003","ETid-3034","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Eindhoven","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3034",null,null,null,null,"NL: municipality of eindhoven",null,null,null,null,null,null,null,null,null],["2026/NL/004","ETid-3035","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Gooise Meren","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3035",null,null,null,null,"NL: municipality of gooise meren",null,null,null,null,null,null,null,null,null],["2026/NL/005","ETid-3036","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Haarlemmermeer","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3036",null,null,null,null,"NL: municipality of haarlemmermeer",null,null,null,null,null,null,null,null,null],["2026/NL/006","ETid-3037","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Hilversum","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3037",null,null,null,null,"NL: municipality of hilversum",null,null,null,null,null,null,null,null,null],["2026/NL/007","ETid-3038","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Huizen","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3038",null,null,null,null,"NL: municipality of huizen",null,null,null,null,null,null,null,null,null],["2026/NL/008","ETid-3039","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Tilburg","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3039",null,null,null,null,"NL: municipality of tilburg",null,null,null,null,null,null,null,null,null],["2026/NL/009","ETid-3040","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Veenendaal","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3040",null,null,null,null,"NL: municipality of veenendaal",null,null,null,null,null,null,null,null,null],["2026/NL/010","ETid-3041","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2026-02-03","day",25000,null,"EUR","Municipality of Zoetermeer","Public Sector and Education","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/system/files?file=2026-02/boetebesluiten-10-nederlandse-gemeenten-illegaal-verwerken-informatie-islamitische-mensen.pdf","https://www.enforcementtracker.com/ETid-3041",null,null,null,null,"NL: municipality of zoetermeer",null,null,null,null,null,null,null,null,null],["2026/ES/011","ETid-3055","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-02-03","day",10000,null,"EUR","FREE TECHNOLOGIES EXCOM, S.L.","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00493-2024.pdf","https://www.enforcementtracker.com/ETid-3055",null,null,null,null,"free technologies excom sl",null,null,null,null,null,null,null,null,null],["2026/FI/002","Tietosuojavaltuutetun toimisto (Finland) - TSV/258/2022","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2026-02-03","day",null,null,null,"Wolt",null,"Art. 12(2), Art. 12(4), Art. 12(6)","Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2026/2","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/258/2022",null,"gdprhub",null,null,"FI: wolt",null,null,null,null,null,null,null,null,null],["2026/BE/010","APD/GBA (Belgium) - 23/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-02-02","day",null,null,null,null,null,"Art. 12, Art. 17(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-23-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_23/2026",null,"gdprhub",null,"Landlord",null,null,null,null,null,"person",null,null,null,null],["2026/RO/002","ETid-3014","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-01-30","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 10, Art. 13, Art. 14, Art. 17(1), Art. 5, Art. 58(1), Art. 6, Art. 9","Data principles, Data subject rights, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_30.01.2026","https://www.enforcementtracker.com/ETid-3014",null,null,null,"Natural person",null,null,null,null,null,"person",null,null,null,null],["2026/HU/003","ETid-3182","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2026-01-30","day",4200,null,"EUR","Hungarian University of Agriculture and Life Sciences","Public Sector and Education","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=1445:kollegiumi-felveteli-eljaras-adatkezelese","https://www.enforcementtracker.com/ETid-3182",null,null,null,null,"HU: hungarian university of agriculture and life sciences",null,null,null,null,null,null,null,null,null],["2026/HU/008","NAIH (Hungary) - NAIH-3344-1/2026","gdprhub","Hungary","HU","NAIH (Hungary)","2026-01-30","day",null,"1,500,000","HUF",null,null,"Art. 13, Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-3344-1/2026",null,"gdprhub",null,"Hungarian University",null,null,1500000.0,3940,"day 2026-01-30|380.7000|HUF",null,null,null,null,null],["2026/DK/001","Datatilsynet (Denmark) - 2025-431-0053","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2026-01-29","day",null,null,null,"Danish Municipalities",null,"Art. 24, Art. 28, Art. 5, Art. 6","Accountability, Data principles, Processor obligations, Unlawful processing",null,"Other Outcome","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2026/jan/datatilsynet-giver-51-kommuner-alvorlig-kritik-i-chromebook-sag","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2025-431-0053",null,"gdprhub",null,null,"DK: danish municipalities",null,null,null,null,null,null,null,null,null],["2026/IT/001","ETid-3059","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-01-29","day",5000,null,"EUR",null,"Health Care","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10220271","https://www.enforcementtracker.com/ETid-3059","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10220271","gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2026/IT/002","ETid-3060","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-01-29","day",2000,null,"EUR","Federazione Nazionale Ordini Professioni Infermieristiche (FNOPI)","Individuals and Private Associations","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10223803","https://www.enforcementtracker.com/ETid-3060",null,null,null,null,"IT: federazione nazionale ordini professioni infermieristiche",null,null,null,null,null,null,null,null,null],["2026/IT/003","ETid-3061","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-01-29","day",10000,null,"EUR","Istituto tecnico industriale statale “Stanislao Cannizzaro” di Catania","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10221968","https://www.enforcementtracker.com/ETid-3061",null,null,null,null,"IT: istituto tecnico industriale statale stanislao cannizzaro di catania",null,null,null,null,null,null,null,null,null],["2026/IT/004","ETid-3062","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-01-29","day",12000,null,"EUR","Istituto San Giuseppe La Salle di Milano","Public Sector and Education","Art. 12(1), Art. 13(1), Art. 35, Art. 6, Art. 88","DPIA, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10222864","https://www.enforcementtracker.com/ETid-3062",null,null,null,null,"IT: istituto san giuseppe la salle di milano",null,null,null,null,null,null,null,null,null],["2026/IT/005","ETid-3076","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-01-29","day",50000,null,"EUR","Università Telematica e-Campus","Public Sector and Education","Art. 25, Art. 9(1)(g)","Accountability, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10221611","https://www.enforcementtracker.com/ETid-3076",null,null,null,null,"IT: universita telematica e campus",null,null,null,null,null,null,null,null,null],["2026/IT/006","ETid-3077","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2026-01-29","day",12000,null,"EUR","Ministero della Cultura","Employment","Art. 12(1), Art. 13, Art. 35, Art. 5(1)(a), Art. 6, Art. 88(1)","DPIA, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10226639","https://www.enforcementtracker.com/ETid-3077",null,null,null,null,"IT: ministero della cultura",null,null,null,null,null,null,null,null,null],["2026/AT/011","DSB (Austria) - DSB-D124.0850/25","gdprhub","Austria","AT","DSB (Austria)","2026-01-28","day",null,null,null,null,null,"Art. 9(2)(f), Art. 9(2)(g)","Special categories",null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260128_2025_0_931_163_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.0850/25",null,"gdprhub",null,null,null,null,null,null,null,null,"appealed","Not final: the complainant appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260128_2025_0_931_163_00",null],["2026/BE/008","APD/GBA (Belgium) - 10/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-01-27","day",null,null,null,null,null,"Art. 24(1), Art. 5(2), Art. 6(1)","Accountability, Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-10-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_10/2026",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2026/BE/009","APD/GBA (Belgium) - 11/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-01-27","day",null,null,null,null,null,"Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-11-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_11/2026",null,"gdprhub",null,"Football club",null,null,null,null,null,null,null,null,null,null],["2026/SE/001","ETid-3027","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2026-01-26","day",565000,null,"EUR","Sportadmin i Skandinavien AB","Industry and Commerce","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/tillsynsskrivelser/2026/beslut-efter-tillsyn-enligt-gdpr_sportadmin-i-skandinavien-ab.pdf","https://www.enforcementtracker.com/ETid-3027","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2025-7801","gdprhub",null,null,"sportadmin i skandinavien ab",null,null,null,null,null,null,null,null,null],["2026/AT/004","DSB (Austria) - 2026-0.028.647","gdprhub","Austria","AT","DSB (Austria)","2026-01-22","day",null,null,null,null,null,"Art. 2(2)",null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260122_2026_0_028_647_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2026-0.028.647",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2026/FR/001","ETid-3026","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2026-01-22","day",5000000,null,"EUR","FRANCE TRAVAIL","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053408671","https://www.enforcementtracker.com/ETid-3026","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN%E2%80%932026-003","gdprhub",null,null,"FR: france travail",null,null,null,null,null,null,null,null,null],["2026/AT/003","DSB (Austria) - D135.026 2025-0.768.263","gdprhub","Austria","AT","DSB (Austria)","2026-01-21","day",null,null,null,"Microsoft Corporation",null,"Art. 28(3), Art. 5(1)(a), Art. 6","Data principles, Processor obligations, Unlawful processing",null,"Violation found","https://noyb.eu/sites/default/files/2026-01/Standarderledigung%20Bescheid_geschw%C3%A4rzt.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D135.026_2025-0.768.263",null,"gdprhub",null,null,"microsoft corp","Microsoft",null,null,null,null,null,null,null,null],["2026/SI/002","ETid-3108","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2026-01-20","day",4850,null,"EUR",null,null,"Art. 25","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_139_2025_9.docx","https://www.enforcementtracker.com/ETid-3108",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/AT/008","DSB (Austria) - 2025-1.049.138","gdprhub","Austria","AT","DSB (Austria)","2026-01-19","day",25500,"25500.0","EUR",null,null,"Art. 12, Art. 13, Art. 13(1)(d), Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(e), Art. 6(1)(a), Art. 6(1)(f)","Data principles, Transparency, Unlawful processing",null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260119_2025_1_049_138_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-1.049.138",null,"gdprhub",null,"Digital marketing agency",null,null,null,null,null,null,"appealed","Not final: the fined party appealed to the Federal Administrative Court (BVwG), only against the amount; the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260119_2025_1_049_138_00",25500],["2026/RO/003","ETid-2997","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-01-19","day",15000,null,"EUR","Continental Automotive Products SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_19_01_2026","https://www.enforcementtracker.com/ETid-2997",null,null,null,null,"continental automotive products srl",null,null,null,null,null,null,null,null,null],["2026/ES/010","ETid-3054","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-01-19","day",1200,null,"EUR","Dental Clinic","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00463-2025.pdf","https://www.enforcementtracker.com/ETid-3054",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2026/ES/035","AEPD (Spain) - EXP202404507","gdprhub","Spain","ES","AEPD (Spain)","2026-01-16","day",400000,"400000","EUR","UNICAJA BANCO, S.A.",null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.aepd.es/documento/ps-00441-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202404507",null,"gdprhub",null,null,"unicaja banco sa",null,null,null,null,null,null,null,null,null],["2026/AT/007","DSB (Austria) - 2026-0.043.390","gdprhub","Austria","AT","DSB (Austria)","2026-01-16","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 5(1)(a)","Data principles, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260116_2026_0_043_390_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2026-0.043.390",null,"gdprhub",null,"Provider of an online shop",null,null,null,null,null,null,null,null,null,null],["2026/NO/001","ETid-3000","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2026-01-16","day",21650,null,"EUR","Timegrip AS","Employment",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.datatilsynet.no/contentassets/fd51778709a14285a13d4cca9fc481f6/20206-01-16-vedtak---timegrip-offentlig-versjon.pdf","https://www.enforcementtracker.com/ETid-3000","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02911-20","gdprhub",null,null,"timegrip as",null,null,null,null,null,null,null,null,null],["2026/GB/004","ICO (UK) - Allay Claims Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2026-01-15","day",null,"120,000","GBP","Allay Claims Ltd",null,null,null,null,"Violation found","https://ico.org.uk/media2/mrwhxwoe/monetary-penalty-notice-allay-claims-ltd.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Allay_Claims_Ltd",null,"gdprhub",null,null,"allay claims ltd",null,120000.0,138344,"day 2026-01-15|0.8674|GBP",null,null,null,null,null],["2026/RO/004","ETid-2996","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-01-13","day",8000,null,"EUR","PREMIER RESTAURANTS ROMANIA SRL","Accommodation and Hospitality","Art. 28(1)","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_13_01_2026","https://www.enforcementtracker.com/ETid-2996",null,null,null,null,"premier restaurants romania srl",null,null,null,null,null,null,null,null,null],["2026/AT/002","ETid-3222","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2026-01-12","day",200,null,"EUR","Medical Student","Individuals and Private Associations","Art. 6(1)(f), Art. 9(2)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260112_2026_0_016_479_00","https://www.enforcementtracker.com/ETid-3222","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2026-0.016.479","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2026/ES/008","ETid-3052","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-01-10","day",8000,null,"EUR","KVIKU SPAIN, S.L.","Finance, Insurance and Consulting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00476-2024.pdf","https://www.enforcementtracker.com/ETid-3052","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202410843","gdprhub",null,null,"kviku spain sl",null,null,null,null,null,null,null,null,null],["2026/ES/009","ETid-3053","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2026-01-10","day",500,null,"EUR","VOX ESPAÑA","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00255-2024.pdf","https://www.enforcementtracker.com/ETid-3053","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202406574","gdprhub",null,null,"ES: vox espana",null,null,null,null,null,null,null,null,null],["2026/AT/010","DSB (Austria) - DSB-D124.2437/25","gdprhub","Austria","AT","DSB (Austria)","2026-01-09","day",null,null,null,"Verein N***-Therapie",null,"Art. 15(1), Art. 2, Art. 22, Art. 31, Art. 4(1), Art. 4(2), Art. 4(6), Art. 51(1), Art. 57(1)(f), Art. 58(2)(c), Art. 77(1)","Data subject rights",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20260109_2026_0_018_391_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.2437/25",null,"gdprhub",null,null,"AT: verein n therapie",null,null,null,null,null,null,null,null,null],["2026/PL/001","ETid-2982","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-01-09","day",18500,null,"EUR","Komendanta Miejskiego Policji w Krakowie","Public Sector and Education",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://uodo.gov.pl/pl/138/4030","https://www.enforcementtracker.com/ETid-2982",null,null,null,null,"PL: komendanta miejskiego policji w krakowie",null,null,null,null,null,null,null,null,null],["2026/RO/005","ETid-2985","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2026-01-08","day",2000,null,"EUR","Money Seeds S.R.L.","Finance, Insurance and Consulting","Art. 12, Art. 13, Art. 14","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_08_01_2026","https://www.enforcementtracker.com/ETid-2985",null,null,null,null,"money seeds srl",null,null,null,null,null,null,null,null,null],["2026/FR/003","ETid-2993","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2026-01-08","day",27000000,null,"EUR","FREE MOBILE","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(e)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053352664","https://www.enforcementtracker.com/ETid-2993","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2026-001","gdprhub",null,null,"FR: free mobile","Free (Iliad)",null,null,null,null,null,null,null,null],["2026/FR/002","ETid-2994","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2026-01-08","day",15000000,null,"EUR","FREE","Media, Telecoms and Broadcasting","Art. 32, Art. 34","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053352643","https://www.enforcementtracker.com/ETid-2994","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2026-002","gdprhub",null,null,"FR: free","Free (Iliad)",null,null,null,null,null,null,null,null],["2026/GR/001","ETid-2999","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2026-01-08","day",10000,null,"EUR","Headquarter of a Fire Brigade","Employment",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2026-01/1_2026%20anonym.pdf","https://www.enforcementtracker.com/ETid-2999","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_1/2026","gdprhub",null,null,"GR: headquarter of a fire brigade",null,null,null,null,null,null,null,null,null],["2026/BE/007","APD/GBA (Belgium) - 01/2026","gdprhub","Belgium","BE","APD/GBA (Belgium)","2026-01-06","day",null,null,null,null,null,"Art. 15, Art. 17(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-01-2026.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_01/2026",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2026/SI/001","ETid-3107","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2026-01-06","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_93_2025_15.docx","https://www.enforcementtracker.com/ETid-3107",null,null,null,"Sole trader",null,null,null,null,null,"person",null,null,null,null],["2026/HR/002","AZOP (Croatia) - 05/01/2026","gdprhub","Croatia","HR","AZOP (Croatia)","2026-01-05","day",6636,"6,636.14","EUR",null,null,"Art. 13, Art. 5(1)","Data principles, Transparency",null,"Violation found","https://azop.hr/wp-content/uploads/2026/02/Rjesenje-UNK-anonimizirano-videonadzor.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_05/01/2026",null,"gdprhub",null,"Retailer",null,null,null,null,null,null,null,null,null,null],["2026/PL/003","ETid-3031","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2026-01-02","day",232379,null,"EUR","Polish Postal Service","Public Sector and Education",null,"Data protection officer","Lack of appointment of data protection officer","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_4/content?query=","https://www.enforcementtracker.com/ETid-3031",null,null,null,null,"PL: polish postal service",null,null,null,null,null,null,null,null,null],["2026/PL/012","UODO (Poland) - DKN.5131.4.2025","gdprhub","Poland","PL","UODO (Poland)","2026-01-02","day",null,"978128","PLN","Poczta Polska (Polish Post)",null,"Art. 38(3), Art. 38(6)","Data protection officer",null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_4","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.4.2025",null,"gdprhub",null,null,"PL: poczta polska",null,978128.0,232208,"day 2026-01-02|4.2123|PLN",null,null,null,null,null],["2026/SI/008","ETid-3289","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2026","year",1282,null,"EUR","Unknown legal entity",null,"Art. 28(3)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fzip%2FPonovna_uporaba%2F2026%2FJunij%2F0609-41-2026-7.docx","https://www.enforcementtracker.com/ETid-3289","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0609-41/2026/7","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/GR/004","ETid-3016","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-12-31","day",10000,null,"EUR","Thessaloniki–Thessaly Gas Supply Company S.A.","Transportation and Energy","Art. 28(3)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.dpa.gr/sites/default/files/2026-01/44_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-3016",null,null,null,null,"thessalonikithessaly gas supply company sa",null,null,null,null,null,null,null,null,null],["2025/GR/003","ETid-3017","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-12-31","day",80000,null,"EUR","ONE WAY PRIVATE COMPANY","Media, Telecoms and Broadcasting","Art. 29, Art. 32, Art. 5, Art. 6, Art. 7","Consent, Data principles, Data security, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2026-01/44_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-3017",null,null,null,null,"GR: one way private company",null,null,null,null,null,null,null,null,null],["2025/GR/002","ETid-3018","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-12-31","day",10000,null,"EUR","SIGMA & KAPPA IMPORTING SOCIÉTÉ ANONYME","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2026-01/44_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-3018",null,null,null,null,"GR: sigma and kappa importing societe anonyme",null,null,null,null,null,null,null,null,null],["2025/GR/001","ETid-3019","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-12-31","day",5000,null,"EUR","REVMA PLUS Retail S.A.","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2026-01/44_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-3019",null,null,null,null,"revma plus retail sa",null,null,null,null,null,null,null,null,null],["2025/GR/017","ETid-3105","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-12-31","day",6000,null,"EUR","I Mathisi","Public Sector and Education","Art. 15(1), Art. 31","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2026-03/39_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-3105",null,null,null,null,"GR: i mathisi",null,null,null,null,null,null,null,null,null],["2025/GR/032","HDPA (Greece) - 44/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-12-31","day",null,null,null,"ZENITH",null,"Art. 32, Art. 5, Art. 6(1)(f)","Data principles, Data security, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2026-01/44_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_44/2025",null,"gdprhub",null,null,"GR: zenith",null,null,null,null,null,null,null,null,null],["2025/RO/077","ANSPDCP (Romania) - 30.12.2025","gdprhub","Romania","RO","ANSPDCP (Romania)","2025-12-30","day",null,"50,920","RON","Roumasport SRL",null,"Art. 24(1), Art. 32(1)(b), Art. 32(2)","Accountability, Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_30.12.2025&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_30.12.2025",null,"gdprhub",null,null,"roumasport srl",null,50920.0,9990,"day 2025-12-30|5.0969|RON",null,null,null,null,null],["2025/RO/001","ETid-2984","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-12-30","day",10000,null,"EUR","Roumasport S.R.L","Industry and Commerce","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_30.12.2025","https://www.enforcementtracker.com/ETid-2984",null,null,null,null,"roumasport srl",null,null,null,null,null,null,null,null,null],["2025/FR/001","ETid-2998","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-12-30","day",3500000,null,"EUR","Company","Industry and Commerce","Art. 13, Art. 32, Art. 35, Art. 6(1)(a)","DPIA, Data principles, Data security, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053391342","https://www.enforcementtracker.com/ETid-2998","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-017","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/LT/012","VDAI (Lithuania) - 3R- 1876 (2.13-1.E)","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-12-30","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)(f), Art. 9(2)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://vdai.lrv.lt/public/canonical/1767704989/1218/2025-12-30%20sprendimas%20Nr.%203R-1876%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-_1876_%282.13-1.E%29",null,"gdprhub",null,"Hospital",null,null,null,null,null,null,null,null,null,null],["2025/RO/002","ETid-2983","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-12-29","day",2000,null,"EUR","Order of General Nurses, Midwives and Medical Assistants of Romania – Neamt Branch","Employment","Art. 12, Art. 13, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_29_12_2025","https://www.enforcementtracker.com/ETid-2983",null,null,null,null,"RO: order of general nurses midwives and medical assistants of romania neamt branch",null,null,null,null,null,null,null,null,null],["2025/ES/002","ETid-2991","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-29","day",1600,null,"EUR","NAROBESA INV, S.L.","Finance, Insurance and Consulting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00076-2025.pdf","https://www.enforcementtracker.com/ETid-2991",null,null,null,null,"narobesa inv sl",null,null,null,null,null,null,null,null,null],["2025/IT/014","ETid-2957","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-23","day",6000,null,"EUR","Geturhotels Srl","Accommodation and Hospitality","Art. 17, Art. 24, Art. 5(1)(e), Art. 6(1)(a)","Accountability, Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10199166","https://www.enforcementtracker.com/ETid-2957",null,null,null,null,"geturhotels srl",null,null,null,null,null,null,null,null,null],["2025/FR/003","ETid-2978","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-12-22","day",1700000,null,"EUR","NEXPUBLICA FRANCE","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053151799","https://www.enforcementtracker.com/ETid-2978","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-015","gdprhub",null,null,"FR: nexpublica france",null,null,null,null,null,null,null,null,null],["2025/ES/003","ETid-2990","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-22","day",500000,null,"EUR","CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.","Transportation and Energy","Art. 25","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00190-2024.pdf","https://www.enforcementtracker.com/ETid-2990",null,null,null,null,"curenergia comercializador de ultimo recurso sau",null,null,null,null,null,null,null,null,null],["2025/ES/007","ETid-2986","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-20","day",300,null,"EUR",null,null,"Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00549-2024.pdf","https://www.enforcementtracker.com/ETid-2986",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/006","ETid-2987","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-20","day",6000,null,"EUR","BLUE TEAM FLIGHT SCHOOL, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00063-2025.pdf","https://www.enforcementtracker.com/ETid-2987",null,null,null,null,"blue team flight school sl",null,null,null,null,null,null,null,null,null],["2025/ES/005","ETid-2988","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-20","day",32000,null,"EUR","EXCEL HOTELS & RESORTS, S.A.","Accommodation and Hospitality","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00077-2024.pdf","https://www.enforcementtracker.com/ETid-2988",null,null,null,null,"excel hotels and resorts sa",null,null,null,null,null,null,null,null,null],["2025/ES/004","ETid-2989","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-20","day",600,null,"EUR","4USPORT INSTALACIONES DEPORTIVAS, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00077-2025.pdf","https://www.enforcementtracker.com/ETid-2989",null,null,null,null,"4usport instalaciones deportivas sl",null,null,null,null,null,null,null,null,null],["2025/BE/030","APD/GBA (Belgium) - 209/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-12-18","day",null,null,null,null,null,"Art. 24, Art. 32, Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-209-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_209/2025",null,"gdprhub",null,"Hospital",null,null,null,null,null,null,null,null,null,null],["2025/IT/003","ETid-3023","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-18","day",6000,null,"EUR","Comune di Nave","Public Sector and Education","Art. 13, Art. 35, Art. 5(1)(a)","DPIA, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10213486","https://www.enforcementtracker.com/ETid-3023",null,null,null,null,"IT: comune di nave",null,null,null,null,null,null,null,null,null],["2025/IT/002","ETid-3024","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-18","day",2000,null,"EUR","Elba Catering Distribuzioni s.r.I.s.","Industry and Commerce","Art. 13","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10211799","https://www.enforcementtracker.com/ETid-3024",null,null,null,null,"IT: elba catering distribuzioni sris",null,null,null,null,null,null,null,null,null],["2025/IT/001","ETid-3025","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-18","day",1000,null,"EUR","Data Controller",null,"Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10210431","https://www.enforcementtracker.com/ETid-3025",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/078","ETid-3043","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-18","day",120000,null,"EUR","Pioneer Hi-Bred Italia Sementi s.r.l.","Employment","Art. 28, Art. 6(1)(f)","Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10213711","https://www.enforcementtracker.com/ETid-3043","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10213711","gdprhub",null,null,"pioneer hi bred italia sementi srl",null,null,null,null,null,null,null,null,null],["2025/IT/079","ETid-3044","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-18","day",40000,null,"EUR","Anticimex s.r.l.","Employment","Art. 12, Art. 13, Art. 15, Art. 88","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10216459","https://www.enforcementtracker.com/ETid-3044",null,null,null,null,"anticimex srl",null,null,null,null,null,null,null,null,null],["2025/IT/080","ETid-3045","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-18","day",40000,null,"EUR","LTL S.p.A.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10213574","https://www.enforcementtracker.com/ETid-3045",null,null,null,null,"ltl spa",null,null,null,null,null,null,null,null,null],["2025/HR/014","ETid-3102","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-12-18","day",1500000,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 12, Art. 13, Art. 25(2), Art. 6(1)","Accountability, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://azop.hr/banci-izrecena-upravna-novcana-kazna-u-iznosu-od-15-milijuna-eura/","https://www.enforcementtracker.com/ETid-3102",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/133","Garante per la protezione dei dati personali (Italy) - 10211780","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-12-18","day",null,null,null,"Jaguar Land Rover Italia S.p.A",null,"Art. 12, Art. 13, Art. 14, Art. 24, Art. 25, Art. 26, Art. 4(11), Art. 5, Art. 5(2), Art. 57(1)(u), Art. 58(2)(b), Art. 58(2)(d), Art. 7","Accountability, Consent, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10211780","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10211780",null,"gdprhub",null,null,"jaguar land rover italia spa",null,null,null,null,null,null,null,null,null],["2025/ES/187","AEPD (Spain) - EXP202306737","gdprhub","Spain","ES","AEPD (Spain)","2025-12-17","day",30000,"30,000","EUR","GAOLANIA SERVICIOS, S.L.",null,"Art. 5(1)(d), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00502-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202306737",null,"gdprhub",null,null,"gaolania servicios sl",null,null,null,null,null,null,null,null,null],["2025/GR/034","HDPA (Greece) - 39/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-12-17","day",4000,"4,000","EUR",null,null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 31, Art. 58(2)(c)","Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-gia-mi-antapokrisi-se-dikaioma-prosbasis-gia","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_39/2025",null,"gdprhub",null,"Private tutoring centre",null,null,null,null,null,null,null,null,null,null],["2025/GB/018","ICO (UK) - Staines Health Group","gdprhub","United Kingdom","GB","ICO (UK)","2025-12-16","day",null,null,null,"Staines Health Group",null,null,null,null,"Violation found","https://ico.org.uk/media2/ydzp0vgm/20251216-staines-health-group-reprimand.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Staines_Health_Group",null,"gdprhub",null,null,"GB: staines health group",null,null,null,null,null,null,null,null,null],["2025/AT/021","DSB (Austria) - 2025-0.395.497","gdprhub","Austria","AT","DSB (Austria)","2025-12-15","day",null,null,null,null,null,"Art. 15","Data subject rights",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251215_2025_0_395_497_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.395.497",null,"gdprhub",null,"Bar association",null,null,null,null,null,null,"appealed","Not final: the complainant appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251215_2025_0_395_497_00",null],["2025/NL/002","ETid-2980","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2025-12-15","day",175000,null,"EUR","Arnhem and Nijmegen University of Applied Sciences","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.autoriteitpersoonsgegevens.nl/actueel/han-krijgt-boete-van-175000-euro-voor-onvoldoende-beveiliging-van-persoonsgegevens","https://www.enforcementtracker.com/ETid-2980",null,null,null,null,"NL: arnhem and nijmegen university of applied sciences",null,null,null,null,null,null,null,null,null],["2025/GB/009","ETid-3075","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-12-12","day",75700,null,"EUR","Chief Constable of the Police Service of Scotland","Public Sector and Education","Art. 32(1), Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/b1kcsxom/police-scotland-reprimand-and-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-3075",null,null,null,null,"GB: chief constable of the police service of scotland",null,null,null,null,null,null,null,null,null],["2025/FR/002","ETid-2995","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-12-11","day",1000000,null,"EUR","MOBIUS SOLUTIONS LTD","Industry and Commerce","Art. 28, Art. 29, Art. 30","Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000053048614","https://www.enforcementtracker.com/ETid-2995","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-014","gdprhub",null,null,"mobius solutions ltd",null,null,null,null,null,null,null,null,null],["2025/SI/001","ETid-3012","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-12-11","day",75474,null,"EUR","RIEDL PRECISION d.o.o.","Employment","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_102_2025_10_odlo%C4%8Dba+o+prekr%C5%A1ku_5_6+SUVP_10122025.docx","https://www.enforcementtracker.com/ETid-3012",null,null,null,null,"riedl precision doo",null,null,null,null,null,null,null,null,null],["2025/GB/017","ICO (UK) - ZMLUK Limited","gdprhub","United Kingdom","GB","ICO (UK)","2025-12-11","day",null,"105,000","GBP","ZMLUK Limited",null,null,null,null,"Violation found","https://ico.org.uk/media2/ltodxokk/monetary-penalty-notice-zmluk-ltd.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_ZMLUK_Limited",null,"gdprhub",null,null,"zmluk ltd",null,105000.0,119986,"day 2025-12-11|0.8751|GBP",null,null,null,null,null],["2025/RO/003","ETid-2971","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-12-10","day",15000,null,"EUR","Crowd Entertainment Limited","Media, Telecoms and Broadcasting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_10.12.2025","https://www.enforcementtracker.com/ETid-2971",null,null,null,null,"crowd entertainment ltd",null,null,null,null,null,null,null,null,null],["2025/IE/004","ETid-3067","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2025-12-10","day",98000,null,"EUR","University of Limerick","Public Sector and Education","Art. 30(1), Art. 32(1), Art. 33(1), Art. 34(1), Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2026-02/20251210_UL_FD_IN-19-7-1.pdf","https://www.enforcementtracker.com/ETid-3067","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Inquiry_concerning_the_University_of_Limerick_%28IN-19-7-1%29","gdprhub",null,null,"IE: university of limerick",null,null,null,null,null,null,null,null,null],["2025/BE/028","APD/GBA (Belgium) - 203/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-12-08","day",null,null,null,"Service public fédéral Santé publique, Administration de l'Expertise médicale (Medex)",null,"Art. 24, Art. 32, Art. 33(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data breach, Data principles, Data security",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-203-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_203/2025",null,"gdprhub",null,null,"BE: service public federal sante publique administration de l expertise medicale",null,null,null,null,null,null,null,null,null],["2025/RO/004","ETid-2954","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-12-08","day",1000,null,"EUR","Compania de Apa Oltenia S.A.","Transportation and Energy","Art. 29, Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08_12_2025","https://www.enforcementtracker.com/ETid-2954",null,null,null,null,"compania de apa oltenia sa",null,null,null,null,null,null,null,null,null],["2025/SI/002","ETid-3011","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-12-08","day",5100,null,"EUR","Legal Entity",null,"Art. 12, Art. 13","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_112_2025_7_odlo%C4%8Dba+ZP-1_GLOBA_%C4%8Dlen+97+ZVOP-2_08122025.docx","https://www.enforcementtracker.com/ETid-3011",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/007","ETid-2992","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-04","day",2000,null,"EUR","Istituto Comprensivo Centro di Casalecchio di Reno","Employment",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10209827","https://www.enforcementtracker.com/ETid-2992",null,null,null,null,"IT: istituto comprensivo centro di casalecchio di reno",null,null,null,null,null,null,null,null,null],["2025/SI/003","ETid-3010","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-12-04","day",1300,null,"EUR","Legal Entity",null,null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_128_2025_6_odlo%C4%8Dba+ZP-1_GLOBA_%C4%8Dlen+96+ZVOP-2_01122025.docx","https://www.enforcementtracker.com/ETid-3010",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/006","ETid-3020","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-04","day",12000,null,"EUR","Comune di Tuscania","Public Sector and Education","Art. 12, Art. 13, Art. 15, Art. 28, Art. 35, Art. 5(1)(a), Art. 58(1)","DPIA, Data principles, Data subject rights, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10213467","https://www.enforcementtracker.com/ETid-3020",null,null,null,null,"IT: comune di tuscania",null,null,null,null,null,null,null,null,null],["2025/IT/005","ETid-3021","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-04","day",1000,null,"EUR","\"Principe Umberto di Savoia\" State Scientific and Linguistic High School","Employment","Art. 13, Art. 29, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10212783","https://www.enforcementtracker.com/ETid-3021",null,null,null,null,"IT: principe umberto di savoia state scientific and linguistic high school",null,null,null,null,null,null,null,null,null],["2025/IT/004","ETid-3022","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-12-04","day",1000,null,"EUR","Roverbella Comprehensive School","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10209089","https://www.enforcementtracker.com/ETid-3022","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10209089","gdprhub",null,null,"IT: roverbella comprehensive school",null,null,null,null,null,null,null,null,null],["2025/ES/189","AEPD (Spain) - PS-00456-2025","gdprhub","Spain","ES","AEPD (Spain)","2025-12-03","day",80000,"80000","EUR","MAJOREL SP SOLUTIONS, S.A",null,"Art. 4(1), Art. 4(2), Art. 4(7), Art. 4(8), Art. 5(1)(a), Art. 58(2), Art. 6, Art. 6(1), Art. 6(1)(b), Art. 83(1), Art. 83(2), Art. 83(2)(a), Art. 83(2)(b), Art. 83(2)(g), Art. 83(5), Art. 83(6)","Data principles, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00456-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00456-2025",null,"gdprhub",null,null,"majorel sp solutions sa",null,null,null,null,null,null,null,null,null],["2025/AT/034","DSB (Austria) - 2025-0.968.031","gdprhub","Austria","AT","DSB (Austria)","2025-12-03","day",null,null,null,null,null,"Art. 9(1), Art. 9(2)(e)","Special categories",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251203_2025_0_968_031_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.968.031",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2025/ES/118","ETid-3190","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-03","day",72000,null,"EUR","TIGER MEDIA INC.","Media, Telecoms and Broadcasting","Art. 27, Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00480-2025.pdf","https://www.enforcementtracker.com/ETid-3190",null,null,null,null,"tiger media inc",null,null,null,null,null,null,null,null,null],["2025/ES/194","CTPDA (Spain) - RPS-2025/082","gdprhub","Spain","ES","CTPDA (Andalusia)","2025-12-02","day",null,null,null,"Dirección General de Innovación y Formación del Profesorado",null,"Art. 13, Art. 25, Art. 30, Art. 32, Art. 35, Art. 5(1)(a), Art. 5(1)(b), Art. 6","Accountability, DPIA, Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.ctpdandalucia.es/area-de-proteccion-de-datos/resoluciones-mas-destacadas-consejo-materia-proteccion-datos/rps-2025082","https://gdprhub.eu/index.php?title=CTPDA_%28Spain%29_-_RPS-2025/082",null,"gdprhub",null,null,"ES: direccion general de innovacion y formacion del profesorado",null,null,null,null,null,null,null,null,null],["2025/HU/003","NAIH (Hungary) - NAIH-5209-29/2025","gdprhub","Hungary","HU","NAIH (Hungary)","2025-12-02","day",null,"1,000,000","HUF","Magyar Állam Tulajdonosainak Társulásával (MATT)",null,"Art. 13(1), Art. 13(2), Art. 5(1)(a), Art. 5(1)(b), Art. 58(1)(e), Art. 6(1), Art. 6(1)(e)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-5209-29/2025",null,"gdprhub",null,null,"HU: magyar allam tulajdonosainak tarsulasaval",null,1000000.0,2626,"day 2025-12-02|380.8300|HUF",null,null,null,null,null],["2025/ES/009","ETid-2969","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-01","day",3600,null,"EUR","RISING SUN CAR RENTAL S..L.","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00241-2025.pdf","https://www.enforcementtracker.com/ETid-2969",null,null,null,null,"rising sun car rental sl",null,null,null,null,null,null,null,null,null],["2025/ES/008","ETid-2970","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-12-01","day",3600,null,"EUR","DELAFRUIT, S.L.","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00061-2025.pdf","https://www.enforcementtracker.com/ETid-2970",null,null,null,null,"delafruit sl",null,null,null,null,null,null,null,null,null],["2025/BE/029","APD/GBA (Belgium) - 200/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-11-28","day",null,null,null,null,null,"Art. 12(2), Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(3), Art. 6(1)","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-200-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_200/2025",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2025/ES/010","ETid-2968","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-28","day",1560000,null,"EUR","SPRINTER MEGACENTROS DEL DEPORTE, S.L.","Industry and Commerce","Art. 34, Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00373-2025.pdf","https://www.enforcementtracker.com/ETid-2968","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202401683","gdprhub",null,null,"sprinter megacentros del deporte sl",null,null,null,null,null,null,null,null,null],["2025/FR/005","ETid-2947","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-11-27","day",1500000,null,"EUR","AMERICAN EXPRESS CARTE FRANCE","Finance, Insurance and Consulting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052981827","https://www.enforcementtracker.com/ETid-2947","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-011","gdprhub",null,null,"FR: american express carte france",null,null,null,null,null,null,null,null,null],["2025/BE/001","ETid-2948","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2025-11-27","day",5000,null,"EUR","Infobel","Industry and Commerce","Art. 24, Art. 5(1)(a), Art. 6(1)","Accountability, Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-199-2025.pdf","https://www.enforcementtracker.com/ETid-2948","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_199/2025","gdprhub",null,null,"BE: infobel",null,null,null,null,null,"reduced","Reduced on appeal: the Market Court cut the fine from €40,000 to €5,000 and annulled the order to delete the data (ruling of 3 June 2026).","https://www.gegevensbeschermingsautoriteit.be/publications/arrest-van-3-juni-2026-van-het-marktenhof-ar-2079.-beschikbaar-in-het-frans.pdf",40000],["2025/RO/005","ETid-2953","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-11-27","day",2000,null,"EUR","Nițu A. Cleopatra – Expert Accountant","Individuals and Private Associations",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_27_11_2025","https://www.enforcementtracker.com/ETid-2953",null,null,null,null,"RO: nitu a cleopatra expert accountant",null,null,null,null,null,null,null,null,null],["2025/IT/009","ETid-2974","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-11-27","day",400000,null,"EUR","Verisure Italy s.r.l.","Industry and Commerce","Art. 12(3), Art. 13(2)(a), Art. 17, Art. 21, Art. 5(1)(e)","Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10201989","https://www.enforcementtracker.com/ETid-2974","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10201989","gdprhub",null,null,"verisure italy srl",null,null,null,null,null,null,null,null,null],["2025/IT/008","ETid-2977","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-11-27","day",300000,null,"EUR","Aimag S.p.A.","Transportation and Energy","Art. 13, Art. 24, Art. 25, Art. 32, Art. 5(1)(e), Art. 6, Art. 7","Accountability, Consent, Data principles, Data security, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10202135","https://www.enforcementtracker.com/ETid-2977",null,null,null,null,"aimag spa",null,null,null,null,null,null,null,null,null],["2025/IT/130","Garante per la protezione dei dati personali (Italy) - 10201426","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-11-27","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 29, Art. 32, Art. 5(1)(a), Art. 5(2), Art. 9","Accountability, Data principles, Data security, Special categories, Transparency",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10201426","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10201426",null,"gdprhub",null,"University of Turin",null,null,null,null,null,null,null,null,null,null],["2025/RO/006","ETid-2952","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-11-26","day",3000,null,"EUR","Cucina di Fabio S.R.L.","Industry and Commerce","Art. 15, Art. 17, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_26.11.2025","https://www.enforcementtracker.com/ETid-2952",null,null,null,null,"cucina di fabio srl",null,null,null,null,null,null,null,null,null],["2025/SI/004","ETid-3009","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-11-26","day",6600,null,"EUR","Legal Entity","Employment","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_104_2025_18_20251126_odlo%C4%8Dba+po+ZP-1_globa.docx","https://www.enforcementtracker.com/ETid-3009",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/AT/033","DSB (Austria) - 2024-0.835.856","gdprhub","Austria","AT","DSB (Austria)","2025-11-24","day",null,null,null,null,null,"Art. 17(1), Art. 17(3)(e), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(b), Art. 6(1)(f), Art. 6(4)","Data principles, Data subject rights, Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251124_2024_0_835_856_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2024-0.835.856",null,"gdprhub",null,null,null,null,null,null,null,null,"appealed","Not final: the complainant appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251124_2024_0_835_856_00",null],["2025/AT/032","DSB (Austria) - 2025-0.950.759","gdprhub","Austria","AT","DSB (Austria)","2025-11-24","day",null,null,null,null,null,"Art. 16, Art. 17, Art. 25, Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(b), Art. 6(1)(f)","Accountability, Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251124_2025_0_950_759_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.950.759",null,"gdprhub",null,"Online store",null,null,null,null,null,null,null,null,null,null],["2025/HR/001","ETid-2937","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-11-24","day",4500000,null,"EUR","Telecommunications operator (operator of electronic communications networks and services)","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13(1)(f), Art. 28(1), Art. 44, Art. 46(1), Art. 6(1)","Data principles, International transfers, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://azop.hr/administrative-fine-of-eur-4-5-million-imposed-on-a-telecommunications-operator-14-november-2025/","https://www.enforcementtracker.com/ETid-2937","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_14-11-2025","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/011","ETid-2967","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-23","day",5000,null,"EUR","ACTIVOS INTELIGENTES, S.L.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00141-2024.pdf","https://www.enforcementtracker.com/ETid-2967",null,null,null,null,"activos inteligentes sl",null,null,null,null,null,null,null,null,null],["2025/AT/035","DSB (Austria) - DSB-D124.0531/24","gdprhub","Austria","AT","DSB (Austria)","2025-11-21","day",null,null,null,"Public Employment Service Austria and ABZ AUSTRIA",null,"Art. 12(5), Art. 12(5)(b), Art. 15(1), Art. 15(3), Art. 28(10), Art. 28(3)(e), Art. 4(10), Art. 4(7), Art. 4(8), Art. 5(1)(a), Art. 57(1)(f)","Data principles, Data subject rights, Processor obligations, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251121_2025_0_566_415_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.0531/24",null,"gdprhub",null,null,"AT: public employment service austria and abz austria",null,null,null,null,null,null,null,null,null],["2025/SI/005","ETid-3008","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-11-21","day",16650,null,"EUR","Legal Entity",null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_114_2025_9_20251121_odlo%C4%8Dba+po+ZP-1_globa.docx","https://www.enforcementtracker.com/ETid-3008",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/001","ETid-3013","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-21","day",1200000,null,"EUR","IDCQ HOSPITALES Y SANIDAD, S.L.U.","Health Care","Art. 25, Art. 6, Art. 9","Accountability, Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00288-2024.pdf","https://www.enforcementtracker.com/ETid-3013",null,null,null,null,"idcq hospitales y sanidad slu",null,null,null,null,null,null,null,null,null],["2025/AT/031","DSB (Austria) - 2025-0.875.804","gdprhub","Austria","AT","DSB (Austria)","2025-11-20","day",null,null,null,"Expert",null,"Art. 57(4), Art. 77",null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251120_2025_0_875_804_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.875.804",null,"gdprhub",null,null,"AT: expert",null,null,null,null,null,"appealed","Not final: a party appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251120_2025_0_875_804_00",null],["2025/FR/004","ETid-2951","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-11-20","day",750000,null,"EUR","LES PUBLICATIONS CONDE NAST","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052851847","https://www.enforcementtracker.com/ETid-2951","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-010","gdprhub",null,null,"FR: les publications conde nast",null,null,null,null,null,null,null,null,null],["2025/GB/001","ETid-2972","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-11-20","day",1400000,null,"EUR","LastPass UK Ltd","Industry and Commerce","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/xfbl1uaa/lastpass-uk-ltd-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-2972",null,null,null,null,"lastpass uk ltd",null,null,null,null,null,null,null,null,null],["2025/BE/025","APD/GBA (Belgium) - 188/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-11-19","day",null,null,null,null,null,"Art. 24(1), Art. 5(2)","Accountability, Data principles",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-188-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_188/2025",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2025/RO/007","ETid-2943","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-11-19","day",3000,null,"EUR","Greencorp S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_19.11.2025","https://www.enforcementtracker.com/ETid-2943",null,null,null,null,"greencorp srl",null,null,null,null,null,null,null,null,null],["2025/ES/014","ETid-2964","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-19","day",2000,null,"EUR","ASOCIACIÓN NACIONAL DE TASADORES Y PERITOS JUDICIALES INFORMÁTICOS","Individuals and Private Associations","Art. 13, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00243-2024.pdf","https://www.enforcementtracker.com/ETid-2964",null,null,null,null,"ES: asociacion nacional de tasadores y peritos judiciales informaticos",null,null,null,null,null,null,null,null,null],["2025/ES/013","ETid-2965","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-19","day",800,null,"EUR","SOBLADA RESTAURACIÓN, S.L.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00257-2023.pdf","https://www.enforcementtracker.com/ETid-2965",null,null,null,null,"soblada restauracion sl",null,null,null,null,null,null,null,null,null],["2025/ES/012","ETid-2966","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-19","day",60000,null,"EUR","STRATESYS TECHNOLOGY SOLUTIONS, S.L.","Industry and Commerce","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00312-2025.pdf","https://www.enforcementtracker.com/ETid-2966",null,null,null,null,"stratesys technology solutions sl",null,null,null,null,null,null,null,null,null],["2025/AT/004","ETid-2950","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2025-11-18","day",80,null,"EUR","Journalist","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251118_2025_0_902_556_00","https://www.enforcementtracker.com/ETid-2950","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.902.556","gdprhub",null,null,"AT: journalist",null,null,null,null,null,null,null,null,null],["2025/SE/010","IMY (Sweden) - IMY-2025-11828","gdprhub","Sweden","SE","IMY (Sweden)","2025-11-18","day",null,null,null,"Swedish Social Insurance Agency (SSIA)",null,"Art. 22, Art. 58","Data subject rights",null,"Violation found","https://www.imy.se/tillsyner/forsakringskassan/","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2025-11828",null,"gdprhub",null,null,"SE: swedish social insurance agency",null,null,null,null,null,null,null,null,null],["2025/RO/008","ETid-2932","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-11-17","day",8000,null,"EUR","PGS SOFA & CO SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_17.11.2025","https://www.enforcementtracker.com/ETid-2932",null,null,null,null,"pgs sofa and co srl",null,null,null,null,null,null,null,null,null],["2025/PL/001","ETid-2981","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-11-15","day",4750,null,"EUR","Powiatowego Inspektora Sanitarnego w Policach","Public Sector and Education","Art. 24, Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2024:dkn_5131_3/content?query=","https://www.enforcementtracker.com/ETid-2981",null,null,null,null,"PL: powiatowego inspektora sanitarnego w policach",null,null,null,null,null,null,null,null,null],["2025/ES/190","AEPD (Spain) - PS-00480-2025","gdprhub","Spain","ES","AEPD (Spain)","2025-11-14","day",72000,"72,000","EUR","Tiger Media Inc.",null,"Art. 27, Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.aepd.es/informes-y-resoluciones/resoluciones","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00480-2025",null,"gdprhub",null,null,"tiger media inc",null,null,null,null,null,null,null,null,null],["2025/AT/030","DSB (Austria) - 2025-0.923.556","gdprhub","Austria","AT","DSB (Austria)","2025-11-14","day",null,null,null,"Friederike N.",null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(4), Art. 4(7), Art. 58(2)(c)","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251114_2025_0_923_556_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.923.556",null,"gdprhub",null,null,"AT: friederike n",null,null,null,null,null,null,null,null,null],["2025/ES/015","ETid-2963","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-14","day",2400,null,"EUR","AXARQUIA VELEZ DENTAL, S.L.","Health Care","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00439-2024.pdf","https://www.enforcementtracker.com/ETid-2963",null,null,null,null,"axarquia velez dental sl",null,null,null,null,null,null,null,null,null],["2025/IT/011","ETid-2960","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-11-13","day",6000,null,"EUR","Comune di Orte","Public Sector and Education","Art. 12(1), Art. 13, Art. 35, Art. 5(1)(a)","DPIA, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10198694","https://www.enforcementtracker.com/ETid-2960",null,null,null,null,"IT: comune di orte",null,null,null,null,null,null,null,null,null],["2025/IT/010","ETid-2973","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-11-13","day",40000,null,"EUR","Quarantadue S.r.l.","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10199522","https://www.enforcementtracker.com/ETid-2973",null,null,null,null,"quarantadue srl",null,null,null,null,null,null,null,null,null],["2025/RO/009","ETid-2931","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-11-12","day",4000,null,"EUR","Fan Courier Express S.R.L.","Transportation and Energy","Art. 17, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_12_11_2025","https://www.enforcementtracker.com/ETid-2931",null,null,null,null,"fan courier express srl",null,null,null,null,null,null,null,null,null],["2025/FI/007","Tietosuojavaltuutetun toimisto (Finland) - TSV/112/2022 (9079/152/22)","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2025-11-11","day",null,null,null,null,null,"Art. 12(2), Art. 12(6), Art. 15(1), Art. 15(3), Art. 5(1)(c)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2487#OT0_OT0","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/112/2022_%289079/152/22%29",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/010","ETid-2920","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-11-10","day",2000,null,"EUR","Whitedecor SRL","Industry and Commerce","Art. 12(3), Art. 15, Art. 17, Art. 21, Art. 6(1)(a), Art. 7","Consent, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_10.11.2025","https://www.enforcementtracker.com/ETid-2920",null,null,null,null,"whitedecor srl",null,null,null,null,null,null,null,null,null],["2025/AT/029","DSB (Austria) - 2025-0.891.622","gdprhub","Austria","AT","DSB (Austria)","2025-11-07","day",null,null,null,null,null,"Art. 12(1), Art. 17, Art. 19, Art. 2(1), Art. 25(1), Art. 3(2)(a), Art. 4(1), Art. 4(11), Art. 5(1)(a), Art. 58(2), Art. 58(6), Art. 7(1), Art. 77(1), Art. 80(2)","Accountability, Consent, Data principles, Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251107_2025_0_891_622_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.891.622",null,"gdprhub",null,"Operator of a live-streaming website",null,null,null,null,null,null,null,null,null,null],["2025/RO/011","ETid-2919","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-11-07","day",7000,null,"EUR","Klass Wagen S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07_11_2025","https://www.enforcementtracker.com/ETid-2919",null,null,null,null,"klass wagen srl",null,null,null,null,null,null,null,null,null],["2025/GR/005","ETid-2949","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-11-07","day",1000,null,"EUR","Company","Employment","Art. 12(5)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2025-11/41_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2949","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_41_/2025","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/GR/030","HDPA (Greece) - 40 /2025","gdprhub","Greece","GR","HDPA (Greece)","2025-11-07","day",null,null,null,null,null,"Art. 31",null,null,"Other Outcome","https://www.dpa.gr/sites/default/files/2025-11/40_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_40_/2025",null,"gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2025/ES/016","ETid-2962","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-06","day",10043002,null,"EUR","Aena, S.M.E., S.A.","Transportation and Energy","Art. 35","DPIA, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00431-2024.pdf","https://www.enforcementtracker.com/ETid-2962",null,null,null,null,"ES: aena smesa",null,null,null,null,null,null,null,null,null],["2025/AT/028","DSB (Austria) - DSB-D124.2113/24","gdprhub","Austria","AT","DSB (Austria)","2025-11-05","day",null,null,null,null,null,"Art. 17(1), Art. 17(2), Art. 17(3)(b), Art. 17(3)(e), Art. 18(2), Art. 21(1), Art. 4(7), Art. 58(2)(c), Art. 6(1)(c), Art. 6(1)(f), Art. 77(1), Art. 9(2)(f)","Data subject rights, Special categories, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251105_2025_0_710_441_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.2113/24",null,"gdprhub","Vera A.; Luigi A.; Rüdiger A.; Peter A.",null,null,null,null,null,null,null,null,null,null,null],["2025/ES/017","ETid-2961","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-11-05","day",750,null,"EUR","ASOCIACIÓN ESCUELA NACIONAL DE EQUITACIÓN","Public Sector and Education","Art. 58(2)(d)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00532-2024.pdf","https://www.enforcementtracker.com/ETid-2961",null,null,null,null,"ES: asociacion escuela nacional de equitacion",null,null,null,null,null,null,null,null,null],["2025/LV/003","DVI (Latvia) - 04.11.2025","gdprhub","Latvia","LV","DVI (Latvia)","2025-11-04","day",150,"150","EUR",null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.dvi.gov.lv/lv/media/4199/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_04.11.2025",null,"gdprhub",null,"Police inspector",null,null,null,null,null,"person",null,null,null,null],["2025/BG/002","ETid-3138","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2025-11-01","day",2556,null,"EUR","Municipality of Kyustendil","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf#page=32","https://www.enforcementtracker.com/ETid-3138",null,null,null,null,"BG: municipality of kyustendil",null,null,null,null,null,null,null,null,null],["2025/LV/001","ETid-2930","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2025-10-28","day",300000,null,"EUR","SIA \"ZZ Dats\"","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dvi.gov.lv/lv/jaunums/inspekcija-noslegusi-parbaudi-par-personas-datu-aizsardzibas-parkapumu","https://www.enforcementtracker.com/ETid-2930",null,null,null,null,"sia zz dats",null,null,null,null,null,null,null,null,null],["2025/ES/018","ETid-2942","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-10-28","day",6000,null,"EUR","APARELLS ORTOPEDICS CURTO, S.L","Health Care","Art. 5(1)(f)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00391-2024.pdf","https://www.enforcementtracker.com/ETid-2942",null,null,null,null,"aparells ortopedics curto sl",null,null,null,null,null,null,null,null,null],["2025/AT/027","DSB (Austria) - DSB-D135.046","gdprhub","Austria","AT","DSB (Austria)","2025-10-27","day",null,null,null,"N. Games & Entertainment Europe Limited",null,"Art. 12(2), Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(2), Art. 15(3), Art. 4(1), Art. 4(7), Art. 58(2)(c), Art. 77","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251027_2025_0_119_280_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D135.046",null,"gdprhub",null,null,"n games and entertainment europe ltd",null,null,null,null,null,null,null,null,null],["2025/PL/003","ETid-2915","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-10-27","day",9450,null,"EUR","Gynecological Center","Health Care",null,"Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/pl/138/3933","https://www.enforcementtracker.com/ETid-2915",null,null,null,null,"PL: gynecological center",null,null,null,null,null,null,null,null,null],["2025/AT/007","ETid-3073","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2025-10-27","day",1500,null,"EUR","Shop Owner","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251027_2025_0_811_087_00","https://www.enforcementtracker.com/ETid-3073","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.811.087","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/DK/003","Datatilsynet (Denmark) - 2024-432-0041","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2025-10-23","day",null,null,null,"DR (Denmark's Radio)",null,"Art. 5(1)(c), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2025/okt/datatilsynet-har-undersoegt-dr%E2%80%99s-obligatoriske-login","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2024-432-0041",null,"gdprhub",null,null,"DK: dr",null,null,null,null,null,null,null,null,null],["2025/FI/001","ETid-2916","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2025-10-23","day",865000,null,"EUR","Aktia Pankki Oyj","Finance, Insurance and Consulting","Art. 25(1), Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2485","https://www.enforcementtracker.com/ETid-2916",null,null,null,null,"aktia pankki oyj",null,null,null,null,null,null,null,null,null],["2025/PL/002","ETid-2940","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-10-23","day",5000,null,"EUR","Court Bailiff","Public Sector and Education","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2024:dkn_5131_17/content","https://www.enforcementtracker.com/ETid-2940",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/019","ETid-2944","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-23","day",4000,null,"EUR","\"Statista Aldo Moro\" Higher Education Institute in Fara Sabina","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10195414","https://www.enforcementtracker.com/ETid-2944",null,null,null,null,"IT: statista aldo moro higher education institute in fara sabina",null,null,null,null,null,null,null,null,null],["2025/IT/018","ETid-2945","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-23","day",2000,null,"EUR","Comune di Avola","Public Sector and Education","Art. 37(7)","Data protection officer","Lack of appointment of data protection officer","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10195379","https://www.enforcementtracker.com/ETid-2945",null,null,null,null,"IT: comune di avola",null,null,null,null,null,null,null,null,null],["2025/IT/016","ETid-2955","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-23","day",15000,null,"EUR","Comune di Curtarolo","Employment","Art. 12(1), Art. 13, Art. 35, Art. 88","DPIA, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10196164","https://www.enforcementtracker.com/ETid-2955","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10196164","gdprhub",null,null,"IT: comune di curtarolo",null,null,null,null,null,null,null,null,null],["2025/IT/015","ETid-2956","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-23","day",1000,null,"EUR","Mayor of the Municipality of Calvi Risorta","Public Sector and Education","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10195910","https://www.enforcementtracker.com/ETid-2956",null,null,null,null,"IT: mayor of the municipality of calvi risorta",null,null,null,null,null,null,null,null,null],["2025/IT/013","ETid-2958","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-23","day",20000,null,"EUR","Multimedia News Società Cooperativa","Media, Telecoms and Broadcasting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10199198","https://www.enforcementtracker.com/ETid-2958",null,null,null,null,"IT: multimedia news societa cooperativa",null,null,null,null,null,null,null,null,null],["2025/IT/012","ETid-2959","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-23","day",15000,null,"EUR","Ordine degli Avvocati di Latina","Public Sector and Education","Art. 10, Art. 5(1)(a)","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10196142","https://www.enforcementtracker.com/ETid-2959",null,null,null,null,"IT: ordine degli avvocati di latina",null,null,null,null,null,null,null,null,null],["2025/IT/120","Garante per la protezione dei dati personali (Italy) - 10183535","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-10-23","day",150000,"150,000","EUR","RAI (the Italian public broadcaster)",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10183535","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10183535",null,"gdprhub",null,null,"IT: rai",null,null,null,null,null,null,null,null,null],["2025/RO/012","ETid-2910","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-10-22","day",2000,null,"EUR","Agency for Control of Outstanding Debts S.R.L.","Finance, Insurance and Consulting","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_22_10_2025","https://www.enforcementtracker.com/ETid-2910",null,null,null,null,"agency for control of outstanding debts srl",null,null,null,null,null,null,null,null,null],["2025/ES/019","ETid-2941","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-10-22","day",80000,null,"EUR","SENDING TRANSPORTE Y COMUNICACIÓN, S.A.","Transportation and Energy",null,null,"Insufficient data processing agreement","Fine issued","https://www.aepd.es/documento/ps-00058-2025.pdf","https://www.enforcementtracker.com/ETid-2941",null,null,null,null,"sending transporte y comunicacion sa",null,null,null,null,null,null,null,null,null],["2025/SE/009","IMY (Sweden) - IMY-2023 4458","gdprhub","Sweden","SE","IMY (Sweden)","2025-10-22","day",null,null,null,null,null,"Art. 14, Art. 4, Art. 6","Transparency, Unlawful processing",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2025/beslut-efter-tillsyn-moderaterna.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2023_4458",null,"gdprhub",null,"Moderate Party's national organization",null,null,null,null,null,null,null,null,null,null],["2025/SE/008","IMY (Sweden) - IMY-2024-7737","gdprhub","Sweden","SE","IMY (Sweden)","2025-10-22","day",null,null,null,"Sweden Democrats",null,"Art. 12, Art. 14, Art. 4(7), Art. 6(1)(f)","Transparency, Unlawful processing",null,"Other Outcome","https://www.imy.se/globalassets/dokument/beslut/2025/beslut-efter-tillsyn-sverigedemokraterna.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2024-7737",null,"gdprhub",null,null,"SE: sweden democrats",null,null,null,null,null,null,null,null,null],["2025/RO/013","ETid-2907","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-10-20","day",5000,null,"EUR","S.P.E.E.H. HIDROELECTRICA SA","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_20_10_2025","https://www.enforcementtracker.com/ETid-2907",null,null,null,null,"speeh hidroelectrica sa",null,null,null,null,null,null,null,null,null],["2025/RO/014","ETid-2906","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-10-16","day",2000,null,"EUR","PRIME TRANSACTION SA","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_16.10.2025","https://www.enforcementtracker.com/ETid-2906",null,null,null,null,"prime transaction sa",null,null,null,null,null,null,null,null,null],["2025/NL/003","ETid-2908","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2025-10-16","day",2700000,null,"EUR","Experian Nederland B.V.","Finance, Insurance and Consulting","Art. 12(1), Art. 14(1), Art. 26(2), Art. 5(1)(a), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteitpersoonsgegevens.nl/actueel/experian-krijgt-boete-van-27-miljoen-euro-voor-privacyovertredingen","https://www.enforcementtracker.com/ETid-2908",null,null,null,null,"experian nederland bv","Experian",null,null,null,null,null,null,null,null],["2025/GB/003","ETid-2898","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-10-15","day",9180000,null,"EUR","CAPITA PLC","Industry and Commerce","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/pv5nhks4/capita-plc-and-cpsl-monetary-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-2898",null,null,null,null,"capita plc",null,null,null,null,null,null,null,null,null],["2025/GB/002","ETid-2899","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-10-15","day",6880000,null,"EUR","CAPITA PENSION SOLUTIONS LIMITED","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/pv5nhks4/capita-plc-and-cpsl-monetary-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-2899",null,null,null,null,"capita pension solutions ltd",null,null,null,null,null,null,null,null,null],["2025/GB/016","ICO (UK) - Capita plc and Capita Pension Solutions Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2025-10-15","day",null,"14,000,000","GBP","Capita plc",null,null,null,null,"Violation found","https://ico.org.uk/media2/pv5nhks4/capita-plc-and-cpsl-monetary-penalty-notice.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Capita_plc_and_Capita_Pension_Solutions_Ltd",null,"gdprhub",null,null,"capita plc",null,14000000.0,16082711,"day 2025-10-15|0.8705|GBP",null,null,null,null,null],["2025/AT/013","DSB (Austria) - D124.2695/24 2025-0.328.963","gdprhub","Austria","AT","DSB (Austria)","2025-10-14","day",null,null,null,"CRIF",null,"Art. 12, Art. 15(1)(c), Art. 15(1)(g), Art. 15(1)(h), Art. 22(3)","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251014_2025_0_328_963_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D124.2695/24_2025-0.328.963",null,"gdprhub",null,null,"AT: crif",null,null,null,null,null,"appealed","Not final: the organisation appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251014_2025_0_328_963_00",null],["2025/EE/009","AKI (Estonia) - 2.1-1/24/1246-3074-22","gdprhub","Estonia","EE","AKI (Estonia)","2025-10-13","day",null,null,null,"Delfi Meedia AS",null,"Art. 17","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2026-01/Ettekirjutus%20hoiatus%20isikuandmete%20kaitse%20asjas.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-1/24/1246-3074-22",null,"gdprhub",null,null,"delfi meedia as",null,null,null,null,null,null,null,null,null],["2025/EE/007","AKI (Estonia) - 2.1-1/25/737-1585-20","gdprhub","Estonia","EE","AKI (Estonia)","2025-10-13","day",null,null,null,"Nura OÜ",null,"Art. 15","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2025-12/Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas_13.10.2025_Nura%20O%C3%9C.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-1/25/737-1585-20",null,"gdprhub",null,null,"nura ou",null,null,null,null,null,null,null,null,null],["2025/RO/015","ETid-2896","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-10-13","day",5000,null,"EUR","Vellea Home SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_13_10_2025","https://www.enforcementtracker.com/ETid-2896",null,null,null,null,"vellea home srl",null,null,null,null,null,null,null,null,null],["2025/ES/184","AEPD (Spain) - EXP202500113","gdprhub","Spain","ES","AEPD (Spain)","2025-10-10","day",500000,"500.000","EUR","ING Bank N.V",null,"Art. 32","Data security",null,"Violation found","https://www.aepd.es/documento/ps-00001-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202500113",null,"gdprhub",null,null,"ing bank nv","ING",null,null,null,null,null,null,null,null],["2025/ES/191","AEPD (Spain) - PS-00140-2025","gdprhub","Spain","ES","AEPD (Spain)","2025-10-10","day",null,null,null,"23ANDME, INC",null,"Art. 24(1), Art. 32, Art. 33, Art. 5(1)(f), Art. 9","Accountability, Data breach, Data principles, Data security, Special categories",null,null,"https://www.aepd.es/documento/ps-00140-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00140-2025",null,"gdprhub",null,null,"23andme inc",null,null,null,null,null,null,null,null,null],["2025/BE/026","APD/GBA (Belgium) - 163/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-10-10","day",null,null,null,null,null,"Art. 12, Art. 14, Art. 38(2), Art. 38(6), Art. 5(1)(a), Art. 6(1), Art. 6(4)","Data principles, Data protection officer, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-163-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_163/2025",null,"gdprhub","Belgian Municipality; Mayor of that municipality",null,null,null,null,null,null,null,null,null,null,null],["2025/AT/023","DSB (Austria) - 2025-0.789.117","gdprhub","Austria","AT","DSB (Austria)","2025-10-10","day",null,null,null,null,null,"Art. 12(3), Art. 15, Art. 27","Data subject rights, Transparency",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251010_2025_0_789_117_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.789.117",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/AT/024","DSB (Austria) - 2025-0.813.131","gdprhub","Austria","AT","DSB (Austria)","2025-10-10","day",null,null,null,null,null,"Art. 5","Data principles",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251010_2025_0_813_131_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.813.131",null,"gdprhub",null,"Event organiser",null,null,null,null,null,null,null,null,null,null],["2025/RO/016","ETid-2895","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-10-09","day",25000,null,"EUR","EON ENERGIE ROMANIA S.A.","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_09_10_2025","https://www.enforcementtracker.com/ETid-2895",null,null,null,null,"eon energie romania sa",null,null,null,null,null,null,null,null,null],["2025/IT/021","ETid-2928","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-09","day",6000,null,"EUR","Interprovincial Order of Medical Radiology Technicians and Technical Health Professions in Rehabilitation and Prevention of AQ - CH - PE - TE","Health Care","Art. 37(1)(a)","Data protection officer, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10192819","https://www.enforcementtracker.com/ETid-2928",null,null,null,null,"IT: interprovincial order of medical radiology technicians and technical health professions in rehabilitation and prevention of aq ch pe te",null,null,null,null,null,null,null,null,null],["2025/IT/020","ETid-2929","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-09","day",16000,null,"EUR","Order of Nursing Professions of Pisa","Health Care","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10192784","https://www.enforcementtracker.com/ETid-2929",null,null,null,null,"IT: order of nursing professions of pisa",null,null,null,null,null,null,null,null,null],["2025/GR/006","ETid-2936","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-10-09","day",10000,null,"EUR","Municipality of Moschato–Tavros","Public Sector and Education","Art. 12(1), Art. 13, Art. 25(1)","Accountability, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2025-11/38_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2936",null,null,null,null,"GR: municipality of moschatotavros",null,null,null,null,null,null,null,null,null],["2025/IT/017","ETid-2946","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-10-09","day",5000,null,"EUR","FT Solutions S.r.l.","Industry and Commerce","Art. 13, Art. 14, Art. 21(2), Art. 24, Art. 25, Art. 32, Art. 6(1)(a), Art. 7","Accountability, Consent, Data principles, Data security, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10193723","https://www.enforcementtracker.com/ETid-2946",null,null,null,null,"ft solutions srl",null,null,null,null,null,null,null,null,null],["2025/IT/125","Garante per la protezione dei dati personali (Italy) - 10193871","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-10-09","day",null,null,null,"Squeezemind S.r.l.",null,"Art. 12, Art. 13, Art. 5(1)(a), Art. 5(1)(c)","Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10193871","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10193871",null,"gdprhub",null,null,"squeezemind srl",null,null,null,null,null,null,null,null,null],["2025/AT/022","DSB (Austria) - 2025-0.620.443","gdprhub","Austria","AT","DSB (Austria)","2025-10-08","day",null,null,null,null,null,null,null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251008_2025_0_620_443_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.620.443",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/AT/015","DSB (Austria) - D135.027 2025-0.477.534","gdprhub","Austria","AT","DSB (Austria)","2025-10-08","day",null,null,null,"Microsoft Corporation",null,"Art. 12(1), Art. 13, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20251008_2025_0_477_534_00/DSBT_20251008_2025_0_477_534_00.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D135.027_2025-0.477.534",null,"gdprhub",null,null,"microsoft corp","Microsoft",null,null,null,null,"appealed","Not final: the organisation appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251008_2025_0_477_534_00",null],["2025/BE/024","APD/GBA (Belgium) - 158/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-10-07","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 17, Art. 5(1)(b), Art. 5(1)(e), Art. 5(2)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/burger/zoeken?q=&search_category%255B%255D=taxonomy%253Apublications&search_type%255B%255D=decision&s=recent&l=25","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_158/2025",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2025/SI/017","IP (Slovenia) - 0602-44/2025/6","gdprhub","Slovenia","SI","IP (Slovenia)","2025-10-07","day",null,null,null,null,null,"Art. 17(1), Art. 17(3)","Data subject rights",null,"Rejected","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0602-44/2025/6",null,"gdprhub",null,"Business operator",null,null,null,null,null,null,null,null,null,null],["2025/EE/008","AKI (Estonia) - 2.1.-4/25/1239-2660-6","gdprhub","Estonia","EE","AKI (Estonia)","2025-10-06","day",null,null,null,"Zu Disain OÜ",null,"Art. 5(1)(a), Art. 6(1), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2026-01/Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas%20nr%202.1.-4%2025%201239-2660-6%20Zu%20Disain%20O%C3%9C.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-4/25/1239-2660-6",null,"gdprhub",null,null,"zu disain ou",null,null,null,null,null,null,null,null,null],["2025/ES/120","ETid-3197","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-10-04","day",164000,null,"EUR","SEUR GEOPOST, S.L.","Transportation and Energy","Art. 28, Art. 5(1)(f)","Data principles, Processor obligations","Insufficient data processing agreement","Fine issued","https://www.aepd.es/documento/ps-00248-2024.pdf","https://www.enforcementtracker.com/ETid-3197",null,null,null,null,"seur geopost sl",null,null,null,null,null,null,null,null,null],["2025/ES/020","ETid-2935","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-10-03","day",30000,null,"EUR","THE RED KIWI, S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00158-2023.pdf","https://www.enforcementtracker.com/ETid-2935",null,null,null,null,"the red kiwi sl",null,null,null,null,null,null,null,null,null],["2025/FI/006","Tietosuojavaltuutetun toimisto (Finland) - 2025/AR/253","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2025-10-03","day",null,null,null,null,null,"Art. 24, Art. 28, Art. 44, Art. 46","Accountability, International transfers, Processor obligations",null,"Violation found","https://www.finlex.fi/en/authorities/data-protection-ombudsman","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_2025/AR/253",null,"gdprhub",null,"Public authority",null,null,null,null,null,null,null,null,null,null],["2025/IT/099","Garante per la protezione dei dati personali (Italy) - 0174164","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-10-01","day",null,null,null,"ClothOff",null,"Art. 25, Art. 5(1)(a), Art. 5(2), Art. 58(2)(f)","Accountability, Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10174164","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_0174164",null,"gdprhub",null,null,"IT: clothoff",null,null,null,null,null,null,null,null,null],["2025/DE/002","ETid-2892","cms_tracker","Germany","DE","Data Protection Authority of Hamburg (HmbBfDI)","2025-09-30","day",492000,null,"EUR","Company","Finance, Insurance and Consulting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2025-hmbbfdi-verhaengt-bussgelder-von-insgesamt-775000-euro","https://www.enforcementtracker.com/ETid-2892",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/DE/001","ETid-2893","cms_tracker","Germany","DE","Data Protection Authority of Hamburg (HmbBfDI)","2025-09-30","day",195000,null,"EUR","Company","Industry and Commerce",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2025-hmbbfdi-verhaengt-bussgelder-von-insgesamt-775000-euro","https://www.enforcementtracker.com/ETid-2893",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/BE/023","APD/GBA (Belgium) - 154/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-09-29","day",null,null,null,null,null,"Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-154-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_154/2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/AT/019","DSB (Austria) - 2024-0.501.636","gdprhub","Austria","AT","DSB (Austria)","2025-09-29","day",null,null,null,null,null,"Art. 17","Data subject rights",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250929_2024_0_501_636_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2024-0.501.636",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/AT/003","ETid-2975","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2025-09-29","day",600,null,"EUR","Owner of a Tesla Car","Individuals and Private Associations","Art. 12, Art. 13, Art. 6(1)","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://dsb.gv.at/sites/site0344/media/downloads/dsb-newsletter_nr._03_25_dezember_2025.pdf","https://www.enforcementtracker.com/ETid-2975",null,null,null,null,"AT: owner of a tesla car",null,null,null,null,null,null,null,null,null],["2025/AT/012","DSB (Austria) - D124.1994/24 2025-0.355.103","gdprhub","Austria","AT","DSB (Austria)","2025-09-25","day",null,null,null,"KSV Information GmbH",null,"Art. 12, Art. 13(2), Art. 14(2)(g), Art. 15(1)(c), Art. 15(1)(g), Art. 15(1)(h), Art. 22(1), Art. 22(2), Art. 58(2)(f)","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250925_2025_0_355_103_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D124.1994/24_2025-0.355.103",null,"gdprhub",null,null,"ksv information gmbh",null,null,null,null,null,"appealed","Not final: the complainant and the organisation appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250925_2025_0_355_103_00",null],["2025/RO/017","ETid-2890","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-09-25","day",20000,null,"EUR","S.C. PRIMONET RO S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_25_09_2025&lang=ro","https://www.enforcementtracker.com/ETid-2890",null,null,null,null,"primonet ro srl",null,null,null,null,null,null,null,null,null],["2025/ES/025","ETid-2894","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-09-25","day",840,null,"EUR","SERVACE S.L.","Employment","Art. 5(1)(f), Art. 6(1)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00481-2024.pdf","https://www.enforcementtracker.com/ETid-2894",null,null,null,null,"servace sl",null,null,null,null,null,null,null,null,null],["2025/IT/028","ETid-2917","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-25","day",3000,null,"EUR","Comune di Isola del Gran Sasso","Employment","Art. 10, Art. 17, Art. 5(1)(a), Art. 6","Data principles, Data subject rights, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10184967","https://www.enforcementtracker.com/ETid-2917","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10184967","gdprhub",null,null,"IT: comune di isola del gran sasso",null,null,null,null,null,null,null,null,null],["2025/IT/027","ETid-2922","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-25","day",10000,null,"EUR","La Prima Srl","Real Estate","Art. 12(3), Art. 17, Art. 58(2)(d), Art. 6(1)(a)","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10184761","https://www.enforcementtracker.com/ETid-2922",null,null,null,null,"la prima srl",null,null,null,null,null,null,null,null,null],["2025/IT/026","ETid-2923","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-25","day",32000,null,"EUR","Provincia Autonoma di Bolzano","Public Sector and Education","Art. 12(1), Art. 13, Art. 21(4), Art. 26, Art. 35","DPIA, Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10185463","https://www.enforcementtracker.com/ETid-2923","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10185463","gdprhub",null,null,"IT: provincia autonoma di bolzano",null,null,null,null,null,null,null,null,null],["2025/IT/025","ETid-2924","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-25","day",15000,null,"EUR","Vimar S.p.A.","Industry and Commerce","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10184744","https://www.enforcementtracker.com/ETid-2924",null,null,null,null,"vimar spa",null,null,null,null,null,null,null,null,null],["2025/IT/024","ETid-2925","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-25","day",3960,null,"EUR","Comune di Pazzano","Public Sector and Education","Art. 12, Art. 13, Art. 58(2)(d)","Cooperation with the DPA, Transparency","Insufficient cooperation with supervisory authority","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10184621","https://www.enforcementtracker.com/ETid-2925",null,null,null,null,"IT: comune di pazzano",null,null,null,null,null,null,null,null,null],["2025/IT/023","ETid-2926","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-25","day",35000,null,"EUR","E-Power S.r.l.","Transportation and Energy","Art. 12, Art. 15, Art. 17, Art. 21, Art. 24, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10187997","https://www.enforcementtracker.com/ETid-2926",null,null,null,null,"e power srl",null,null,null,null,null,null,null,null,null],["2025/IT/022","ETid-2927","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-25","day",1000,null,"EUR","Green.mec. s.r.l.","Employment","Art. 13(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10191266","https://www.enforcementtracker.com/ETid-2927",null,null,null,null,"green mec srl",null,null,null,null,null,null,null,null,null],["2025/IT/126","Garante per la protezione dei dati personali (Italy) - 10185490","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-09-25","day",20000,"20,000","EUR",null,null,"Art. 25, Art. 32, Art. 5(1)(a), Art. 5(1)(f), Art. 9","Accountability, Data principles, Data security, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10185490","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10185490",null,"gdprhub",null,"Local health authority of Ferrara",null,null,null,null,null,null,null,null,null,null],["2025/IT/127","Garante per la protezione dei dati personali (Italy) - 10188249","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-09-25","day",null,null,null,null,null,"Art. 85, Art. 89",null,null,"Rejected","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10188249","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10188249",null,"gdprhub",null,"News broadcaster",null,null,null,null,null,null,null,null,null,null],["2025/AT/018","DSB (Austria) - 2025-0.533.437","gdprhub","Austria","AT","DSB (Austria)","2025-09-24","day",null,null,null,null,null,"Art. 15, Art. 4(7), Art. 6","Data subject rights, Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250924_2025_0_533_437_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.533.437",null,"gdprhub",null,"Lawyer",null,null,null,null,null,"person",null,null,null,null],["2025/ES/026","ETid-2887","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-09-23","day",600,null,"EUR","Property manager","Real Estate","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00322-2024.pdf","https://www.enforcementtracker.com/ETid-2887",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/027","ETid-2886","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-09-22","day",3000,null,"EUR","DHL PARCEL IBERIA, S.L.","Transportation and Energy","Art. 32","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00465-2024.pdf","https://www.enforcementtracker.com/ETid-2886",null,null,null,null,"dhl parcel iberia sl",null,null,null,null,null,null,null,null,null],["2025/RO/018","ETid-2876","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-09-18","day",1000,null,"EUR","Dr. Max SRL","Health Care","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_18_09_2025","https://www.enforcementtracker.com/ETid-2876",null,null,null,null,"dr max srl",null,null,null,null,null,null,null,null,null],["2025/FR/006","ETid-2877","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-09-18","day",100000,null,"EUR","SAMARITAINE SAS","Industry and Commerce","Art. 38(1)","Data principles, Data protection officer","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052266505","https://www.enforcementtracker.com/ETid-2877","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-008","gdprhub",null,null,"samaritaine sas",null,null,null,null,null,null,null,null,null],["2025/ES/024","ETid-2914","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-09-17","day",1500000,null,"EUR","SERVICIOS FINANCIEROS CARREFOUR, E.F.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00288-2025.pdf","https://www.enforcementtracker.com/ETid-2914","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202402154","gdprhub",null,null,"servicios financieros carrefour efc","Carrefour",null,null,null,null,null,null,null,null],["2025/ES/023","ETid-2918","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-09-17","day",150000,null,"EUR","DIGI SPAIN TELECOM, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00343-2024.pdf","https://www.enforcementtracker.com/ETid-2918",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2025/PL/004","ETid-2897","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-09-12","day",2670,null,"EUR",null,"Health Care","Art. 38(6)","Data protection officer","Lack of appointment of data protection officer","Fine issued","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2025:dkn_5131_7/content?query=","https://www.enforcementtracker.com/ETid-2897",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/035","ETid-2889","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-11","day",12000,null,"EUR","Casa di Cura Città di Roma","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10169116","https://www.enforcementtracker.com/ETid-2889",null,null,null,null,"IT: casa di cura citta di roma",null,null,null,null,null,null,null,null,null],["2025/IT/034","ETid-2900","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-11","day",12000,null,"EUR","Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10177237","https://www.enforcementtracker.com/ETid-2900",null,null,null,null,"IT: ministry of the interior department of firefighters public rescue and civil defense provincial command of florence",null,null,null,null,null,null,null,null,null],["2025/IT/033","ETid-2901","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-11","day",8000,null,"EUR","Migliarino San Rossore Massaciuccoli Regional Park Authority","Employment","Art. 20, Art. 5(1)(a), Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10176998","https://www.enforcementtracker.com/ETid-2901",null,null,null,null,"IT: migliarino san rossore massaciuccoli regional park authority",null,null,null,null,null,null,null,null,null],["2025/IT/032","ETid-2902","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-11","day",6000,null,"EUR","Municipality of Buccino","Public Sector and Education","Art. 37(7), Art. 9","Data protection officer, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10177128","https://www.enforcementtracker.com/ETid-2902",null,null,null,null,"IT: municipality of buccino",null,null,null,null,null,null,null,null,null],["2025/IT/031","ETid-2911","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-11","day",6000,null,"EUR","Company","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10183236","https://www.enforcementtracker.com/ETid-2911",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/030","ETid-2912","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-11","day",18000,null,"EUR","Comune di Nichelino","Public Sector and Education","Art. 12(3), Art. 16","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10183000","https://www.enforcementtracker.com/ETid-2912","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10183000","gdprhub",null,null,"IT: comune di nichelino",null,null,null,null,null,null,null,null,null],["2025/IT/029","ETid-2913","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-09-11","day",1000,null,"EUR","Giada FM S.r.l.","Employment","Art. 12, Art. 15, Art. 5(1)(a)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10183903","https://www.enforcementtracker.com/ETid-2913",null,null,null,null,"giada fm srl",null,null,null,null,null,null,null,null,null],["2025/IT/118","Garante per la protezione dei dati personali (Italy) - 10167745","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-09-11","day",null,null,null,"Società per Azioni Esercizi Aeroportuali S.E.A.",null,"Art. 13, Art. 25, Art. 32, Art. 5(1)(e), Art. 5(1)(f), Art. 6","Accountability, Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10167745","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10167745",null,"gdprhub",null,null,"IT: societa per azioni esercizi aeroportuali sea",null,null,null,null,null,null,null,null,null],["2025/AT/016","DSB (Austria) - 2025-0.607.071","gdprhub","Austria","AT","DSB (Austria)","2025-09-10","day",null,null,null,null,null,"Art. 5, Art. 58, Art. 6(1)(f), Art. 7(4)","Consent, Data principles, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250910_2025_0_607_071_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.607.071",null,"gdprhub",null,"Restaurant owner",null,null,null,null,null,"person",null,null,null,null],["2025/RO/019","ETid-2872","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-09-09","day",5000,null,"EUR","Unita Turism Holding S.A.","Employment",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_09_09_2025&lang=ro","https://www.enforcementtracker.com/ETid-2872",null,null,null,null,"unita turism holding sa",null,null,null,null,null,null,null,null,null],["2025/FI/002","ETid-2873","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2025-09-08","day",1800000,null,"EUR","S-Pankki Oyj","Finance, Insurance and Consulting","Art. 25(1), Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2479","https://www.enforcementtracker.com/ETid-2873","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/3606/2024","gdprhub",null,null,"s pankki oyj",null,null,null,null,null,null,null,null,null],["2025/EE/006","AKI (Estonia) - 2.1-1/25/958-2082-7","gdprhub","Estonia","EE","AKI (Estonia)","2025-09-05","day",null,null,null,"DirectMarketing OÜ",null,"Art. 15(1), Art. 17(1)","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2025-11/Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas%2005.09.2025%20DirectMarketing%20O%C3%9C.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-1/25/958-2082-7",null,"gdprhub",null,null,"directmarketing ou",null,null,null,null,null,null,null,null,null],["2025/EE/001","ETid-2858","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2025-09-05","day",3000000,null,"EUR","Allium UPI","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aki.ee/uudised/allium-upi-jattis-kliendiandmed-kaitseta-3-miljoni-euro-suurune-trahv","https://www.enforcementtracker.com/ETid-2858",null,null,null,null,"EE: allium upi",null,null,null,null,null,null,null,null,null],["2025/AT/002","ETid-2976","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2025-09-05","day",33500,null,"EUR","Bakery Chain","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://dsb.gv.at/sites/site0344/media/downloads/dsb-newsletter_nr._03_25_dezember_2025.pdf","https://www.enforcementtracker.com/ETid-2976",null,null,null,null,"AT: bakery chain",null,null,null,null,null,null,null,null,null],["2025/BE/002","ETid-2859","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2025-09-04","day",9700,null,"EUR","Landlord","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-142-2025-du-4-septembre-2025.pdf","https://www.enforcementtracker.com/ETid-2859","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_142/2025","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/028","ETid-2875","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-09-04","day",180000,null,"EUR","Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A.","Finance, Insurance and Consulting","Art. 28, Art. 5(1)(f)","Data principles, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00313-2025.pdf","https://www.enforcementtracker.com/ETid-2875","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202318311","gdprhub",null,null,"sociedad de gestion de activos procedentes de la reestructuracion bancaria sa",null,null,null,null,null,null,null,null,null],["2025/AT/005","ETid-2938","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2025-09-04","day",870,null,"EUR","Company",null,"Art. 33(3)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250904_2025_0_699_550_00","https://www.enforcementtracker.com/ETid-2938","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D550.1221","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/DK/001","ETid-2891","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2025-09-02","day",200900,null,"EUR","ILVA A/S","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2025/sep/vestre-landsret-har-afsagt-dom-i-straffesagen-mod-ilva-as","https://www.enforcementtracker.com/ETid-2891",null,null,null,null,"ilva as",null,null,null,null,null,null,null,null,null],["2025/SI/016","IP (Slovenia) - 0600-43/2025/9","gdprhub","Slovenia","SI","IP (Slovenia)","2025-09-02","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0600-43/2025/9",null,"gdprhub",null,"Association",null,null,null,null,null,null,null,null,null,null],["2025/FR/015","CNIL (France) - SAN-2025-004","gdprhub","France","FR","CNIL (France)","2025-09-01","day",325000000,"325,000,000","EUR",null,null,"Art. 4(11)",null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000052182222?init=true&page=1&query=SAN-2025-004&searchField=ALL&tab_selection=all","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-004",null,"gdprhub","Google LLC; Google France; Google Ireland Limited",null,null,null,null,null,null,null,null,null,null,null],["2025/IE/007","DPC (Ireland) - Inquiry into Microsoft Ireland Operations Limited","gdprhub","Ireland","IE","DPC (Ireland)","2025-09-01","day",null,null,null,"Microsoft Ireland Operations Limited",null,"Art. 12(4), Art. 15(4), Art. 5(1)(a)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2026-03/20250901-REDACTED-Art60-Decision-Microsoft-for-publication.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Inquiry_into_Microsoft_Ireland_Operations_Limited",null,"gdprhub",null,null,"microsoft ireland operations ltd","Microsoft",null,null,null,null,null,null,null,null],["2025/RO/020","ETid-2841","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-09-01","day",10000,null,"EUR","La Fântâna S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_01.09.2025","https://www.enforcementtracker.com/ETid-2841",null,null,null,null,"la fantana srl",null,null,null,null,null,null,null,null,null],["2025/FR/009","ETid-2862","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-09-01","day",200000000,null,"EUR","GOOGLE LLC","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cnil.fr/sites/default/files/2025-09/cnil_sanction_google_en.pdf","https://www.enforcementtracker.com/ETid-2862",null,null,null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2025/FR/008","ETid-2863","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-09-01","day",125000000,null,"EUR","GOOGLE IRELAND LIMITED","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cnil.fr/sites/default/files/2025-09/cnil_sanction_google_en.pdf","https://www.enforcementtracker.com/ETid-2863",null,null,null,null,"google ireland ltd","Google (Alphabet)",null,null,null,null,null,null,null,null],["2025/FR/007","ETid-2864","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-09-01","day",150000000,null,"EUR","INFINITE STYLES SERVICES CO. LIMITED","Industry and Commerce",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cnil.fr/sites/default/files/2025-09/cnil_sanction_shein_en.pdf","https://www.enforcementtracker.com/ETid-2864","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-005","gdprhub",null,null,"infinite styles services co ltd",null,null,null,null,null,null,null,null,null],["2025/ES/030","ETid-2867","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-09-01","day",1200,null,"EUR","Company",null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00181-2025.pdf","https://www.enforcementtracker.com/ETid-2867",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/009","ETid-3072","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-09-01","day",2000,null,"EUR","Primary School","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/wp-content/uploads/2025/09/skola-kazna.pdf","https://www.enforcementtracker.com/ETid-3072",null,null,null,null,"HR: primary school",null,null,null,null,null,null,null,null,null],["2025/ES/022","ETid-2933","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-31","day",2000,null,"EUR","GESTIÓN DE VENTAS IBERIA S.L.","Industry and Commerce","Art. 14","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00522-2024.pdf","https://www.enforcementtracker.com/ETid-2933",null,null,null,null,"gestion de ventas iberia sl",null,null,null,null,null,null,null,null,null],["2025/ES/032","ETid-2865","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-29","day",2400,null,"EUR","KVIKU SPAIN, S.L.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00384-2025.pdf","https://www.enforcementtracker.com/ETid-2865",null,null,null,null,"kviku spain sl",null,null,null,null,null,null,null,null,null],["2025/ES/031","ETid-2866","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-29","day",1200,null,"EUR","GOHIPOTECA, S.L.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00007-2025.pdf","https://www.enforcementtracker.com/ETid-2866",null,null,null,null,"gohipoteca sl",null,null,null,null,null,null,null,null,null],["2025/ES/180","AEPD (Spain) - EXP202402590","gdprhub","Spain","ES","AEPD (Spain)","2025-08-28","day",5000,"5,000","EUR","AECORP 005, S.L.",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00521-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202402590",null,"gdprhub",null,null,"aecorp 005 sl",null,null,null,null,null,null,null,null,null],["2025/PL/005","ETid-2840","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-08-26","day",4323250,null,"EUR","ING Bank Śląski","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/pl/138/3854","https://www.enforcementtracker.com/ETid-2840",null,null,null,null,"PL: ing bank slaski","ING",null,null,null,null,null,null,null,null],["2025/ES/033","ETid-2854","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-26","day",300,null,"EUR","Driving School","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00235-2025.pdf","https://www.enforcementtracker.com/ETid-2854",null,null,null,null,"ES: driving school",null,null,null,null,null,null,null,null,null],["2025/ES/035","ETid-2852","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-25","day",1800,null,"EUR","LEIVA BUS, S.L.","Transportation and Energy","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00066-2025.pdf","https://www.enforcementtracker.com/ETid-2852",null,null,null,null,"leiva bus sl",null,null,null,null,null,null,null,null,null],["2025/ES/034","ETid-2853","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-25","day",5400,null,"EUR","YUNEXPRESS SPAIN, S.L.","Transportation and Energy","Art. 28(3), Art. 5(1)(d)","Data principles, Processor obligations","Insufficient data processing agreement","Fine issued","https://www.aepd.es/documento/ps-00452-2024.pdf","https://www.enforcementtracker.com/ETid-2853",null,null,null,null,"yunexpress spain sl",null,null,null,null,null,null,null,null,null],["2025/ES/037","ETid-2850","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-22","day",6000,null,"EUR","BANCO INVERSIS, S.A.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00108-2025.pdf","https://www.enforcementtracker.com/ETid-2850",null,null,null,null,"banco inversis sa",null,null,null,null,null,null,null,null,null],["2025/ES/036","ETid-2851","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-22","day",18000,null,"EUR","GRUPO BONATEL SL","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00308-2025.pdf","https://www.enforcementtracker.com/ETid-2851",null,null,null,null,"grupo bonatel sl",null,null,null,null,null,null,null,null,null],["2025/BE/021","APD/GBA (Belgium) - 132/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-08-19","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 15, Art. 2, Art. 5(1)(a), Art. 6(1)(b), Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-132-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_132/2025",null,"gdprhub",null,"Bike rental company",null,null,null,null,null,null,null,null,null,null],["2025/BE/020","APD/GBA (Belgium) - 133/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-08-19","day",null,null,null,null,null,"Art. 12(1), Art. 14(1), Art. 14(2), Art. 15(1)(g), Art. 5(1)(a), Art. 5(1)(b)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.dataprotectionauthority.be/citizen","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_133/2025",null,"gdprhub",null,"Politician",null,null,null,null,null,"person",null,null,null,null],["2025/RO/021","ETid-2783","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-08-18","day",3000,null,"EUR","SC Elite Conta SRL","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_18_08_2025","https://www.enforcementtracker.com/ETid-2783",null,null,null,null,"elite conta srl",null,null,null,null,null,null,null,null,null],["2025/ES/038","ETid-2849","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-14","day",42000,null,"EUR","WORLD 2 MEET, S.L.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00389-2024.pdf","https://www.enforcementtracker.com/ETid-2849","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00389-2024","gdprhub",null,null,"world 2 meet sl",null,null,null,null,null,null,null,null,null],["2025/SI/006","ETid-3007","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-08-13","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_97_2024_2_odlo%C4%8Dba+po+ZP_GLOBA_83%284%29+GDPR_13082025.docx","https://www.enforcementtracker.com/ETid-3007",null,null,null,"Sole trader",null,null,null,null,null,"person",null,null,null,null],["2025/LT/010","VDAI (Lithuania) - 3R-1078","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-08-13","day",null,null,null,null,null,"Art. 4(1), Art. 6(1)(c)","Unlawful processing",null,"Rejected","https://vdai.lrv.lt/public/canonical/1755581167/1057/2025-08-13%20sprendimas%20Nr.%203R-1078%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-1078",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/022","ETid-2782","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-08-12","day",3000,null,"EUR","\"FLEXICREDIT\" Mutual Aid House Association","Finance, Insurance and Consulting","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_12.08.2025","https://www.enforcementtracker.com/ETid-2782",null,null,null,null,"RO: flexicredit mutual aid house association",null,null,null,null,null,null,null,null,null],["2025/ES/041","ETid-2846","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-12","day",4800,null,"EUR","GACM SEGUROS GENERALES, COMPAÑIA DE SEGUROS Y REASEGUROS S.A.U.","Finance, Insurance and Consulting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00453-2024.pdf","https://www.enforcementtracker.com/ETid-2846",null,null,null,null,"gacm seguros generales compania de seguros y reaseguros sau",null,null,null,null,null,null,null,null,null],["2025/ES/040","ETid-2847","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-12","day",1600,null,"EUR","REAL FEDERACIÓN ESPAÑOLA DE TENIS DE MESA","Individuals and Private Associations","Art. 5(1)(f)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00305-2024.pdf","https://www.enforcementtracker.com/ETid-2847",null,null,null,null,"ES: real federacion espanola de tenis de mesa",null,null,null,null,null,null,null,null,null],["2025/ES/039","ETid-2848","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-12","day",66000,null,"EUR","REAL SOCIEDAD DE FUTBOL S.A.D.","Individuals and Private Associations","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00286-2025.pdf","https://www.enforcementtracker.com/ETid-2848","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202318433","gdprhub",null,null,"ES: real sociedad de futbol sad",null,null,null,null,null,null,null,null,null],["2025/EE/003","AKI (Estonia) - 2.1.-4/25/879-1919-3","gdprhub","Estonia","EE","AKI (Estonia)","2025-08-11","day",null,null,null,"Mydentist.ee",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c)","Data principles",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2025-10/Hoiatus%20isikuandmete%20kaitse%20asjas%20%C3%95igusnormid%20art%205%20lg%201%20p%20a%2C%20art%206%20lg%201%20p%20a%2C%20f%20ja%20art%209%20lg%202%20p%20a.%20Teemad%20eriliiki%20andmete%20t%C3%B6%C3%B6tlemine%2C%20n%C3%B5usolek.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-4/25/879-1919-3",null,"gdprhub",null,null,"EE: mydentist ee",null,null,null,null,null,null,null,null,null],["2025/ES/021","ETid-2934","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-08-11","day",80000,null,"EUR","BIZUM, S.L.","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00283-2025.pdf","https://www.enforcementtracker.com/ETid-2934","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202318538","gdprhub",null,null,"bizum sl",null,null,null,null,null,null,null,null,null],["2025/AT/036","DSB (Austria) - 2025-0.626.844","gdprhub","Austria","AT","DSB (Austria)","2025-08-07","day",null,null,null,null,null,"Art. 12(1), Art. 15(1), Art. 15(2)","Data subject rights, Transparency",null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250807_2025_0_626_844_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.626.844",null,"gdprhub",null,"Video streaming service",null,null,null,null,null,null,"appealed","Not final: the organisation appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250807_2025_0_626_844_00",null],["2025/AT/011","DSB (Austria) - D130.200","gdprhub","Austria","AT","DSB (Austria)","2025-08-07","day",null,null,null,"Google LLC",null,"Art. 12(1), Art. 12(2), Art. 13, Art. 14, Art. 15","Data subject rights, Transparency",null,"Violation found","https://gdprhub.eu/images/9/90/DSB_D.130.200-redacted.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D130.200",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2025/AT/001","ETid-2979","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2025-08-06","day",6200,null,"EUR","Media Company","Media, Telecoms and Broadcasting","Art. 58(2)(d)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250806_2025_0_276_820_00","https://www.enforcementtracker.com/ETid-2979","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.276.820","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/NL/001","AP (The Netherlands) - 05.08.2025","gdprhub","Netherlands","NL","AP (The Netherlands)","2025-08-05","day",null,null,null,null,null,"Art. 15","Data subject rights",null,null,"https://autoriteitpersoonsgegevens.nl/documenten/woo-besluit-onderzoek-datalek-addcomm","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_05.08.2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/023","ETid-2777","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-08-05","day",1000,null,"EUR","Order of Biochemists, Biologists and Chemists in the Romanian Health System","Health Care","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_05.08.2025","https://www.enforcementtracker.com/ETid-2777",null,null,null,null,"RO: order of biochemists biologists and chemists in the romanian health system",null,null,null,null,null,null,null,null,null],["2025/CY/002","ETid-3139","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2025-08-05","day",25000,null,"EUR","Bank of Cyprus Public Company Limited","Finance, Insurance and Consulting","Art. 24, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf#page=33","https://www.enforcementtracker.com/ETid-3139",null,null,null,null,"bank of cyprus public company ltd",null,null,null,null,null,null,null,null,null],["2025/LT/007","VDAI (Lithuania) - 3R-1029","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-08-05","day",null,null,null,"The Lithuanian Border Police",null,"Art. 33(1), Art. 34(1)","Data breach",null,"Violation found","https://vdai.lrv.lt/public/canonical/1754472096/1033/2025-08-05%20sprendimas%20Nr.%203R-1029%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-1029",null,"gdprhub",null,null,"LT: the lithuanian border police",null,null,null,null,null,null,null,null,null],["2025/PL/006","ETid-2765","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-08-04","day",7700,null,"EUR","Non-Public Health Care Institution","Health Care","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3838","https://www.enforcementtracker.com/ETid-2765",null,null,null,null,"PL: non public health care institution",null,null,null,null,null,null,null,null,null],["2025/IT/039","ETid-2869","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-08-04","day",2000,null,"EUR","Linea Stampalibera Società Cooperativa r.I.","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10166287","https://www.enforcementtracker.com/ETid-2869",null,null,null,null,"IT: linea stampalibera societa cooperativa ri",null,null,null,null,null,null,null,null,null],["2025/IT/038","ETid-2870","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-08-04","day",10000,null,"EUR","Comune di Venezia","Public Sector and Education","Art. 25, Art. 32","Accountability, Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10164311","https://www.enforcementtracker.com/ETid-2870","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10164311","gdprhub",null,null,"IT: comune di venezia",null,null,null,null,null,null,null,null,null],["2025/GB/004","ETid-2885","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-08-04","day",230,null,"EUR","Police Officer","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/08/guilty-police-conduct-investigator-fined-after-unlawfully-obtaining-sensitive-case-details/","https://www.enforcementtracker.com/ETid-2885",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/036","ETid-2888","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-08-04","day",80000,null,"EUR","Ospedaliero-Universitaria Careggi","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10166336","https://www.enforcementtracker.com/ETid-2888",null,null,null,null,"IT: ospedaliero universitaria careggi",null,null,null,null,null,null,null,null,null],["2025/LT/008","VDAI (Lithuania) - 3R-1005","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-08-01","day",null,null,null,"Vinted UAB",null,"Art. 6(1)(b)","Unlawful processing",null,"Violation found","https://vdai.lrv.lt/public/canonical/1754649919/1043/2025-08-01%20sprendimas%20Nr.%203R-1005%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-1005",null,"gdprhub",null,null,"vinted uab","Vinted",null,null,null,null,null,null,null,null],["2025/LT/009","VDAI (Lithuania) - 3R-1007","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-08-01","day",null,null,null,"Vinted UAB",null,"Art. 12(3), Art. 15, Art. 5(1)(d), Art. 5(2)","Data principles, Data subject rights, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1754649927/1044/2025-08-01%20sprendimas%20Nr.%203R-1007%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-1007",null,"gdprhub",null,null,"vinted uab","Vinted",null,null,null,null,null,null,null,null],["2025/EE/005","AKI (Estonia) - 2.1.-1/23/1294-3237-26","gdprhub","Estonia","EE","AKI (Estonia)","2025-07-31","day",null,null,null,"Estonian Public Broadcasting",null,"Art. 17(1), Art. 21(1)","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2025-09/31.07.2025%20Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas%20meedia.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-1/23/1294-3237-26",null,"gdprhub",null,null,"EE: estonian public broadcasting",null,null,null,null,null,null,null,null,null],["2025/LT/011","VDAI (Lithuania) - 3R-998","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-07-31","day",null,null,null,null,null,"Art. 4(2)",null,null,"Rejected","https://vdai.lrv.lt/public/canonical/1754369062/1028/2025-07-31%20sprendimas%20Nr.%203R-998%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-998",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2025/SI/007","ETid-3006","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-07-29","day",11614,null,"EUR","Legal Entity",null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_18_2025_7_odlo%C4%8Dba+po+ZP_GLOBA_5%281%29+in+6_GDPR.docx","https://www.enforcementtracker.com/ETid-3006",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/PL/007","ETid-2764","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-07-28","day",4400,null,"EUR","Entrepreneur","Employment",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/pl/138/3834","https://www.enforcementtracker.com/ETid-2764",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/182","AEPD (Spain) - EXP202307113","gdprhub","Spain","ES","AEPD (Spain)","2025-07-25","day",4000000,"4,000,000","EUR",null,null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.aepd.es/documento/ps-00246-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202307113",null,"gdprhub",null,"Communication network provider",null,null,null,null,null,null,null,null,null,null],["2025/SI/009","ETid-3004","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-07-25","day",5810,null,"EUR","Legal Entity",null,"Art. 28(3)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_34_2025_8_odlo%C4%8Dba+po+ZP-1_Globa_96+%C4%8Dlen+ZVOP-2.docx","https://www.enforcementtracker.com/ETid-3004",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/SI/008","ETid-3005","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-07-25","day",5020,null,"EUR","Legal Entity",null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_35_2025_9_odlo%C4%8Dba+po+ZP-1_Globa_96+%C4%8Dlen+ZVOP-2.docx","https://www.enforcementtracker.com/ETid-3005",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HU/001","ETid-3042","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2025-07-24","day",26400,null,"EUR","Debt Collector","Finance, Insurance and Consulting","Art. 17(1)(d), Art. 6(1)","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=1405:koveteleskezelessel-osszefuggo-jogalap-nelkuli-adatkezeles-es-torlesi-kerelem-nem-teljesitese","https://www.enforcementtracker.com/ETid-3042",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/024","ETid-2756","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-07-23","day",5000,null,"EUR","Agricola International SA","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23.07.2025","https://www.enforcementtracker.com/ETid-2756",null,null,null,null,"agricola international sa",null,null,null,null,null,null,null,null,null],["2025/IT/044","ETid-2855","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-23","day",10000,null,"EUR","Order of Nursing Professions of Viterbo","Public Sector and Education","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10161390","https://www.enforcementtracker.com/ETid-2855",null,null,null,null,"IT: order of nursing professions of viterbo",null,null,null,null,null,null,null,null,null],["2025/IT/043","ETid-2856","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-23","day",10000,null,"EUR","SATI S.p.A.","Employment","Art. 9(2)(b)","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10161545","https://www.enforcementtracker.com/ETid-2856",null,null,null,null,"sati spa",null,null,null,null,null,null,null,null,null],["2025/PL/020","UODO (Poland) - DKN.5112.6.2020","gdprhub","Poland","PL","UODO (Poland)","2025-07-23","day",null,"18,416,400","PLN",null,null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://orzeczenia.uodo.gov.pl/document/urn:ndoc:gov:pl:uodo:2020:dkn_5112_6/content","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.6.2020",null,"gdprhub",null,"Bank",null,null,18416400.0,4328687,"day 2025-07-23|4.2545|PLN",null,null,null,null,null],["2025/SI/010","ETid-3003","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-07-22","day",2200,null,"EUR","Legal Entity",null,"Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_101_2024_5_odlo%C4%8Dba+ZP-1_GLOBA_%C4%8Dlen+97+ZVOP-2.docx","https://www.enforcementtracker.com/ETid-3003",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/012","ETid-3100","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-07-22","day",320000,null,"EUR","HEP-Toplinarstvo","Transportation and Energy","Art. 31, Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izrecene-dvije-upravne-novcane-kazne-u-iznosu-od-370-000-eura/","https://www.enforcementtracker.com/ETid-3100",null,null,null,null,"HR: hep toplinarstvo",null,null,null,null,null,null,null,null,null],["2025/HR/013","ETid-3101","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-07-22","day",50000,null,"EUR","Information and Communication Company",null,null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izrecene-dvije-upravne-novcane-kazne-u-iznosu-od-370-000-eura/","https://www.enforcementtracker.com/ETid-3101",null,null,null,null,"HR: information and communication company",null,null,null,null,null,null,null,null,null],["2025/SI/015","IP (Slovenia) - 07105-10/2024/13","gdprhub","Slovenia","SI","IP (Slovenia)","2025-07-22","day",null,null,null,null,null,"Art. 15","Data subject rights",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07105-10/2024/13",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/PL/009","ETid-2757","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-07-21","day",3955000,null,"EUR","McDonald’s Polska Sp. z o.o.","Employment","Art. 25(1), Art. 28(1), Art. 38(1), Art. 5(1)(c)","Accountability, Data principles, Data protection officer, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://uodo.gov.pl/pl/138/3827","https://www.enforcementtracker.com/ETid-2757",null,null,null,null,"mcdonalds polska spzoo",null,null,null,null,null,null,null,null,null],["2025/PL/008","ETid-2758","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-07-21","day",43000,null,"EUR","24/7 Communication Sp. z o.o.","Employment","Art. 25(1), Art. 38(1), Art. 5(1)(c)","Accountability, Data principles, Data protection officer, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3827","https://www.enforcementtracker.com/ETid-2758",null,null,null,null,"24 7 communication spzoo",null,null,null,null,null,null,null,null,null],["2025/GR/007","ETid-2921","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-07-21","day",9000,null,"EUR","Hestia Publishers & Booksellers I. D. Kollaros & Co. S.A.","Industry and Commerce","Art. 25(1), Art. 32(1), Art. 33(1), Art. 34(1), Art. 5(1)(f)","Accountability, Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2025-10/33_2025_anonym.pdf","https://www.enforcementtracker.com/ETid-2921","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_33/2025","gdprhub",null,null,"hestia publishers and booksellers id kollaros and co sa",null,null,null,null,null,null,null,null,null],["2025/AT/010","DSB (Austria) - D130.1000","gdprhub","Austria","AT","DSB (Austria)","2025-07-18","day",null,null,null,"Grindr LLC",null,"Art. 12(2), Art. 12(6), Art. 5(1)(c)","Data principles, Transparency",null,"Other","https://gdprhub.eu/images/5/56/DSB_D130.1000_redacted.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D130.1000",null,"gdprhub",null,null,"grindr llc",null,null,null,null,null,null,null,null,null],["2025/ES/043","ETid-2844","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-18","day",1100,null,"EUR","ADMINISTRACIONES BENIPON, S.L.","Real Estate","Art. 33(2)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.aepd.es/documento/ps-00251-2025.pdf","https://www.enforcementtracker.com/ETid-2844",null,null,null,null,"administraciones benipon sl",null,null,null,null,null,null,null,null,null],["2025/ES/042","ETid-2845","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-18","day",1000,null,"EUR","CLUB BALONCESTO TELDE","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00265-2024.pdf","https://www.enforcementtracker.com/ETid-2845",null,null,null,null,"ES: club baloncesto telde",null,null,null,null,null,null,null,null,null],["2025/ES/045","ETid-2842","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-17","day",200000,null,"EUR","ENDESA ENERGIA, S.A.U.","Transportation and Energy","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00232-2024.pdf","https://www.enforcementtracker.com/ETid-2842","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202308085","gdprhub",null,null,"endesa energia sau",null,null,null,null,null,null,null,null,null],["2025/ES/044","ETid-2843","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-17","day",1200,null,"EUR","TRUEBA SPORT S.L.","Industry and Commerce","Art. 13, Art. 5(1)(f)","Data principles, Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00184-2025.pdf","https://www.enforcementtracker.com/ETid-2843",null,null,null,null,"trueba sport sl",null,null,null,null,null,null,null,null,null],["2025/RO/025","ETid-2755","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-07-16","day",4000,null,"EUR","Georgescu Călin","Individuals and Private Associations","Art. 12, Art. 13, Art. 14","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16.07.2025","https://www.enforcementtracker.com/ETid-2755",null,null,null,null,"RO: georgescu calin",null,null,null,null,null,null,null,null,null],["2025/ES/048","ETid-2760","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-16","day",5400,null,"EUR","SUNERIS, S.A.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00421-2024.pdf","https://www.enforcementtracker.com/ETid-2760",null,null,null,null,"suneris sa",null,null,null,null,null,null,null,null,null],["2025/ES/047","ETid-2761","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-16","day",180000,null,"EUR","TRIVE CREDIT SPAIN, S.L.","Finance, Insurance and Consulting","Art. 58(2)(c)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00495-2024.pdf","https://www.enforcementtracker.com/ETid-2761","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202415922","gdprhub",null,null,"trive credit spain sl",null,null,null,null,null,null,null,null,null],["2025/ES/049","ETid-2759","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-11","day",32000,null,"EUR","VALORA PREVENCIÓN, S.L.U.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00106-2024.pdf","https://www.enforcementtracker.com/ETid-2759",null,null,null,null,"valora prevencion slu",null,null,null,null,null,null,null,null,null],["2025/GR/009","ETid-2880","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-07-11","day",20000,null,"EUR","NN Greek Single-Member Anonymous Life Insurance Company","Finance, Insurance and Consulting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2025-09/32_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2880","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_32/2025","gdprhub",null,null,"GR: nn greek single member anonymous life insurance company",null,null,null,null,null,null,null,null,null],["2025/GR/008","ETid-2881","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-07-11","day",2000,null,"EUR","PAVLOS BIKOS SOLE PROPRIETORSHIP DENTAL PRIVATE CAPITAL COMPANY","Finance, Insurance and Consulting","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dpa.gr/sites/default/files/2025-09/32_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2881",null,null,null,null,"GR: pavlos bikos sole proprietorship dental private capital company",null,null,null,null,null,null,null,null,null],["2025/IT/049","ETid-2767","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-10","day",80000,null,"EUR","Poste Vita S.p.a.","Finance, Insurance and Consulting","Art. 33(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10154110","https://www.enforcementtracker.com/ETid-2767","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10154110","gdprhub",null,null,"poste vita spa",null,null,null,null,null,null,null,null,null],["2025/IT/048","ETid-2768","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-10","day",50000,null,"EUR","Magna PT S.p.A.","Employment","Art. 13, Art. 6, Art. 88, Art. 9","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10154148","https://www.enforcementtracker.com/ETid-2768","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10154148","gdprhub",null,null,"magna pt spa",null,null,null,null,null,null,null,null,null],["2025/IT/042","ETid-2857","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-10","day",3000,null,"EUR","Comune di Conversano","Public Sector and Education","Art. 37(1)","Data protection officer","Lack of appointment of data protection officer","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10161611","https://www.enforcementtracker.com/ETid-2857",null,null,null,null,"IT: comune di conversano",null,null,null,null,null,null,null,null,null],["2025/IT/041","ETid-2860","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-10","day",8000,null,"EUR","Università degli Studi di Cassino e del Lazio Meridionale","Employment","Art. 17, Art. 21","Data principles, Data subject rights","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10162267","https://www.enforcementtracker.com/ETid-2860","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10162267","gdprhub",null,null,"IT: universita degli studi di cassino e del lazio meridionale",null,null,null,null,null,null,null,null,null],["2025/IT/040","ETid-2861","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-10","day",4000,null,"EUR","Istituto Comprensivo 2 C.D. “G. Modugno” S.M. “G. Galilei” di Monopoli","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10162203","https://www.enforcementtracker.com/ETid-2861",null,null,null,null,"IT: istituto comprensivo 2cdg modugno smg galilei di monopoli",null,null,null,null,null,null,null,null,null],["2025/IT/037","ETid-2871","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-10","day",10000,null,"EUR","Nursery School “La Combricola Dei Birichini Di Betty”","Public Sector and Education","Art. 12(1), Art. 13, Art. 35, Art. 37(7), Art. 38(6), Art. 5(1)(a), Art. 6, Art. 7","Consent, DPIA, Data principles, Data protection officer, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10162731","https://www.enforcementtracker.com/ETid-2871","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10162731","gdprhub",null,null,"IT: nursery school la combricola dei birichini di betty",null,null,null,null,null,null,null,null,null],["2025/IT/087","ETid-3141","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-07-10","day",100000,null,"EUR","Banco Bilbao Vizcaya Argentaria SA","Finance, Insurance and Consulting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10168555","https://www.enforcementtracker.com/ETid-3141",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2025/IT/116","Garante per la protezione dei dati personali (Italy) - 10166250","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-07-10","day",null,null,null,"GF",null,"Art. 12, Art. 17, Art. 5(1)(a), Art. 6, Art. 7","Consent, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10166250","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10166250",null,"gdprhub",null,null,"IT: gf",null,null,null,null,null,null,null,null,null],["2025/ES/050","ETid-2749","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-04","day",6000,null,"EUR","CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U.","Transportation and Energy",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00461-2024.pdf","https://www.enforcementtracker.com/ETid-2749",null,null,null,null,"curenergia comercializador de ultimo recurso sau",null,null,null,null,null,null,null,null,null],["2025/GR/012","ETid-2778","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-07-04","day",3000,null,"EUR","Zougla TZI-AP Anonymous Mass Media Company","Media, Telecoms and Broadcasting","Art. 31, Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2025-07/30_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2778",null,null,null,null,"GR: zougla tzi ap anonymous mass media company",null,null,null,null,null,null,null,null,null],["2025/ES/051","ETid-2748","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-07-02","day",900,null,"EUR","ARCONADA 1932, S.L.","Transportation and Energy","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00162-2025.pdf","https://www.enforcementtracker.com/ETid-2748",null,null,null,null,"arconada 1932 sl",null,null,null,null,null,null,null,null,null],["2025/HR/010","ETid-3098","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-07-02","day",101000,null,"EUR","Croatian Insurance Bureau","Public Sector and Education","Art. 5(1)(e)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izreceno-osam-upravnih-novcanih-kazni-u-ukupnom-iznosu-od-350-50000-eura/","https://www.enforcementtracker.com/ETid-3098",null,null,null,null,"HR: croatian insurance bureau",null,null,null,null,null,null,null,null,null],["2025/HR/011","ETid-3099","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-07-02","day",175000,null,"EUR","FAVORIT SPORTSKA KLADIONICA d.o.o.","Industry and Commerce","Art. 5(1)(e)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izreceno-osam-upravnih-novcanih-kazni-u-ukupnom-iznosu-od-350-50000-eura/","https://www.enforcementtracker.com/ETid-3099",null,null,null,null,"favorit sportska kladionica doo",null,null,null,null,null,null,null,null,null],["2025/BE/019","APD/GBA (Belgium) - 111/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-06-30","day",null,null,null,null,null,"Art. 12(3)","Transparency",null,"Violation found","https://www.dataprotectionauthority.be/citizen/publications/decisions","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_111/2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/PL/010","ETid-2730","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-06-30","day",15600,null,"EUR","L. Zamenhof University Children's Clinical Hospital in Białystok","Health Care","Art. 32, Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3803","https://www.enforcementtracker.com/ETid-2730",null,null,null,null,"PL: l zamenhof university children s clinical hospital in biaystok",null,null,null,null,null,null,null,null,null],["2025/RO/029","ETid-2724","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-26","day",3000,null,"EUR","SC Piramida Trade Invest SRL","Employment","Art. 12(3), Art. 15, Art. 17, Art. 21, Art. 32(1)(b), Art. 5(1)(a), Art. 6(1)","Data principles, Data security, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_26.06.2025","https://www.enforcementtracker.com/ETid-2724",null,null,null,null,"piramida trade invest srl",null,null,null,null,null,null,null,null,null],["2025/RO/028","ETid-2725","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-26","day",25000,null,"EUR","Alliance for the Union of Romanians Party","Public Sector and Education","Art. 6(1)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07_07_2025","https://www.enforcementtracker.com/ETid-2725",null,null,null,null,"RO: alliance for the union of romanians party",null,null,null,null,null,null,null,null,null],["2025/RO/027","ETid-2726","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-26","day",3000,null,"EUR","Selgros Cash & Carry SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08_07_2025","https://www.enforcementtracker.com/ETid-2726",null,null,null,null,"selgros cash and carry srl",null,null,null,null,null,null,null,null,null],["2025/RO/026","ETid-2727","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-26","day",3000,null,"EUR","SC Tremend Software Consulting SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09_07_2025","https://www.enforcementtracker.com/ETid-2727",null,null,null,null,"tremend software consulting srl",null,null,null,null,null,null,null,null,null],["2025/ES/052","ETid-2747","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-26","day",96000,null,"EUR","SIDECU, S.A.","Industry and Commerce","Art. 13, Art. 35, Art. 9","DPIA, Data principles, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00289-2024.pdf","https://www.enforcementtracker.com/ETid-2747","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202313347","gdprhub",null,null,"sidecu sa",null,null,null,null,null,null,null,null,null],["2025/GR/011","ETid-2878","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-06-25","day",550000,null,"EUR","Vodafone – PANAFON A.E.E.T.","Media, Telecoms and Broadcasting","Art. 5(1)(d)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2025-09/27_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2878",null,null,null,null,"GR: vodafone panafon aeet","Vodafone",null,null,null,null,null,null,null,null],["2025/GR/010","ETid-2879","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-06-25","day",40000,null,"EUR","KARAMBELAS KONSTANTINOS & CO. E.E.","Media, Telecoms and Broadcasting","Art. 29, Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2025-09/27_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2879",null,null,null,null,"GR: karambelas konstantinos and co ee",null,null,null,null,null,null,null,null,null],["2025/GR/026","HDPA (Greece) - 27/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-06-25","day",740000,"740,000","EUR","Vodafone",null,"Art. 28(1), Art. 28(3), Art. 29, Art. 32, Art. 5(1)(d)","Data principles, Data security, Processor obligations",null,"Violation found","https://www.dpa.gr/sites/default/files/2025-09/27_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_27/2025",null,"gdprhub",null,null,"GR: vodafone","Vodafone",null,null,null,null,null,null,null,null],["2025/DK/002","Datatilsynet (Denmark) - 2023-442-0197","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2025-06-24","day",null,null,null,"Digitaliseringsstyrelsen (Danish Agency for Digitalisation)",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2025/jun/digitaliseringsstyrelsen-faar-alvorlig-kritik-for-mangelfulde-sikkerhedsforanstaltninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-442-0197",null,"gdprhub",null,null,"DK: digitaliseringsstyrelsen",null,null,null,null,null,null,null,null,null],["2025/GR/014","ETid-2750","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-06-24","day",7000,null,"EUR","General Hospital of the University of Larissa","Health Care","Art. 14, Art. 15, Art. 5(2)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2025-07/17_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2750",null,null,null,null,"GR: general hospital of the university of larissa",null,null,null,null,null,null,null,null,null],["2025/GR/013","ETid-2754","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-06-24","day",10000,null,"EUR","Shield of David - K.I.D.A.F.","Health Care","Art. 12, Art. 13, Art. 15, Art. 24, Art. 31, Art. 5","Accountability, Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2025-07/31_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2754","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_31/2025","gdprhub",null,null,"GR: shield of david kidaf",null,null,null,null,null,null,null,null,null],["2025/GB/005","ETid-2766","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-06-24","day",20725,null,"EUR","Birthlink","Individuals and Private Associations","Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/bvljtpy2/birthlink-mpn.pdf","https://www.enforcementtracker.com/ETid-2766","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Birthlink","gdprhub",null,null,"GB: birthlink",null,null,null,null,null,null,null,null,null],["2025/IE/001","ETid-2684","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2025-06-23","day",125000,null,"EUR","City of Dublin Education and Training Board","Public Sector and Education","Art. 33(1), Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/en/news-media/press-releases/inquiry-city-dublin-education-and-training-board-cdetb","https://www.enforcementtracker.com/ETid-2684",null,null,null,null,"IE: city of dublin education and training board",null,null,null,null,null,null,null,null,null],["2025/RO/053","ETid-2700","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-23","day",4000,null,"EUR","Vodafone Romania S.A.","Media, Telecoms and Broadcasting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_23_06_2025&lang=ro","https://www.enforcementtracker.com/ETid-2700",null,null,null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2025/GR/015","ETid-2728","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-06-23","day",50000,null,"EUR","Piraeus Bank S.A.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2025-07/23_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2728",null,null,null,null,"GR: piraeus bank",null,null,null,null,null,null,null,null,null],["2025/PL/011","ETid-2729","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-06-23","day",3500,null,"EUR","Municipal Social Welfare Center Aleksandrów","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3793","https://www.enforcementtracker.com/ETid-2729",null,null,null,null,"PL: municipal social welfare center aleksandrow",null,null,null,null,null,null,null,null,null],["2025/IT/113","Garante per la protezione dei dati personali (Italy) - 10161361","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-06-23","day",null,null,null,"A municipality",null,"Art. 37(7), Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(e), Art. 6(2), Art. 6(3)","Data principles, Data protection officer, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10161361","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10161361",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/LT/006","VDAI (Lithuania) - 3R-753","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-06-23","day",null,null,null,null,null,"Art. 2(2)(c), Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://vdai.lrv.lt/public/canonical/1751455491/992/2025-06-23%20sprendimas%20Nr.%203R-753(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-753",null,"gdprhub",null,"Neighbour",null,null,null,null,null,"person",null,null,null,null],["2025/ES/054","ETid-2745","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-20","day",24000,null,"EUR","COLEGIO VIRGEN DE EUROPA, S.L.","Public Sector and Education","Art. 13, Art. 5(1)(f), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00070-2025.pdf","https://www.enforcementtracker.com/ETid-2745","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202315180","gdprhub",null,null,"colegio virgen de europa sl",null,null,null,null,null,null,null,null,null],["2025/ES/053","ETid-2746","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-20","day",42000,null,"EUR","IBERCAJA BANCO, S.A.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00246-2025.pdf","https://www.enforcementtracker.com/ETid-2746",null,null,null,null,"ibercaja banco sa",null,null,null,null,null,null,null,null,null],["2025/RO/030","ETid-2723","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-19","day",1000,null,"EUR","SC Diamir SRL","Industry and Commerce","Art. 6(1)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_19.06.2025","https://www.enforcementtracker.com/ETid-2723",null,null,null,null,"diamir srl",null,null,null,null,null,null,null,null,null],["2025/SE/002","ETid-2680","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2025-06-18","day",6800,null,"EUR","AB Storstockholms Lokaltrafik","Transportation and Energy","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2025/beslut-efter-tillsyn-sl.pdf","https://www.enforcementtracker.com/ETid-2680","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2024-1521","gdprhub",null,null,"ab storstockholms lokaltrafik",null,null,null,null,null,null,null,null,null],["2025/SE/001","ETid-2681","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2025-06-18","day",6800,null,"EUR","Waxholms Ångfartygs AB","Transportation and Energy","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2025/beslut-efter-tillsyn-waab.pdf","https://www.enforcementtracker.com/ETid-2681",null,null,null,null,"waxholms angfartygs ab",null,null,null,null,null,null,null,null,null],["2025/RO/031","ETid-2722","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-18","day",200,null,"EUR","Dincă Viorel George","Individuals and Private Associations",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_18_06_2025","https://www.enforcementtracker.com/ETid-2722",null,null,null,null,"RO: dinca viorel george",null,null,null,null,null,null,null,null,null],["2025/GR/033","HDPA (Greece) - 45/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-06-17","day",null,null,null,"Hellenic Police",null,null,null,null,null,"https://www.dpa.gr/sites/default/files/2026-01/45_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_45/2025",null,"gdprhub",null,null,"GR: hellenic police",null,null,null,null,null,null,null,null,null],["2025/LT/004","VDAI (Lithuania) - 3R-728","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-06-17","day",null,null,null,"UAB Diagnostikos laboratorija",null,"Art. 12(3), Art. 24(1)","Accountability, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1750333960/981/2025-06-17%20sprendimas%20Nr.%203R-728%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-728",null,"gdprhub",null,null,"uab diagnostikos laboratorija",null,null,null,null,null,null,null,null,null],["2025/ES/056","ETid-2743","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-16","day",3000,null,"EUR","SILVANERGIA 2022, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00201-2025.pdf","https://www.enforcementtracker.com/ETid-2743","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202414144","gdprhub",null,null,"silvanergia 2022 sl",null,null,null,null,null,null,null,null,null],["2025/ES/055","ETid-2744","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-16","day",12000,null,"EUR","ALBOR ENERGÍA S.L.","Transportation and Energy","Art. 28","Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00206-2025.pdf","https://www.enforcementtracker.com/ETid-2744","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202504911","gdprhub",null,null,"albor energia sl",null,null,null,null,null,null,null,null,null],["2025/ES/058","ETid-2741","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-13","day",18000,null,"EUR","OCI CINE, S.L.","Industry and Commerce","Art. 32, Art. 5(1)(d)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00536-2024.pdf","https://www.enforcementtracker.com/ETid-2741","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202409828","gdprhub",null,null,"oci cine sl",null,null,null,null,null,null,null,null,null],["2025/ES/057","ETid-2742","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-13","day",540,null,"EUR","CUBILLO GALLEGO, S.L.","Real Estate","Art. 58(2)(d)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00041-2025.pdf","https://www.enforcementtracker.com/ETid-2742",null,null,null,null,"cubillo gallego sl",null,null,null,null,null,null,null,null,null],["2025/IE/002","ETid-2657","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2025-06-12","day",550000,null,"EUR","Departement of Social Security","Public Sector and Education","Art. 13(1)(c), Art. 13(2)(a), Art. 6(1), Art. 9(1)","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ie/en/news-media/press-releases/dpc-announces-conclusion-investigation-use-facial-matching-technology-connection-public-services","https://www.enforcementtracker.com/ETid-2657",null,null,null,null,"IE: departement of social security",null,null,null,null,null,null,null,null,null],["2025/RO/069","ETid-2659","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-06-12","day",10000,null,"EUR","Accounting Audit SRL","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_10_06_2025&lang=ro","https://www.enforcementtracker.com/ETid-2659",null,null,null,null,"accounting audit srl",null,null,null,null,null,null,null,null,null],["2025/NO/004","Datatilsynet (Norway) - 24/01059-9","gdprhub","Norway","NO","Datatilsynet (Norway)","2025-06-10","day",null,null,null,"Norsk Helseinformatikk AS",null,"Art. 6(1), Art. 9(1)","Special categories, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/d503c1527a66493eb00be998240e0a09/vedtak-om-irettesettelse--tilsyn-med-sporingsverktoy--norsk-helseinformatikk-as-nhi.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_24/01059-9",null,"gdprhub",null,null,"norsk helseinformatikk as",null,null,null,null,null,null,null,null,null],["2025/NO/001","ETid-2658","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2025-06-10","day",22000,null,"EUR","Kristiansand municipality","Public Sector and Education","Art. 12, Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/d503c1527a66493eb00be998240e0a09/vedtak-om-overtredelsesgebyr---tilsyn-med-sporingsverktoy---alarmtelefonen-116111.no.pdf","https://www.enforcementtracker.com/ETid-2658","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_NO_-_DPA_-_24/01055-10","gdprhub",null,null,"NO: kristiansand municipality",null,null,null,null,null,null,null,null,null],["2025/ES/135","AEPD (Spain) - EXP202302270","gdprhub","Spain","ES","AEPD (Spain)","2025-06-05","day",200000,"200,000","EUR","CAIXABANK S.A.",null,"Art. 5(1)(e), Art. 6(1)(b)","Data principles, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00140-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202302270",null,"gdprhub",null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2025/BE/018","APD/GBA (Belgium) - 91/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-06-05","day",null,null,null,null,null,"Art. 12(1), Art. 13, Art. 17, Art. 30(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-91-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_91/2025",null,"gdprhub",null,"Daycare center",null,null,null,null,null,null,null,null,null,null],["2025/GB/006","ETid-2656","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-06-05","day",2700000,null,"EUR","23andMe, Inc.","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/kclbljpo/23andme-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-2656",null,null,null,null,"23andme inc",null,null,null,null,null,null,null,null,null],["2025/GB/014","ICO (UK) - 23andMe Inc","gdprhub","United Kingdom","GB","ICO (UK)","2025-06-05","day",null,"2.310.000","GBP","23andMe Inc",null,"Art. 32(1)(b), Art. 32(1)(d), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/06/23andme-fined-for-failing-to-protect-uk-users-genetic-data/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_23andMe_Inc",null,"gdprhub",null,null,"23andme inc",null,2310000.0,2743794,"day 2025-06-05|0.8419|GBP",null,null,null,null,null],["2025/IT/053","ETid-2683","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-06-04","day",45000,null,"EUR","Noi Compriamo Auto.it S.r.l.","Industry and Commerce","Art. 12(2), Art. 24, Art. 28, Art. 5(2), Art. 6(1)(a)","Accountability, Data principles, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10143278","https://www.enforcementtracker.com/ETid-2683","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10143278","gdprhub",null,null,"noi compriamo auto it srl",null,null,null,null,null,null,null,null,null],["2025/ES/059","ETid-2740","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-06-04","day",21000,null,"EUR","ALVEA SOLUCIONES TECNOLÓGICAS, S.L.","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00517-2024.pdf","https://www.enforcementtracker.com/ETid-2740","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_AEPD_-_EXP202414290","gdprhub",null,null,"alvea soluciones tecnologicas sl",null,null,null,null,null,null,null,null,null],["2025/IT/107","Garante per la protezione dei dati personali (Italy) - 10152729","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-06-04","day",null,null,null,"Confalonieri S.r.l.",null,"Art. 12, Art. 13, Art. 4(11), Art. 5, Art. 7","Consent, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10152729","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10152729",null,"gdprhub",null,null,"confalonieri srl",null,null,null,null,null,null,null,null,null],["2025/IT/114","Garante per la protezione dei dati personali (Italy) - 10152755","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-06-04","day",null,null,null,"Centralcar S.p.a.",null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 4(11), Art. 5, Art. 7","Accountability, Consent, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10152755","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10152755",null,"gdprhub",null,null,"centralcar spa",null,null,null,null,null,null,null,null,null],["2025/SI/014","IP (Slovenia) - 0602-18/2024/43","gdprhub","Slovenia","SI","IP (Slovenia)","2025-06-04","day",null,null,null,null,null,"Art. 12, Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0602-18/2024/43",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/178","AEPD (Spain) - EXP202400905","gdprhub","Spain","ES","AEPD (Spain)","2025-06-03","day",100000,"100,000","EUR","GOLDCAR SPAIN, S.L.",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00215-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202400905",null,"gdprhub",null,null,"goldcar spain sl",null,null,null,null,null,null,null,null,null],["2025/AT/006","ETid-2731","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2025-06-03","day",16000,null,"EUR","Car Park Management Company","Industry and Commerce","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250603_2025_0_177_424_00","https://www.enforcementtracker.com/ETid-2731",null,null,null,null,"AT: car park management company",null,null,null,null,null,"appealed","Not final: the fined party appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250603_2025_0_177_424_00",16000],["2025/LT/005","VDAI (Lithuania) - 3R-661","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-06-03","day",null,null,null,"UAB Medical Score",null,"Art. 12(3), Art. 15(1), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1749207248/968/2025-06-03%20sprendimas%20Nr.%203R-661%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-661",null,"gdprhub",null,null,"uab medical score",null,null,null,null,null,null,null,null,null],["2025/ES/168","AEPD (Spain) - EXP202501567","gdprhub","Spain","ES","AEPD (Spain)","2025-05-31","day",3000,"3,000","EUR","Wallapop S.L.",null,null,null,null,"Violation found","https://www.aepd.es/documento/ps-00160-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202501567",null,"gdprhub",null,null,"wallapop sl",null,null,null,null,null,null,null,null,null],["2025/ES/137","AEPD (Spain) - EXP202301365","gdprhub","Spain","ES","AEPD (Spain)","2025-05-30","day",200000,"200,000","EUR","XFERA MÓVILES, S.A.",null,"Art. 6(1), Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00170-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202301365",null,"gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2025/ES/154","AEPD (Spain) - EXP202311911","gdprhub","Spain","ES","AEPD (Spain)","2025-05-30","day",200000,"200,000","EUR","DIGI SPAIN TELECOM, S.L.",null,"Art. 6(1), Art. 6(1)(a), Art. 6(1)(b), Art. 82(2)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/reposicion-ps-00097-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202311911",null,"gdprhub",null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2025/RO/032","ETid-2721","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-30","day",5000,null,"EUR","AG-BROKER ASIGURARE S.R.L.","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_30.05.2025","https://www.enforcementtracker.com/ETid-2721",null,null,null,null,"ag broker asigurare srl",null,null,null,null,null,null,null,null,null],["2025/ES/060","ETid-2739","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-30","day",42000,null,"EUR","LVMH IBERIA, S.L.","Employment","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00192-2024.pdf","https://www.enforcementtracker.com/ETid-2739","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202310848","gdprhub",null,null,"lvmh iberia sl",null,null,null,null,null,null,null,null,null],["2025/FI/003","ETid-2647","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2025-05-27","day",1100000,null,"EUR","Yliopiston Apteekin","Health Care",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://finlex.fi/fi/viranomaiset/tietosuojavaltuutettu/2025/2473","https://www.enforcementtracker.com/ETid-2647","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/108/2022","gdprhub",null,null,"FI: yliopiston apteekin",null,null,null,null,null,null,null,null,null],["2025/ES/061","ETid-2738","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-26","day",1380000,null,"EUR","REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L.","Transportation and Energy","Art. 32, Art. 5(1)(d)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00090-2024.pdf","https://www.enforcementtracker.com/ETid-2738","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202207990","gdprhub",null,null,"repsol comercializadora de electricidad y gas sl",null,null,null,null,null,null,null,null,null],["2025/ES/164","AEPD (Spain) - EXP202410264","gdprhub","Spain","ES","AEPD (Spain)","2025-05-23","day",10000,"10,000","EUR","ADNAYA GREEN SOLUTIONS",null,"Art. 6(1), Art. 83(1), Art. 83(2)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00440-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202410264",null,"gdprhub",null,null,"ES: adnaya green solutions",null,null,null,null,null,null,null,null,null],["2025/ES/062","ETid-2737","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-23","day",60000,null,"EUR","AIRE NETWORKS DEL MEDITERRÃNEO, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00025-2025.pdf","https://www.enforcementtracker.com/ETid-2737",null,null,null,null,"aire networks del mediterraneo sl",null,null,null,null,null,null,null,null,null],["2025/ES/085","ETid-2624","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-22","day",1200,null,"EUR","Attorney","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00032-2025.pdf","https://www.enforcementtracker.com/ETid-2624",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/033","ETid-2720","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-22","day",1000,null,"EUR","MP Dumitru Viorel Focșa","Public Sector and Education","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_22_05_2025","https://www.enforcementtracker.com/ETid-2720",null,null,null,null,"RO: mp dumitru viorel focsa",null,null,null,null,null,null,null,null,null],["2025/ES/160","AEPD (Spain) - EXP202313830","gdprhub","Spain","ES","AEPD (Spain)","2025-05-21","day",3000,"3,000","EUR","Silvanergia 2022, S.L",null,"Art. 28(3), Art. 6(1), Art. 83(1), Art. 83(2)(a), Art. 83(2)(b), Art. 83(2)(g), Art. 83(5)(a)","Processor obligations, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00201-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202313830",null,"gdprhub",null,null,"silvanergia 2022 sl",null,null,null,null,null,null,null,null,null],["2025/IT/054","ETid-2682","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-05-21","day",420000,null,"EUR","Autostrade per l’Italia S.p.A.","Employment","Art. 6, Art. 88","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10143261","https://www.enforcementtracker.com/ETid-2682","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10143261","gdprhub",null,null,"autostrade per litalia spa",null,null,null,null,null,null,null,null,null],["2025/RO/034","ETid-2719","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-21","day",12000,null,"EUR","Data Diggers Market Research SRL","Industry and Commerce","Art. 12(1), Art. 14, Art. 15, Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_21_05_2025","https://www.enforcementtracker.com/ETid-2719",null,null,null,null,"data diggers market research srl",null,null,null,null,null,null,null,null,null],["2025/ES/063","ETid-2736","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-21","day",200000,null,"EUR","TELEFÓNICA MÓVILES ESPAÑA, S.A.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00159-2024.pdf","https://www.enforcementtracker.com/ETid-2736","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202307361","gdprhub",null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2025/IT/051","ETid-2752","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-05-21","day",7000,null,"EUR","Health Protection Agency of the Metropolitan City of Milan, Workplace Prevention and Safety Service, Milan North","Public Sector and Education","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10143721","https://www.enforcementtracker.com/ETid-2752",null,null,null,null,"IT: health protection agency of the metropolitan city of milan workplace prevention and safety service milan north",null,null,null,null,null,null,null,null,null],["2025/IT/050","ETid-2753","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-05-21","day",21000,null,"EUR","Menarini Silicon Biosystems SpA","Health Care","Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10149917","https://www.enforcementtracker.com/ETid-2753",null,null,null,null,"menarini silicon biosystems spa",null,null,null,null,null,null,null,null,null],["2025/GR/022","HDPA (Greece) - 18/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-05-21","day",null,null,null,null,null,"Art. 27, Art. 3(3)",null,null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/entoli-orismoy-ekprosopoy-stin-etaireia-hangzhou-deepseek-artificial","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_18/2025",null,"gdprhub",null,"Provider of DeepSeek AI",null,null,null,null,null,null,null,null,null,null],["2025/GB/013","ICO (UK) - London Borough of Hammersmith & Fulham Council","gdprhub","United Kingdom","GB","ICO (UK)","2025-05-21","day",null,null,null,"London Borough of Hammersmith & Fulham Council",null,null,null,null,"Violation found","https://ico.org.uk/media2/fjojafbq/london-borough-of-hammersmith-and-fulham-reprimand.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_London_Borough_of_Hammersmith_%26_Fulham_Council",null,"gdprhub",null,null,"GB: london borough of hammersmith and fulham council",null,null,null,null,null,null,null,null,null],["2025/BE/017","APD/GBA (Belgium) - 88/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-05-20","day",null,null,null,null,null,"Art. 15, Art. 20","Data subject rights",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-88-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_88/2025",null,"gdprhub",null,"Screen capture software provider",null,null,null,null,null,null,null,null,null,null],["2025/ES/064","ETid-2735","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-20","day",360,null,"EUR","RED ESPAÑOLA DE IDENTIFICACIÓN DE ANIMALES DE COMPAÑÍA","Individuals and Private Associations","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00212-2025.pdf","https://www.enforcementtracker.com/ETid-2735",null,null,null,null,"ES: red espanola de identificacion de animales de compania",null,null,null,null,null,null,null,null,null],["2025/ES/077","ETid-2642","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-19","day",1000,null,"EUR","Home Owner Association","Individuals and Private Associations","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00447-2024.pdf","https://www.enforcementtracker.com/ETid-2642","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202406389","gdprhub",null,null,"ES: home owner association",null,null,null,null,null,null,null,null,null],["2025/RO/035","ETid-2718","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-19","day",5000,null,"EUR","Maravet S.R.L.","Health Care",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_19.05.2025","https://www.enforcementtracker.com/ETid-2718",null,null,null,null,"maravet srl",null,null,null,null,null,null,null,null,null],["2025/ES/065","ETid-2734","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-19","day",200000,null,"EUR","ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.","Finance, Insurance and Consulting","Art. 17, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00157-2024.pdf","https://www.enforcementtracker.com/ETid-2734","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202305732","gdprhub",null,null,"asnef equifax servicios de informacion sobre solvencia y credito sl",null,null,null,null,null,null,null,null,null],["2025/RO/036","ETid-2717","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-16","day",5000,null,"EUR","ACCOUNTING & AUDIT CONSULTING SRL","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_16_05_2025","https://www.enforcementtracker.com/ETid-2717",null,null,null,null,"accounting and audit consulting srl",null,null,null,null,null,null,null,null,null],["2025/ES/066","ETid-2733","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-16","day",30000,null,"EUR","ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00175-2024.pdf","https://www.enforcementtracker.com/ETid-2733",null,null,null,null,"atresmedia corporacion de medios de comunicacion sa",null,null,null,null,null,null,null,null,null],["2025/FR/011","ETid-2610","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-05-15","day",900000,null,"EUR","SOLOCAL MARKETING SERVICES","Media, Telecoms and Broadcasting","Art. 6, Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051630617","https://www.enforcementtracker.com/ETid-2610","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-001","gdprhub",null,null,"FR: solocal marketing services",null,null,null,null,null,null,null,null,null],["2025/FR/010","ETid-2630","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-05-15","day",80000,null,"EUR","CALOGA","Media, Telecoms and Broadcasting","Art. 5(1)(e), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051660380","https://www.enforcementtracker.com/ETid-2630","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2025-002","gdprhub",null,null,"FR: caloga",null,null,null,null,null,null,null,null,null],["2025/LT/003","VDAI (Lithuania) - 3R-537","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-05-15","day",null,null,null,null,null,"Art. 13(1), Art. 13(2), Art. 15(1)(b), Art. 15(1)(g), Art. 33(5), Art. 5(1)(a)","Data breach, Data principles, Data subject rights, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1747655502/880/2025-05-15%20sprendimas%20Nr.%203R-537%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-537",null,"gdprhub",null,"Politician",null,null,null,null,null,"person",null,null,null,null],["2025/RO/037","ETid-2716","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-14","day",2000,null,"EUR","CVA TAX & FINANCE S.R.L.","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_14_05_2025","https://www.enforcementtracker.com/ETid-2716",null,null,null,null,"cva tax and finance srl",null,null,null,null,null,null,null,null,null],["2025/SI/011","ETid-3002","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-05-14","day",16000,null,"EUR","Oddaja sob","Accommodation and Hospitality","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609+91+2024+16_odlo%C4%8Dba+o+prekr%C5%A1ku_globa_kr%C5%A1itev+5+in+6+%C4%8Dlen+SUVP.odt","https://www.enforcementtracker.com/ETid-3002",null,null,null,null,"SI: oddaja sob",null,null,null,null,null,null,null,null,null],["2025/RO/038","ETid-2715","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-13","day",2000,null,"EUR","Romoffice Construct Holding Ag SRL","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_13_05_2025","https://www.enforcementtracker.com/ETid-2715",null,null,null,null,"romoffice construct holding ag srl",null,null,null,null,null,null,null,null,null],["2025/ES/067","ETid-2732","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-13","day",100000,null,"EUR","PLATAFORMA CABANILLAS SA.","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00162-2024.pdf","https://www.enforcementtracker.com/ETid-2732","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202405048","gdprhub",null,null,"plataforma cabanillas sa",null,null,null,null,null,null,null,null,null],["2025/RO/039","ETid-2714","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-12","day",2000,null,"EUR","CV PRO CONSULT S.R.L.","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_12_05_2025","https://www.enforcementtracker.com/ETid-2714",null,null,null,null,"cv pro consult srl",null,null,null,null,null,null,null,null,null],["2025/ES/079","ETid-2640","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-09","day",6600,null,"EUR","Owner of a Pharmacy Office","Health Care","Art. 14, Art. 32, Art. 6(1)","Data principles, Data security, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00190-2025.pdf","https://www.enforcementtracker.com/ETid-2640",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/078","ETid-2641","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-09","day",120000,null,"EUR","UNIÓN DE CRÉDITO PARA LA FINANCIACIÓN MOBILIARIA E INMOBILIARIA EFC","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00209-2024.pdf","https://www.enforcementtracker.com/ETid-2641",null,null,null,null,"union de credito para la financiacion mobiliaria e inmobiliaria efc",null,null,null,null,null,null,null,null,null],["2025/RO/040","ETid-2713","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-05-09","day",5000,null,"EUR","ROUMASPORT SRL","Employment","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_09.05.2025","https://www.enforcementtracker.com/ETid-2713",null,null,null,null,"roumasport srl",null,null,null,null,null,null,null,null,null],["2025/ES/080","ETid-2639","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-05-08","day",6600,null,"EUR","Owner of a Pharmacy Office","Health Care","Art. 14, Art. 32, Art. 6(1)","Data principles, Data security, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00177-2025.pdf","https://www.enforcementtracker.com/ETid-2639",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/SE/006","IMY (Sweden) - 2024-2347","gdprhub","Sweden","SE","IMY (Sweden)","2025-05-06","day",null,null,null,"Consulate General of Sweden in Istanbul",null,"Art. 28(1), Art. 32(1)","Data security, Processor obligations",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2025/tillsynsbeslut-sveriges-generalkonsulat-istanbul.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_2024-2347",null,"gdprhub",null,null,"SE: consulate general of sweden in istanbul",null,null,null,null,null,null,null,null,null],["2025/IE/003","ETid-2584","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2025-05-02","day",530000000,null,"EUR","TikTok Technology Limited","Media, Telecoms and Broadcasting","Art. 13(1)(f), Art. 46(1)","International transfers, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tiktok-eu530-million-and-orders-corrective-measures-following","https://www.enforcementtracker.com/ETid-2584","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_TikTok","gdprhub",null,null,"tiktok technology ltd","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2025/LU/001","ETid-2939","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2025-04-30","day",7000,null,"EUR","Company","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2025/dcision-de-la-fr-nr-3fr-2025-du-30-avril-2025-version-pseudonymise.pdf","https://www.enforcementtracker.com/ETid-2939","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_3FR/2025_du_30_avril_2025","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/075","ETid-2648","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",30000,null,"EUR","Ordine degli psicologi della Lombardia","Public Sector and Education","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10134827","https://www.enforcementtracker.com/ETid-2648","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10134827","gdprhub",null,null,"IT: ordine degli psicologi della lombardia",null,null,null,null,null,null,null,null,null],["2025/IT/066","ETid-2668","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",50000,null,"EUR","Regione Lombardia","Employment","Art. 25, Art. 28, Art. 35, Art. 6, Art. 88","Accountability, DPIA, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10134221","https://www.enforcementtracker.com/ETid-2668","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10134221","gdprhub",null,null,"IT: regione lombardia",null,null,null,null,null,null,null,null,null],["2025/IT/058","ETid-2676","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",2000,null,"EUR","Versilmagra Immobiliare di Robertelli Davide & C. S.a.s.","Real Estate","Art. 12, Art. 14, Art. 15, Art. 17, Art. 21(2), Art. 24, Art. 25, Art. 6(1)(a), Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10134847","https://www.enforcementtracker.com/ETid-2676",null,null,null,null,"IT: versilmagra immobiliare di robertelli davide and csas",null,null,null,null,null,null,null,null,null],["2025/IT/056","ETid-2678","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",40000,null,"EUR","MA Immobiliare S.r.l.s.","Real Estate","Art. 12, Art. 13, Art. 14, Art. 15, Art. 24, Art. 25, Art. 6(1)(a), Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10134791","https://www.enforcementtracker.com/ETid-2678","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10134791","gdprhub",null,null,"ma immobiliare srls",null,null,null,null,null,null,null,null,null],["2025/IT/055","ETid-2679","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",2000,null,"EUR","Tirrenia Hospital S.r.l.","Health Care","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10139193","https://www.enforcementtracker.com/ETid-2679",null,null,null,null,"tirrenia hospital srl",null,null,null,null,null,null,null,null,null],["2025/IT/052","ETid-2751","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",100000,null,"EUR","Energia Verde S.p.A.","Transportation and Energy","Art. 12, Art. 15, Art. 16, Art. 17, Art. 18, Art. 19, Art. 20, Art. 21, Art. 22, Art. 24, Art. 28, Art. 31, Art. 5, Art. 58, Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10145986","https://www.enforcementtracker.com/ETid-2751","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10145986","gdprhub",null,null,"energia verde spa",null,null,null,null,null,null,null,null,null],["2025/IT/047","ETid-2774","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",20000,null,"EUR","Cooperativa Sociale Quadrifoglio","Health Care","Art. 28(3), Art. 32(1)","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10146337","https://www.enforcementtracker.com/ETid-2774","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10146337","gdprhub",null,null,"IT: cooperativa sociale quadrifoglio",null,null,null,null,null,null,null,null,null],["2025/IT/046","ETid-2775","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",1200,null,"EUR","Municipality of San Francesco al Campo","Public Sector and Education","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10145821","https://www.enforcementtracker.com/ETid-2775","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10145821","gdprhub",null,null,"IT: municipality of san francesco al campo",null,null,null,null,null,null,null,null,null],["2025/IT/045","ETid-2776","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-29","day",40000,null,"EUR","Municipality of Bologna","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10146543","https://www.enforcementtracker.com/ETid-2776","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10146543","gdprhub",null,null,"IT: municipality of bologna",null,null,null,null,null,null,null,null,null],["2025/IT/100","Garante per la protezione dei dati personali (Italy) - 10139147","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-04-29","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 4(11), Art. 5, Art. 7","Accountability, Consent, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10139147","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10139147",null,"gdprhub",null,"Business",null,null,null,null,null,null,null,null,null,null],["2025/IT/121","Garante per la protezione dei dati personali (Italy) - 10145853","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-04-29","day",null,null,null,"Google",null,"Art. 17","Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10145853","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10145853",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2025/IT/105","Garante per la protezione dei dati personali (Italy) - 10146249","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-04-29","day",null,null,null,"MF Service S.r.l.",null,"Art. 16","Data subject rights",null,"Rejected","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10146249","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10146249",null,"gdprhub",null,null,"mf service srl",null,null,null,null,null,null,null,null,null],["2025/CH/001","EDÖB/PFPDT/IFPDT (Switzerland) - Inkasso-Team AG","gdprhub","Switzerland","CH","EDÖB/PFPDT/IFPDT (Switzerland)","2025-04-28","day",null,"3,200","CHF","Inkasso-Team AG",null,null,null,null,"Violation found","https://backend.edoeb.admin.ch/fileservice/sdweb-docs-prod-edoebch-files/files/2025/06/30/7c3dba1d-bfd7-4419-a5e1-e5a1a5fcf613.pdf","https://gdprhub.eu/index.php?title=ED%C3%96B/PFPDT/IFPDT_%28Switzerland%29_-_Inkasso-Team_AG",null,"gdprhub",null,null,"inkasso team ag",null,3200.0,3397,"day 2025-04-28|0.9420|CHF",null,null,null,null,null],["2025/RO/041","ETid-2712","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-28","day",1000,null,"EUR","Xiting ROM SRL","Industry and Commerce",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_28_04_2025","https://www.enforcementtracker.com/ETid-2712",null,null,null,null,"xiting rom srl",null,null,null,null,null,null,null,null,null],["2025/SE/004","IMY (Sweden) - 2023-16452","gdprhub","Sweden","SE","IMY (Sweden)","2025-04-28","day",null,null,null,"Aller Media AB",null,"Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2025/tillsynsbeslut-aller-media-ab.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_2023-16452",null,"gdprhub",null,null,"aller media ab",null,null,null,null,null,null,null,null,null],["2025/RO/042","ETid-2711","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-25","day",6000,null,"EUR","SC Travel Planner SRL","Industry and Commerce","Art. 15, Art. 32, Art. 33","Data breach, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_25_04_2025","https://www.enforcementtracker.com/ETid-2711",null,null,null,null,"travel planner srl",null,null,null,null,null,null,null,null,null],["2025/SI/012","ETid-3001","cms_tracker","Slovenia","SI","Slovenian Supervisory Authority (Informacijski pooblaščenec)","2025-04-25","day",1000,null,"EUR",null,"Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ip-rs.si/go?u=%2Ffileadmin%2Fuser_upload%2Fdocx%2FSUVP%2F0609_35_2024_6_Globa+po+ZP-1_83+clen_5+odstavek_tocka+a.odt","https://www.enforcementtracker.com/ETid-3001",null,null,null,"Sole trader",null,null,null,null,null,"person",null,null,null,null],["2025/BE/016","APD/GBA (Belgium) - 76/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-04-24","day",null,null,null,null,null,"Art. 12(2), Art. 15, Art. 17, Art. 24(1), Art. 5(1)(a), Art. 6, Art. 6(1)(f)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-76-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_76/2025",null,"gdprhub",null,"Retail company",null,null,null,null,null,null,null,null,null,null],["2025/BE/015","APD/GBA (Belgium) - 79/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-04-24","day",null,null,null,"Service Public fédéral Finances",null,"Art. 12(1), Art. 14(1), Art. 14(2), Art. 24, Art. 35(1), Art. 5(2)","Accountability, DPIA, Data principles, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-79-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_79/2025",null,"gdprhub",null,null,"BE: service public federal finances",null,null,null,null,null,null,null,null,null],["2025/BE/003","ETid-2614","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2025-04-24","day",6000,null,"EUR","Real Estate Agency","Real Estate","Art. 17(1), Art. 21(2), Art. 6(1)","Cooperation with the DPA, Data subject rights, Unlawful processing","Insufficient cooperation with supervisory authority","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-80-2025.pdf","https://www.enforcementtracker.com/ETid-2614",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/068","ETid-2667","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-24","day",1500,null,"EUR","ULPIA TRAJANA ALAMEDA S.L.","Accommodation and Hospitality","Art. 5(1)(c), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00546-2024.pdf","https://www.enforcementtracker.com/ETid-2667",null,null,null,null,"ulpia trajana alameda sl",null,null,null,null,null,null,null,null,null],["2025/RO/043","ETid-2710","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-24","day",10000,null,"EUR","Dante International SA","Industry and Commerce","Art. 12(1), Art. 17, Art. 19","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_24_04_2025","https://www.enforcementtracker.com/ETid-2710",null,null,null,null,"dante international sa",null,null,null,null,null,null,null,null,null],["2025/SE/007","IMY (Sweden) - 2023-2522","gdprhub","Sweden","SE","IMY (Sweden)","2025-04-24","day",null,null,null,"Sjukhusstyrelsen i Region Uppsala",null,"Art. 32(1)","Data security",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2025/tillsynsbeslut-region-uppsala.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_2023-2522",null,"gdprhub",null,null,"SE: sjukhusstyrelsen i region uppsala",null,null,null,null,null,null,null,null,null],["2025/BE/014","APD/GBA (Belgium) - 73/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-04-23","day",null,null,null,"Bpost",null,"Art. 5(1)(c), Art. 5(1)(e), Art. 6(1)(c)","Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-73-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_73/2025",null,"gdprhub",null,null,"BE: bpost",null,null,null,null,null,null,null,null,null],["2025/SE/003","ETid-2598","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2025-04-23","day",9200,null,"EUR","Diskrimineringsombudsmannen","Public Sector and Education","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2025/tillsynsbeslut-do.pdf","https://www.enforcementtracker.com/ETid-2598",null,null,null,null,"SE: diskrimineringsombudsmannen",null,null,null,null,null,null,null,null,null],["2025/ES/192","AEPD (Spain) - PS-00637-2025","gdprhub","Spain","ES","AEPD (Spain)","2025-04-22","day",4000,"4000.0","EUR","BODENSE ESTRUCTURAS Y CALDELERÍA, S.L.",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00637-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00637-2025",null,"gdprhub",null,null,"bodense estructuras y caldeleria sl",null,null,null,null,null,null,null,null,null],["2025/BE/011","APD/GBA (Belgium) - 71/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-04-22","day",null,null,null,null,null,"Art. 25, Art. 5(1)(c), Art. 60","Accountability, Data principles",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-71-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_71/2025",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2025/BE/004","ETid-2613","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2025-04-22","day",20000,null,"EUR","Company","Industry and Commerce","Art. 12(1), Art. 24(1), Art. 25(1), Art. 6(1)","Accountability, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-72-2025.pdf","https://www.enforcementtracker.com/ETid-2613","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_72/2025","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/084","ETid-2625","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-22","day",1200,null,"EUR","SERVICIOS DE INTEGRACIÓN DE ANDALUCÍA","Employment","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00393-2024.pdf","https://www.enforcementtracker.com/ETid-2625",null,null,null,null,"ES: servicios de integracion de andalucia",null,null,null,null,null,null,null,null,null],["2025/ES/083","ETid-2626","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-22","day",12000,null,"EUR","NOVATES ALIMENTACIÓN MADRID, S.L.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00345-2024.pdf","https://www.enforcementtracker.com/ETid-2626","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202407160","gdprhub",null,null,"novates alimentacion madrid sl",null,null,null,null,null,null,null,null,null],["2025/ES/082","ETid-2627","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-22","day",1200,null,"EUR","FUNDACIÓ PRIVADA DE SERVEIS PER ALS USUARIS DEL HABITATGE SOCIAL DE CATALUNYA","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00382-2024.pdf","https://www.enforcementtracker.com/ETid-2627",null,null,null,null,"ES: fundacio privada de serveis per als usuaris del habitatge social de catalunya",null,null,null,null,null,null,null,null,null],["2025/BE/013","APD/GBA (Belgium) - DOS-2022-02223","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-04-18","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)(e), Art. 8(1), Art. 9(2)(a)","Consent, Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-70-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_DOS-2022-02223",null,"gdprhub","School; Knowledge center Z",null,null,null,null,null,null,null,null,null,null,null],["2025/PL/013","ETid-2589","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-04-15","day",7800,null,"EUR","Funeral Home","Health Care","Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3639","https://www.enforcementtracker.com/ETid-2589",null,null,null,null,"PL: funeral home",null,null,null,null,null,null,null,null,null],["2025/ES/086","ETid-2623","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-15","day",600,null,"EUR",null,null,"Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00535-2024.pdf","https://www.enforcementtracker.com/ETid-2623","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202409823","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/044","ETid-2709","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-15","day",2000,null,"EUR","United Business Solutions SRL","Accommodation and Hospitality",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_15_04_2025","https://www.enforcementtracker.com/ETid-2709",null,null,null,null,"united business solutions srl",null,null,null,null,null,null,null,null,null],["2025/ES/046","ETid-2838","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-15","day",260000,null,"EUR","CAMERDATA, S.A.","Media, Telecoms and Broadcasting","Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00146-2024.pdf","https://www.enforcementtracker.com/ETid-2838","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202404641","gdprhub",null,null,"camerdata sa",null,null,null,null,null,null,null,null,null],["2025/ES/029","ETid-2874","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-15","day",500000,null,"EUR","Chamber of Commerce, Industry, Services and Navigation of Spain","Public Sector and Education","Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00145-2024.pdf","https://www.enforcementtracker.com/ETid-2874","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202301678","gdprhub",null,null,"ES: chamber of commerce industry services and navigation of spain",null,null,null,null,null,null,null,null,null],["2025/ES/176","AEPD (Spain) - EXP202404644","gdprhub","Spain","ES","AEPD (Spain)","2025-04-14","day",1800000,"1,800,000","EUR","INFORMA D&B, S.A.",null,"Art. 14, Art. 14(5)(b), Art. 6(1)","Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00149-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202404644",null,"gdprhub",null,null,"ES: informa d and bsa",null,null,null,null,null,null,null,null,null],["2025/ES/173","AEPD (Spain) - EXP202404646","gdprhub","Spain","ES","AEPD (Spain)","2025-04-14","day",42000,"42,000","EUR","DEYDE DATACENTRIC, S.L.U",null,"Art. 14, Art. 14(5)(b), Art. 5(2), Art. 6(1), Art. 6(1)(f)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00151-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202404646",null,"gdprhub",null,null,"deyde datacentric slu",null,null,null,null,null,null,null,null,null],["2025/GB/007","ETid-2566","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-04-14","day",70300,null,"EUR","DPP Law Ltd.","Finance, Insurance and Consulting","Art. 33(1), Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/pr4bg5hq/dpp-law-ltd-monetary-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-2566","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_DPP_Law_Ltd","gdprhub",null,null,"dpp law ltd",null,null,null,null,null,null,null,null,null],["2025/ES/088","ETid-2621","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-14","day",3000,null,"EUR","EDA TV CONSULTING, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00443-2024.pdf","https://www.enforcementtracker.com/ETid-2621","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202209077","gdprhub",null,null,"eda tv consulting sl",null,null,null,null,null,null,null,null,null],["2025/ES/087","ETid-2622","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-14","day",6000,null,"EUR","LÃSER METALPRINT 3D, S.L.","Industry and Commerce","Art. 28","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.aepd.es/documento/ps-00107-2025.pdf","https://www.enforcementtracker.com/ETid-2622",null,null,null,null,"laser metalprint 3d sl",null,null,null,null,null,null,null,null,null],["2025/RO/045","ETid-2708","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-14","day",1000,null,"EUR","Office Nova Concept SRL","Real Estate","Art. 15(3), Art. 17, Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_14_04_2025","https://www.enforcementtracker.com/ETid-2708",null,null,null,null,"office nova concept srl",null,null,null,null,null,null,null,null,null],["2025/ES/133","AEPD (Spain) - EXP202303454","gdprhub","Spain","ES","AEPD (Spain)","2025-04-11","day",200000,"200,000","EUR","SD IBERIAN PORTFOLIOS, S.A",null,"Art. 5(1), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00102-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202303454","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202312279","gdprhub",null,null,"sd iberian portfolios sa",null,null,null,null,null,null,null,null,null],["2025/RO/046","ETid-2707","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-11","day",2000,null,"EUR","NEW GAMBLING SOLUTIONS S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_11_04_2025","https://www.enforcementtracker.com/ETid-2707",null,null,null,null,"new gambling solutions srl",null,null,null,null,null,null,null,null,null],["2025/IT/077","ETid-2611","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",5000000,null,"EUR","Luka Inc.","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 24, Art. 25(1), Art. 6","Accountability, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10130115#english","https://www.enforcementtracker.com/ETid-2611","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10130115","gdprhub",null,null,"luka inc",null,null,null,null,null,null,null,null,null],["2025/IT/073","ETid-2660","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",3000000,null,"EUR","Acea Energia S.p.A.","Transportation and Energy","Art. 13, Art. 24, Art. 25, Art. 28, Art. 32, Art. 6, Art. 7","Accountability, Consent, Data security, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10127930","https://www.enforcementtracker.com/ETid-2660","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10127930","gdprhub",null,null,"acea energia spa",null,null,null,null,null,null,null,null,null],["2025/IT/072","ETid-2661","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",850000,null,"EUR","Network of Agencies and Companies","Media, Telecoms and Broadcasting","Art. 13, Art. 28, Art. 29, Art. 31, Art. 32, Art. 58(1)(a), Art. 6, Art. 7","Consent, Data principles, Data security, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10127964","https://www.enforcementtracker.com/ETid-2661",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/IT/063","ETid-2671","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",15000,null,"EUR","Immobiliare Valdalpone S.r.l.","Real Estate","Art. 12, Art. 13, Art. 14, Art. 15, Art. 17, Art. 21(2), Art. 24, Art. 25, Art. 6(1)(a), Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10134918","https://www.enforcementtracker.com/ETid-2671",null,null,null,null,"immobiliare valdalpone srl",null,null,null,null,null,null,null,null,null],["2025/IT/062","ETid-2672","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",8000,null,"EUR","Eastern Parma Apennine Mountain Community","Public Sector and Education","Art. 12, Art. 13, Art. 5(1)(a), Art. 6, Art. 88(1)","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10139433","https://www.enforcementtracker.com/ETid-2672",null,null,null,null,"IT: eastern parma apennine mountain community",null,null,null,null,null,null,null,null,null],["2025/IT/061","ETid-2673","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",5000,null,"EUR","Patronage and Assistance for Citizens and Agriculture Board","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10140301","https://www.enforcementtracker.com/ETid-2673",null,null,null,null,"IT: patronage and assistance for citizens and agriculture board",null,null,null,null,null,null,null,null,null],["2025/IT/060","ETid-2674","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",4000,null,"EUR","Municipality of Ponte nelle Alpi","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10140369","https://www.enforcementtracker.com/ETid-2674",null,null,null,null,"IT: municipality of ponte nelle alpi",null,null,null,null,null,null,null,null,null],["2025/IT/059","ETid-2675","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-04-10","day",8000,null,"EUR","Undici S.r.l.s.","Real Estate","Art. 12, Art. 13, Art. 14, Art. 15, Art. 24, Art. 25, Art. 6(1)(a), Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10135041","https://www.enforcementtracker.com/ETid-2675",null,null,null,null,"undici srls",null,null,null,null,null,null,null,null,null],["2025/RO/047","ETid-2706","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-10","day",15000,null,"EUR","Tensa Art Design S.A.","Industry and Commerce","Art. 15, Art. 17, Art. 6(1)(a)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_10_04_2025","https://www.enforcementtracker.com/ETid-2706",null,null,null,null,"tensa art design sa",null,null,null,null,null,null,null,null,null],["2025/ES/089","ETid-2620","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-09","day",600,null,"EUR","FEDERACION DE COLUMBICULTURA DE CASTILLA-LA MANCHA","Individuals and Private Associations","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00359-2024.pdf","https://www.enforcementtracker.com/ETid-2620",null,null,null,null,"ES: federacion de columbicultura de castilla la mancha",null,null,null,null,null,null,null,null,null],["2025/GR/016","ETid-2650","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-04-09","day",5000,null,"EUR","Gynaecologist","Health Care","Art. 15","Data subject rights, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dpa.gr/sites/default/files/2025-06/11_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-2650","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_11/2025","gdprhub",null,null,"GR: gynaecologist",null,null,null,null,null,null,null,null,null],["2025/ES/119","ETid-3192","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-07","day",14400000,null,"EUR","AMADEUS IT GROUP, S.A.","Transportation and Energy","Art. 14, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00005-2025.pdf","https://www.enforcementtracker.com/ETid-3192",null,null,null,null,"amadeus it group sa",null,null,null,null,null,null,null,null,null],["2025/ES/131","AEPD (Spain) - EXP202205208","gdprhub","Spain","ES","AEPD (Spain)","2025-04-04","day",70000,"70,000","EUR","XFERA MÓVILES, S.A.",null,"Art. 5(1)(d), Art. 5(2)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00066-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202205208",null,"gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2025/ES/106","ETid-2567","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-04","day",120000,null,"EUR","BANCO BILBAO VIZCAYA ARGENTARIA, S.A.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00253-2024.pdf","https://www.enforcementtracker.com/ETid-2567","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202305408","gdprhub",null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2025/ES/090","ETid-2619","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-04","day",360,null,"EUR","SINDICAT CATAC-CTSC",null,"Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00013-2025.pdf","https://www.enforcementtracker.com/ETid-2619",null,null,null,null,"ES: sindicat catac ctsc",null,null,null,null,null,null,null,null,null],["2025/LT/002","VDAI (Lithuania) - 3R-345","gdprhub","Lithuania","LT","VDAI (Lithuania)","2025-04-04","day",null,null,null,null,null,"Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://vdai.lrv.lt/public/canonical/1744089556/825/2025-04-04%20sprendimas%20Nr.%20345%20(2.13-1.E).pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-345",null,"gdprhub",null,"Employment Service",null,null,null,null,null,null,null,null,null,null],["2025/ES/081","ETid-2628","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-04-03","day",600,null,"EUR","Owner of a Law Firm","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00566-2024.pdf","https://www.enforcementtracker.com/ETid-2628",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/048","ETid-2705","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-03","day",5000,null,"EUR","Banca Transilvania S.A.","Finance, Insurance and Consulting","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_03_04_2025","https://www.enforcementtracker.com/ETid-2705",null,null,null,null,"banca transilvania sa",null,null,null,null,null,null,null,null,null],["2025/ES/145","AEPD (Spain) - EXP202400903","gdprhub","Spain","ES","AEPD (Spain)","2025-04-02","day",500,"500","EUR","Terra, Brasa Y Mar",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00261-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202400903",null,"gdprhub",null,null,"ES: terra brasa y mar",null,null,null,null,null,null,null,null,null],["2025/EE/004","AKI (Estonia) - 2.1-1/24/1083-2664-12","gdprhub","Estonia","EE","AKI (Estonia)","2025-04-02","day",null,null,null,"Register OÜ",null,"Art. 15(1)(c)","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/documents/2025-05/Ettekirjutus-hoiatus%20isikuandmete%20kaitse%20asjas%20nr%202.1-1%2024%201083-2664-12%20Register%20O%C3%9C.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-1/24/1083-2664-12",null,"gdprhub",null,null,"register ou",null,null,null,null,null,null,null,null,null],["2025/RO/049","ETid-2704","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-04-02","day",3000,null,"EUR","BINBOX GLOBAL SERVICES S.R.L.","Media, Telecoms and Broadcasting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_02_04_2025","https://www.enforcementtracker.com/ETid-2704",null,null,null,null,"binbox global services srl",null,null,null,null,null,null,null,null,null],["2025/MT/001","ETid-3142","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2025-04-02","day",20000,null,"EUR","Hospital","Health Care","Art. 14, Art. 16, Art. 37(1)(c), Art. 5(1)(a), Art. 6(1)","Data principles, Data protection officer, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://idpc.org.mt/wp-content/uploads/2025/04/0476_001.pdf","https://www.enforcementtracker.com/ETid-3142",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/BE/010","APD/GBA (Belgium) - 64/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-04-01","day",null,null,null,null,null,"Art. 24, Art. 32(1), Art. 33(1), Art. 4(7), Art. 5(1)(f)","Accountability, Data breach, Data principles, Data security",null,"Rejected","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-64-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_64/2025",null,"gdprhub",null,"Hospital manager",null,null,null,null,null,"person",null,null,null,null],["2025/ES/171","AEPD (Spain) - EXP202409001","gdprhub","Spain","ES","AEPD (Spain)","2025-03-31","day",20000,"20,000","EUR","vodafone",null,"Art. 7(1)","Consent",null,"Violation found","https://www.aepd.es/documento/ps-00435-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202409001",null,"gdprhub",null,null,"ES: vodafone","Vodafone",null,null,null,null,null,null,null,null],["2025/ES/091","ETid-2618","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-30","day",3500,null,"EUR","MAD COOL FESTIVAL S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00456-2024.pdf","https://www.enforcementtracker.com/ETid-2618",null,null,null,null,"mad cool festival sl",null,null,null,null,null,null,null,null,null],["2025/ES/104","ETid-2569","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-28","day",120000,null,"EUR","SERVICIOS ESPECIALES, S.A.","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00505-2024.pdf","https://www.enforcementtracker.com/ETid-2569","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202411409","gdprhub",null,null,"servicios especiales sa",null,null,null,null,null,null,null,null,null],["2025/ES/073","ETid-2651","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-28","day",12000,null,"EUR","ESTUDIO ALCAZAR DEL GENIL 2022, S.L.","Real Estate","Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00023-2025.pdf","https://www.enforcementtracker.com/ETid-2651","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202308051","gdprhub",null,null,"estudio alcazar del genil 2022 sl",null,null,null,null,null,null,null,null,null],["2025/ES/072","ETid-2652","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-28","day",21600,null,"EUR","SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L.","Industry and Commerce","Art. 28, Art. 5(1)(e), Art. 7","Consent, Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00021-2025.pdf","https://www.enforcementtracker.com/ETid-2652","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202309454","gdprhub",null,null,"school fitness holiday and franchising sl",null,null,null,null,null,null,null,null,null],["2025/ES/071","ETid-2653","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-28","day",4000,null,"EUR","CREMA GAMES, S.L.","Media, Telecoms and Broadcasting","Art. 15","Data subject rights, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00169-2024.pdf","https://www.enforcementtracker.com/ETid-2653",null,null,null,null,"crema games sl",null,null,null,null,null,null,null,null,null],["2025/ES/070","ETid-2654","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-28","day",6600,null,"EUR","GRUAS IGNACI, S.L.","Industry and Commerce","Art. 13, Art. 32, Art. 5(1)(c)","Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00287-2024.pdf","https://www.enforcementtracker.com/ETid-2654",null,null,null,null,"gruas ignaci sl",null,null,null,null,null,null,null,null,null],["2025/IT/065","ETid-2669","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-27","day",3000,null,"EUR","Municipality of Palma di Montechiaro","Public Sector and Education",null,"Data protection officer","Lack of appointment of data protection officer","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10138964","https://www.enforcementtracker.com/ETid-2669","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10138964","gdprhub",null,null,"IT: municipality of palma di montechiaro",null,null,null,null,null,null,null,null,null],["2025/IT/064","ETid-2670","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-27","day",4000,null,"EUR","Istituto di Istruzione Superiore \"P. Galluppi\" Tropea","Employment","Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10138981","https://www.enforcementtracker.com/ETid-2670",null,null,null,null,"IT: istituto di istruzione superiore p galluppi tropea",null,null,null,null,null,null,null,null,null],["2025/IT/057","ETid-2677","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-27","day",18000,null,"EUR","Multiple Companies","Industry and Commerce","Art. 12(1), Art. 13, Art. 6(1)(a)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10140216","https://www.enforcementtracker.com/ETid-2677",null,null,null,null,"IT: multiple companies",null,null,null,null,null,null,null,null,null],["2025/GB/012","ICO (UK) - AFK Letters Co. Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2025-03-27","day",null,"90,000","GBP","AFK Letters Co. Ltd",null,null,null,null,"Violation found","https://ico.org.uk/media2/sqmnjxcs/afk-letters-co-ltd-monetary-penalty-notice.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_AFK_Letters_Co._Ltd",null,"gdprhub",null,null,"afk letters co ltd",null,90000.0,108020,"day 2025-03-27|0.8332|GBP",null,null,null,null,null],["2025/GB/008","ETid-2561","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2025-03-26","day",3500000,null,"EUR","Advanced Computer Software Group Ltd","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media2/gdlfddgc/advanced-penalty-notice-20250327.pdf","https://www.enforcementtracker.com/ETid-2561","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Advanced_Computer_Software_Group_Limited","gdprhub",null,null,"advanced computer software group ltd",null,null,null,null,null,null,null,null,null],["2025/RO/050","ETid-2703","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-25","day",25000,null,"EUR","NTT DATA ROMANIA S.A.","Industry and Commerce","Art. 33(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_25.03.2025","https://www.enforcementtracker.com/ETid-2703",null,null,null,null,"ntt data romania sa",null,null,null,null,null,null,null,null,null],["2025/ES/128","AEPD (Spain) - EXP202304094","gdprhub","Spain","ES","AEPD (Spain)","2025-03-24","day",70000,"70000","EUR","Telefonico Servicios Integrales de Distribucion",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00406-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202304094",null,"gdprhub",null,null,"ES: telefonico servicios integrales de distribucion",null,null,null,null,null,null,null,null,null],["2025/PL/014","ETid-2588","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-03-24","day",17600,null,"EUR","Chief Commander of the Police","Public Sector and Education","Art. 6(1), Art. 9(1)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/decyzje/DS.523.4750.2023","https://www.enforcementtracker.com/ETid-2588",null,null,null,null,"PL: chief commander of the police",null,null,null,null,null,null,null,null,null],["2025/HR/008","ETid-2603","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-03-24","day",80000,null,"EUR","Company","Transportation and Energy","Art. 5(1)(b), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/","https://www.enforcementtracker.com/ETid-2603",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/007","ETid-2604","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-03-24","day",40000,null,"EUR","Company","Media, Telecoms and Broadcasting","Art. 12, Art. 14, Art. 30, Art. 6(1)(f)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/","https://www.enforcementtracker.com/ETid-2604",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/006","ETid-2605","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-03-24","day",20000,null,"EUR","Hospital","Health Care","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/","https://www.enforcementtracker.com/ETid-2605",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/005","ETid-2606","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-03-24","day",4000,null,"EUR","Hospital","Health Care","Art. 13, Art. 14(2)(f), Art. 25(1), Art. 28(3)","Accountability, Data principles, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/","https://www.enforcementtracker.com/ETid-2606",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/004","ETid-2607","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-03-24","day",3000,null,"EUR","Hospital","Health Care","Art. 13, Art. 32, Art. 33, Art. 34(1)","Data breach, Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/","https://www.enforcementtracker.com/ETid-2607",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/003","ETid-2608","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-03-24","day",12000,null,"EUR","Casino","Industry and Commerce","Art. 37","Data protection officer","Lack of appointment of data protection officer","Fine issued","https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/","https://www.enforcementtracker.com/ETid-2608",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/HR/002","ETid-2609","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2025-03-24","day",10000,null,"EUR","Oil and fat manufacturer","Industry and Commerce","Art. 37","Data protection officer","Lack of appointment of data protection officer","Fine issued","https://azop.hr/sedam-novih-upravnih-novcanih-kazni-u-iznosu-od-169-000-eura/","https://www.enforcementtracker.com/ETid-2609",null,null,null,null,"HR: oil and fat manufacturer",null,null,null,null,null,null,null,null,null],["2025/ES/074","ETid-2645","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-24","day",2000,null,"EUR","INDEPENDENTS DE VALLROMANES","Public Sector and Education","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00118-2023.pdf","https://www.enforcementtracker.com/ETid-2645",null,null,null,null,"ES: independents de vallromanes",null,null,null,null,null,null,null,null,null],["2025/RO/051","ETid-2702","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-21","day",1000,null,"EUR","Bucharest Down Town Hotel SRL","Accommodation and Hospitality","Art. 12(3), Art. 13, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_21.03.2025","https://www.enforcementtracker.com/ETid-2702",null,null,null,null,"bucharest down town hotel srl",null,null,null,null,null,null,null,null,null],["2025/RO/076","ANSPDCP (Romania) - One United Properties SA","gdprhub","Romania","RO","ANSPDCP (Romania)","2025-03-20","day",null,"9,994","RON","One United Properties SA",null,"Art. 12(3), Art. 15, Art. 17, Art. 6","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_20.03.2025&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_One_United_Properties_SA",null,"gdprhub",null,null,"one united properties sa",null,9994.0,2008,"day 2025-03-20|4.9769|RON",null,null,null,null,null],["2025/ES/076","ETid-2643","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-20","day",4800,null,"EUR","TECNOCRÃTICA CENTRO DE DATOS S.L.","Media, Telecoms and Broadcasting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00119-2024.pdf","https://www.enforcementtracker.com/ETid-2643",null,null,null,null,"tecnocratica centro de datos sl",null,null,null,null,null,null,null,null,null],["2025/ES/075","ETid-2644","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-20","day",500,null,"EUR","GALENICUM HEALTH, S.L.U.","Health Care","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00544-2023.pdf","https://www.enforcementtracker.com/ETid-2644",null,null,null,null,"galenicum health slu",null,null,null,null,null,null,null,null,null],["2025/RO/052","ETid-2701","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-20","day",2000,null,"EUR","ONE UNITED PROPERTIES S.A","Real Estate","Art. 12(3), Art. 15, Art. 17, Art. 6","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_20.03.2025","https://www.enforcementtracker.com/ETid-2701",null,null,null,null,"one united properties sa",null,null,null,null,null,null,null,null,null],["2025/SI/013","IP (Slovenia) - 0600-43/2024/12","gdprhub","Slovenia","SI","IP (Slovenia)","2025-03-20","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0600-43/2024/12",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2025/ES/142","AEPD (Spain) - EXP202414976","gdprhub","Spain","ES","AEPD (Spain)","2025-03-17","day",1000,"1000","EUR","Club Rapido de Bouzas",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00460-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202414976",null,"gdprhub",null,null,"ES: club rapido de bouzas",null,null,null,null,null,null,null,null,null],["2025/PL/016","ETid-2563","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-03-17","day",null,null,"EUR","Poczta Polska SA (Polish Post)","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/pl/138/3590","https://www.enforcementtracker.com/ETid-2563",null,null,null,null,"PL: poczta polska",null,null,null,null,null,null,null,null,null],["2025/PL/015","ETid-2587","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-03-17","day",23500,null,"EUR","Minister of Digital Affairs","Public Sector and Education","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.1.2025","https://www.enforcementtracker.com/ETid-2587","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.1.2025","gdprhub",null,null,"PL: minister of digital affairs",null,null,null,null,null,null,null,null,null],["2025/ES/092","ETid-2586","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-14","day",1600000,null,"EUR","ING BANK N.V., SUCURSAL EN ESPAÑA","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00531-2023.pdf","https://www.enforcementtracker.com/ETid-2586","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202213634","gdprhub",null,null,"ing bank nv sucursal en espana","ING",null,null,null,null,null,null,null,null],["2025/ES/069","ETid-2655","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-03-14","day",3200000,null,"EUR","CENTROS COMERCIALES CARREFOUR, S.A.","Industry and Commerce","Art. 32, Art. 34, Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00128-2024.pdf","https://www.enforcementtracker.com/ETid-2655","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202305979","gdprhub",null,null,"centros comerciales carrefour sa","Carrefour",null,null,null,null,null,null,null,null],["2025/IT/076","ETid-2612","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-13","day",50000,null,"EUR","Azienda regionale per lo sviluppo e per i servizi in agricoltura (ARSAC)","Public Sector and Education","Art. 13, Art. 25, Art. 35, Art. 5, Art. 6, Art. 88","Accountability, DPIA, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10128005","https://www.enforcementtracker.com/ETid-2612",null,null,null,null,"IT: azienda regionale per lo sviluppo e per i servizi in agricoltura",null,null,null,null,null,null,null,null,null],["2025/IT/071","ETid-2662","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-13","day",15000,null,"EUR","G@S Telecomunicazioni di Losito Lucia","Industry and Commerce","Art. 13, Art. 14, Art. 5(1)(a), Art. 6, Art. 7","Consent, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10137409","https://www.enforcementtracker.com/ETid-2662",null,null,null,null,"IT: gs telecomunicazioni di losito lucia",null,null,null,null,null,null,null,null,null],["2025/IT/070","ETid-2663","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-13","day",2000,null,"EUR","l’Istituto Alberghiero Mediterraneo di Pulsano","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10127792","https://www.enforcementtracker.com/ETid-2663",null,null,null,null,"IT: listituto alberghiero mediterraneo di pulsano",null,null,null,null,null,null,null,null,null],["2025/IT/069","ETid-2664","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-13","day",20000,null,"EUR","Encore Thermoengineering s.r.l.","Industry and Commerce","Art. 17, Art. 6","Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10138760","https://www.enforcementtracker.com/ETid-2664",null,null,null,null,"encore thermoengineering srl",null,null,null,null,null,null,null,null,null],["2025/IT/068","ETid-2665","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-13","day",40000,null,"EUR","Interflora Italia S.p.A.","Industry and Commerce","Art. 12(3), Art. 15, Art. 21, Art. 6(1)(a)","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10138948","https://www.enforcementtracker.com/ETid-2665","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10138948","gdprhub",null,null,"interflora italia spa",null,null,null,null,null,null,null,null,null],["2025/IT/067","ETid-2666","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-03-13","day",2000,null,"EUR","Municipality of Roccaraso","Employment",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10127776","https://www.enforcementtracker.com/ETid-2666",null,null,null,null,"IT: municipality of roccaraso",null,null,null,null,null,null,null,null,null],["2025/IT/098","Garante per la protezione dei dati personali (Italy) - 10132518","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-03-13","day",null,null,null,"Google",null,"Art. 17","Data subject rights",null,"Rejected","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10132518","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10132518",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2025/RO/054","ETid-2699","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-12","day",5000,null,"EUR","Automobilus International S.R.L.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_12_03_2025","https://www.enforcementtracker.com/ETid-2699",null,null,null,null,"automobilus international srl",null,null,null,null,null,null,null,null,null],["2025/ES/141","AEPD (Spain) - EXP202313983","gdprhub","Spain","ES","AEPD (Spain)","2025-03-11","day",1200,"1200","EUR",null,null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00138-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202313983",null,"gdprhub",null,"Accommodation provider",null,null,null,null,null,null,null,null,null,null],["2025/PL/012","ETid-2590","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2025-03-11","day",13400,null,"EUR","Polskie Radio Szczecin","Media, Telecoms and Broadcasting","Art. 24(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3585","https://www.enforcementtracker.com/ETid-2590",null,null,null,null,"PL: polskie radio szczecin",null,null,null,null,null,null,null,null,null],["2025/RO/055","ETid-2698","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-11","day",1000,null,"EUR","Noy Business Tranzactions SRL","Accommodation and Hospitality","Art. 15(3), Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_11.03.2025","https://www.enforcementtracker.com/ETid-2698",null,null,null,null,"noy business tranzactions srl",null,null,null,null,null,null,null,null,null],["2025/DE/005","BfDI (Germany) - Vodafone","gdprhub","Germany","DE","BfDI (Germany)","2025-03-10","day",45000000,"45,000,000","EUR","Vodafone",null,"Art. 28(1), Art. 32(1)","Data security, Processor obligations",null,"Violation found","https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2025/06_Geldbu%25C3%259Fe-Vodafone.html","https://gdprhub.eu/index.php?title=BfDI_%28Germany%29_-_Vodafone",null,"gdprhub",null,null,"DE: vodafone","Vodafone",null,null,null,null,null,null,null,null],["2025/BG/003","CPDP (Bulgaria) - Teachers \"blacklist\"","gdprhub","Bulgaria","BG","CPDP (Bulgaria)","2025-03-10","day",null,null,null,null,null,"Art. 6(1)(a)","Unlawful processing",null,null,"https://cpdp.bg/%25d0%25b2%25d1%258a%25d0%25b2-%25d0%25b2%25d1%2580%25d1%258a%25d0%25b7%25d0%25ba%25d0%25b0-%25d1%2581-%25d0%25bf%25d1%2583%25d0%25b1%25d0%25bb%25d0%25b8%25d0%25ba%25d1%2583%25d0%25b2%25d0%25b0%25d0%25bd%25d0%25b5-%25d0%25bd%25d0%25b0-%25d1%2587%25d0%25b5%25d1%2580%25d0%25b5%25d0%25bd-%25d1%2581%25d0%25bf%25d0%25b8%25d1%2581/","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_Teachers_%22blacklist%22",null,"gdprhub",null,"Event organiser",null,null,null,null,null,null,null,null,null,null],["2025/NO/003","Datatilsynet (Norway) - 21/03823-45","gdprhub","Norway","NO","Datatilsynet (Norway)","2025-03-10","day",null,"4,000,000","NOK","Telenor ASA",null,"Art. 24(1), Art. 24(2), Art. 37, Art. 38, Art. 39","Accountability, Data protection officer",null,"Violation found","https://www.datatilsynet.no/contentassets/46e5764f637941b6b4d7666984ae0df8/decision---dpo-role-in-telenor-asa_english-translation_redacted_.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/03823-45",null,"gdprhub",null,null,"telenor asa",null,4000000.0,342745,"day 2025-03-10|11.6705|NOK",null,null,null,null,null],["2025/NO/002","ETid-2573","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2025-03-10","day",338000,null,"EUR","Telenor ASA.","Media, Telecoms and Broadcasting","Art. 37(7)","Data principles, Data protection officer","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.no/en/news/aktuelle-nyheter-2025/sanctions-imposed-on-telenor-asa-for-lack-in-the-organisation-of-the-data-protection-officer-and-lack-of-internal-control/","https://www.enforcementtracker.com/ETid-2573",null,null,null,null,"telenor asa",null,null,null,null,null,null,null,null,null],["2025/CY/001","ETid-2837","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2025-03-10","day",10000,null,"EUR","Housing Finance Corporation","Finance, Insurance and Consulting","Art. 24(1)","Accountability, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/5725C0D6228A7C40C2258CE3003D5CA0/$file/2025%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20-%20%CE%9F%CE%A7%CE%A3.pdf","https://www.enforcementtracker.com/ETid-2837","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_Housing_Finance_Corporation","gdprhub",null,null,"housing finance corp",null,null,null,null,null,null,null,null,null],["2025/DE/003","ETid-2781","cms_tracker","Germany","DE","Data Protection Authority of Baden-Württemberg","2025-03-07","day",3500,null,"EUR","Police Officer","Individuals and Private Associations","Art. 5(1), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/datenabfrage-fuer-private-zwecke-3-500-euro-bussgeld/","https://www.enforcementtracker.com/ETid-2781",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/056","ETid-2697","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-06","day",2000,null,"EUR","SHOPBAG GROUP ONLINE SRL","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_06_03_2025","https://www.enforcementtracker.com/ETid-2697",null,null,null,null,"shopbag group online srl",null,null,null,null,null,null,null,null,null],["2025/PL/018","UODO (Poland) - DKN.5112.10.2024","gdprhub","Poland","PL","UODO (Poland)","2025-03-06","day",null,"56,824","PLN","An unnamed news outlet",null,"Art. 24(1), Art. 32(1), Art. 32(2)","Accountability, Data security",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5112.10.2024","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.10.2024",null,"gdprhub",null,null,"PL: an unnamed news outlet",null,56824.0,13604,"day 2025-03-06|4.1770|PLN",null,null,null,null,null],["2025/RO/074","ANSPDCP (Romania) - Webrasoft SRL","gdprhub","Romania","RO","ANSPDCP (Romania)","2025-03-04","day",null,"99,518","RON",null,null,"Art. 32(1)(b), Art. 32(1)(d), Art. 32(2)","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_04_03_2025&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Webrasoft_SRL",null,"gdprhub",null,"E-billing website",null,null,99518.0,19996,"day 2025-03-04|4.9769|RON",null,null,null,null,null],["2025/RO/057","ETid-2696","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-04","day",20000,null,"EUR","WEBRASOFT SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_04_03_2025","https://www.enforcementtracker.com/ETid-2696",null,null,null,null,"webrasoft srl",null,null,null,null,null,null,null,null,null],["2025/RO/075","ANSPDCP (Romania) Beko Romania SA","gdprhub","Romania","RO","ANSPDCP (Romania)","2025-03-03","day",null,"49,766","RON","Beko Romania SA",null,"Art. 32(1)(b), Art. 32(1)(d), Art. 32(2), Art. 33","Data breach, Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_03_03_2025&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_Beko_Romania_SA",null,"gdprhub",null,null,"beko romania sa",null,49766.0,9999,"day 2025-03-03|4.9773|RON",null,null,null,null,null],["2025/RO/058","ETid-2695","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-03-03","day",10000,null,"EUR","BEKO ROMANIA SA","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_03_03_2025","https://www.enforcementtracker.com/ETid-2695",null,null,null,null,"beko romania sa",null,null,null,null,null,null,null,null,null],["2025/BG/001","ETid-3137","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2025-03-01","day",2556,null,"EUR","Registry Agency of Republic of Bulgaria","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.edpb.europa.eu/system/files/2026-04/edpb-annual-report-2025_en.pdf#page=32","https://www.enforcementtracker.com/ETid-3137",null,null,null,null,"BG: registry agency of republic of bulgaria",null,null,null,null,null,null,null,null,null],["2025/ES/193","APDCAT (Catalonia) - EXP202409570","gdprhub","Spain","ES","APDCAT (Catalonia)","2025-02-28","day",600,"600","EUR","Club Esportiu",null,"Art. 7","Consent",null,"Violation found","https://www.aepd.es/documento/ps-00418-2024.pdf","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_EXP202409570",null,"gdprhub",null,null,"ES: club esportiu",null,null,null,null,null,null,null,null,null],["2025/AT/026","DSB (Austria) - 2024-0.917.161","gdprhub","Austria","AT","DSB (Austria)","2025-02-27","day",null,null,null,null,null,"Art. 4, Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250227_2024_0_917_161_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2024-0.917.161",null,"gdprhub",null,"Real estate agency",null,null,null,null,null,null,null,null,null,null],["2025/RO/059","ETid-2694","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-27","day",1000,null,"EUR","Velvet Medical SRL","Health Care","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_27.02.2025","https://www.enforcementtracker.com/ETid-2694",null,null,null,null,"velvet medical srl",null,null,null,null,null,null,null,null,null],["2025/IT/089","Garante per la protezione dei dati personali (Italy) - 10114967","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-02-27","day",300000,"300,000","EUR","Energia Pulita S.r.l.",null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 28, Art. 29, Art. 32, Art. 5, Art. 6, Art. 7, Art. 9","Accountability, Consent, Data principles, Data security, Processor obligations, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10114967","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10114967",null,"gdprhub",null,null,"energia pulita srl",null,null,null,null,null,null,null,null,null],["2025/IT/091","Garante per la protezione dei dati personali (Italy) - 10122998","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-02-27","day",null,null,null,"Security Service s.r.l.",null,"Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10122998","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10122998",null,"gdprhub",null,null,"security service srl",null,null,null,null,null,null,null,null,null],["2025/ES/108","ETid-2564","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-02-25","day",200000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00120-2024.pdf","https://www.enforcementtracker.com/ETid-2564",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2025/ES/102","ETid-2574","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-02-25","day",600000,null,"EUR","IBERMUTUA, MUTUA COLABORADORA CON LA SEGURIDAD SOCIAL NUM.274.","Individuals and Private Associations","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00540-2024.pdf","https://www.enforcementtracker.com/ETid-2574","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202412881","gdprhub",null,null,"ES: ibermutua mutua colaboradora con la seguridad social num 274",null,null,null,null,null,null,null,null,null],["2025/RO/070","ETid-2546","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-20","day",2000,null,"EUR","Medstar S.R.L.","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20_02_2025&lang=ro","https://www.enforcementtracker.com/ETid-2546",null,null,null,null,"medstar srl",null,null,null,null,null,null,null,null,null],["2025/IS/001","ETid-2602","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2025-02-17","day",34300,null,"EUR","Primary Health Care in the Capital Area","Health Care","Art. 5(1)(a), Art. 6(1), Art. 9(2)","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/sekt-a-hendur-heilsugaeslu-hofudborgarsvaedisins-vegna-vinnslu-personuupplysinga-i-sameiginlegu-sjukraskrarkerfi","https://www.enforcementtracker.com/ETid-2602",null,null,null,null,"IS: primary health care in the capital area",null,null,null,null,null,null,null,null,null],["2025/RO/060","ETid-2693","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-17","day",2000,null,"EUR","Meedea Construct Prest SRL","Employment","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_17_02_2025","https://www.enforcementtracker.com/ETid-2693",null,null,null,null,"meedea construct prest srl",null,null,null,null,null,null,null,null,null],["2025/HU/002","NAIH (Hungary) - 7905/2025","gdprhub","Hungary","HU","NAIH (Hungary)","2025-02-17","day",null,null,null,null,null,"Art. 12(3), Art. 13, Art. 17, Art. 17(1)(c), Art. 21(3)","Data subject rights, Transparency",null,"Violation found","https://naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_7905/2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/107","ETid-2565","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-02-14","day",200000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00500-2023.pdf","https://www.enforcementtracker.com/ETid-2565",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2025/ES/093","ETid-2585","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-02-14","day",200000,null,"EUR","ORANGE BANK, S.A. SUCURSAL EN ESPAÑA","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00089-2024.pdf","https://www.enforcementtracker.com/ETid-2585",null,null,null,null,"orange bank sa sucursal en espana","Orange",null,null,null,null,null,null,null,null],["2025/IT/090","Garante per la protezione dei dati personali (Italy) - 10119750","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2025-02-13","day",15000,"15,000","EUR","Movimento Diritti Europei s.r.l.s.",null,"Art. 12(2), Art. 12(3), Art. 12(4), Art. 14, Art. 24, Art. 5(1)(a), Art. 5(2), Art. 6","Accountability, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10119750","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10119750",null,"gdprhub",null,null,"movimento diritti europei srls",null,null,null,null,null,null,null,null,null],["2025/AT/008","DSB (Austria) - DSB-D213.2544","gdprhub","Austria","AT","DSB (Austria)","2025-02-11","day",null,null,null,null,null,"Art. 85(2), Art. 9","Special categories",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250211_2024_0_195_679_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D213.2544",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2025/LV/002","DVI (Latvia) - skola2030.lv","gdprhub","Latvia","LV","DVI (Latvia)","2025-02-11","day",null,null,null,"State Education Development Agency",null,"Art. 5(1), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.dvi.gov.lv/lv/media/3761/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_skola2030.lv",null,"gdprhub",null,null,"LV: state education development agency",null,null,null,null,null,null,null,null,null],["2025/ES/103","ETid-2572","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-02-11","day",120000,null,"EUR","BEEDIGITAL AI, S.A.","Industry and Commerce","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00416-2023.pdf","https://www.enforcementtracker.com/ETid-2572",null,null,null,null,"beedigital ai sa",null,null,null,null,null,null,null,null,null],["2025/RO/061","ETid-2692","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-10","day",3000,null,"EUR","PPC Energie Muntenia SA","Transportation and Energy","Art. 15, Art. 6","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_10.02.2025","https://www.enforcementtracker.com/ETid-2692",null,null,null,null,"ppc energie muntenia sa",null,null,null,null,null,null,null,null,null],["2025/BE/009","APD/GBA (Belgium) - 21/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-02-06","day",null,null,null,null,null,"Art. 5(1)(c), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-21-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_21/2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/062","ETid-2691","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-06","day",3000,null,"EUR","Omniasig Vienna Insurance Group S.A.","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_06_02_2025","https://www.enforcementtracker.com/ETid-2691",null,null,null,null,"omniasig vienna insurance group sa",null,null,null,null,null,null,null,null,null],["2025/GR/021","HDPA (Greece) - 07/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-02-06","day",3000,"3,000","EUR",null,null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.dpa.gr/sites/default/files/2025-03/7_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_07/2025",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2025/GR/019","HDPA (Greece) - 9/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-02-06","day",1000,"1000","EUR",null,null,"Art. 2(2)(c), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2025-03/9_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_9/2025",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2025/ES/114","ETid-2541","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-02-05","day",1200000,null,"EUR","ORANGE ESPAGNE, S.A.U.","Media, Telecoms and Broadcasting","Art. 25, Art. 6","Accountability, Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00332-2023.pdf","https://www.enforcementtracker.com/ETid-2541","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202213023","gdprhub",null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2025/ES/105","ETid-2568","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-02-05","day",500000,null,"EUR","MARINA SALUD, S.A.","Health Care","Art. 28","Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00127-2024.pdf","https://www.enforcementtracker.com/ETid-2568","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202307719","gdprhub",null,null,"marina salud sa",null,null,null,null,null,null,null,null,null],["2025/RO/063","ETid-2690","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-05","day",5000,null,"EUR","FARMEC SA","Industry and Commerce","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_05_02_2025","https://www.enforcementtracker.com/ETid-2690",null,null,null,null,"farmec sa",null,null,null,null,null,null,null,null,null],["2025/AT/009","DSB (Austria) - DSB-D124.1328/24","gdprhub","Austria","AT","DSB (Austria)","2025-02-04","day",null,null,null,null,null,"Art. 5(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250204_2025_0_021_375_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.1328/24",null,"gdprhub",null,"Person receiving home care",null,null,null,null,null,"person",null,null,null,null],["2025/FR/012","ETid-2517","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2025-02-04","day",40000,null,"EUR","Real estate company","Employment","Art. 12, Art. 13, Art. 32, Art. 35, Art. 5(1)(c), Art. 6","DPIA, Data principles, Data security, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/surveillance-excessive-des-salaries-sanction-de-40-000-euros-entreprise-secteur-immobilier","https://www.enforcementtracker.com/ETid-2517",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/064","ETid-2689","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-04","day",10000,null,"EUR","V&M Contab & Management SRL","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_04.02.2025","https://www.enforcementtracker.com/ETid-2689",null,null,null,null,"v and m contab and management srl",null,null,null,null,null,null,null,null,null],["2025/RO/065","ETid-2688","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-02-03","day",15000,null,"EUR","Unicredit Bank SA","Finance, Insurance and Consulting","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_03_02_2025","https://www.enforcementtracker.com/ETid-2688",null,null,null,null,"unicredit bank sa","UniCredit",null,null,null,null,null,null,null,null],["2025/RO/066","ETid-2687","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-01-31","day",15000,null,"EUR","S.P.E.E.H. HIDROELECTRICA S.A","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_31.01.2025_1","https://www.enforcementtracker.com/ETid-2687",null,null,null,null,"speeh hidroelectrica sa",null,null,null,null,null,null,null,null,null],["2025/CH/002","EDÖB/PFPDT/IFPDT (Switzerland) - Cembra Money Bank AG","gdprhub","Switzerland","CH","EDÖB/PFPDT/IFPDT (Switzerland)","2025-01-29","day",null,null,null,null,null,null,null,null,"Violation found","https://backend.edoeb.admin.ch/fileservice/sdweb-docs-prod-edoebch-files/files/2025/07/01/38c5fccc-45de-47f9-be46-4cf5bbf0fcc8.pdf","https://gdprhub.eu/index.php?title=ED%C3%96B/PFPDT/IFPDT_%28Switzerland%29_-_Cembra_Money_Bank_AG",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2025/BE/008","APD/GBA (Belgium) - 2018-04762","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-01-27","day",null,null,null,"Radio Télévision Belge de la Communauté française (RTBF)",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)(b), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-17-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_2018-04762",null,"gdprhub",null,null,"BE: radio television belge de la communaute francaise",null,null,null,null,null,null,null,null,null],["2025/RO/067","ETid-2686","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-01-27","day",40000,null,"EUR","Orange Romania SA","Media, Telecoms and Broadcasting","Art. 17, Art. 5, Art. 6, Art. 7","Consent, Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_27_01_2025","https://www.enforcementtracker.com/ETid-2686",null,null,null,null,"orange romania sa","Orange",null,null,null,null,null,null,null,null],["2025/BE/006","APD/GBA (Belgium) - 16/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-01-24","day",null,null,null,"DPG Media",null,"Art. 6(1)(a)","Unlawful processing",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-16-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_16/2025",null,"gdprhub",null,null,"BE: dpg media",null,null,null,null,null,null,null,null,null],["2025/BE/007","APD/GBA (Belgium) - 14/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-01-23","day",null,null,null,"A data controller (an employer)",null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-14-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_14/2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/RO/071","ETid-2505","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-01-23","day",5000,null,"EUR","Softehnica S.R.L.","Industry and Commerce","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23_01_2025&lang=ro","https://www.enforcementtracker.com/ETid-2505",null,null,null,null,"softehnica srl",null,null,null,null,null,null,null,null,null],["2025/CY/004","Commissioner (Cyprus) - Freedom Finance Europe Ltd","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2025-01-22","day",null,null,null,"Freedom Finance Europe Ltd",null,"Art. 12(2), Art. 12(4), Art. 17, Art. 56","Data subject rights, Transparency",null,"Violation found","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/5725C0D6228A7C40C2258CE3003D5CA0/$file/2025%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20-%20FREEDOM%20FINANCE.pdf?openelement","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_Freedom_Finance_Europe_Ltd",null,"gdprhub",null,null,"freedom finance europe ltd",null,null,null,null,null,null,null,null,null],["2025/RO/073","ETid-2503","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-01-20","day",15000,null,"EUR","Vodafone Romania S.A.","Media, Telecoms and Broadcasting","Art. 32(1)(b), Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20_01_2025&lang=ro","https://www.enforcementtracker.com/ETid-2503",null,null,null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2025/RO/072","ETid-2504","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-01-17","day",2000,null,"EUR","DELIVERY SOLUTIONS S.A.","Industry and Commerce","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_17_01_2025&lang=ro","https://www.enforcementtracker.com/ETid-2504",null,null,null,null,"delivery solutions sa",null,null,null,null,null,null,null,null,null],["2025/ES/117","ETid-2537","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",16000,null,"EUR","CAJA RURAL DEL SUR, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00011-2024.pdf","https://www.enforcementtracker.com/ETid-2537",null,null,null,null,"caja rural del sur scc",null,null,null,null,null,null,null,null,null],["2025/ES/116","ETid-2538","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",12000,null,"EUR","CAJA RURAL DE ARAGÓN, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00011-2024.pdf","https://www.enforcementtracker.com/ETid-2538",null,null,null,null,"caja rural de aragon scc",null,null,null,null,null,null,null,null,null],["2025/ES/115","ETid-2539","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",88000,null,"EUR","CAJA RURAL DE EXTREMADURA S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00005-2024.pdf","https://www.enforcementtracker.com/ETid-2539",null,null,null,null,"caja rural de extremadura scc",null,null,null,null,null,null,null,null,null],["2025/ES/112","ETid-2551","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",8000,null,"EUR","CAJA RURAL NTRA. SRA. DEL ROSARIO","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00024-2024.pdf","https://www.enforcementtracker.com/ETid-2551",null,null,null,null,"ES: caja rural ntra sra del rosario",null,null,null,null,null,null,null,null,null],["2025/ES/111","ETid-2552","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",80000,null,"EUR","CAJA RURAL DE ALBACETE, CIUDAD REAL Y CUENCA, S.C.T","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00009-2024.pdf","https://www.enforcementtracker.com/ETid-2552",null,null,null,null,"ES: caja rural de albacete ciudad real y cuenca sct",null,null,null,null,null,null,null,null,null],["2025/ES/110","ETid-2553","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",200000,null,"EUR","CAJA RURAL DE SALAMANCA, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00007-2024.pdf","https://www.enforcementtracker.com/ETid-2553","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202212956","gdprhub",null,null,"caja rural de salamanca scc",null,null,null,null,null,null,null,null,null],["2025/ES/109","ETid-2554","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",76000,null,"EUR","CAJA RURAL DE GIJÓN, S.C.A.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00006-2024.pdf","https://www.enforcementtracker.com/ETid-2554",null,null,null,null,"ES: caja rural de gijon scac",null,null,null,null,null,null,null,null,null],["2025/ES/101","ETid-2576","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",12000,null,"EUR","CAJA RURAL DE ARAGÓN, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00019-2024.pdf","https://www.enforcementtracker.com/ETid-2576",null,null,null,null,"caja rural de aragon scc",null,null,null,null,null,null,null,null,null],["2025/ES/100","ETid-2577","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",10000,null,"EUR","CAJA RURAL NTRA. SRA. DEL ROSARIO","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00024-2024.pdf","https://www.enforcementtracker.com/ETid-2577","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202300016","gdprhub",null,null,"ES: caja rural ntra sra del rosario",null,null,null,null,null,null,null,null,null],["2025/ES/099","ETid-2578","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",8000,null,"EUR","CAJA RURAL NTRA MADRE DEL SOL S.C.A.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00025-2024.pdf","https://www.enforcementtracker.com/ETid-2578",null,null,null,null,"ES: caja rural ntra madre del sol scac",null,null,null,null,null,null,null,null,null],["2025/ES/098","ETid-2579","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",12000,null,"EUR","CAJA RURAL DE ONDA, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00021-2024.pdf","https://www.enforcementtracker.com/ETid-2579",null,null,null,null,"caja rural de onda scc",null,null,null,null,null,null,null,null,null],["2025/ES/097","ETid-2580","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",12000,null,"EUR","CAJA RURAL GRANADA, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00018-2024.pdf","https://www.enforcementtracker.com/ETid-2580",null,null,null,null,"caja rural granada scc",null,null,null,null,null,null,null,null,null],["2025/ES/096","ETid-2581","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",8000,null,"EUR","CAJA RURAL DE BAENA NTRA. SRA. DE GUADALUPE, S.C.C.A.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00023-2024.pdf","https://www.enforcementtracker.com/ETid-2581",null,null,null,null,"ES: caja rural de baena ntra sra de guadalupe scca",null,null,null,null,null,null,null,null,null],["2025/ES/094","ETid-2583","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-17","day",12000,null,"EUR","CAJA RURAL DE ASTURIAS, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00015-2024.pdf","https://www.enforcementtracker.com/ETid-2583",null,null,null,null,"caja rural de asturias scc",null,null,null,null,null,null,null,null,null],["2025/LT/001","ETid-2595","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2025-01-17","day",9000,null,"EUR","Employment Service under the Ministry of Social Security and Labor of the Republic of Lithuania","Public Sector and Education","Art. 24(1), Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://vdai.lrv.lt/public/canonical/1737436310/706/2025-01-17%20sprendimas%20Nr.%203R-57%20(2.13-1.E).pdf","https://www.enforcementtracker.com/ETid-2595",null,null,null,null,"LT: employment service under the ministry of social security and labor of the republic of lithuania",null,null,null,null,null,null,null,null,null],["2025/ES/113","ETid-2550","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-16","day",400000,null,"EUR","CAJA RURAL DE JAEN, BARCELONA Y MADRID, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00004-2024.pdf","https://www.enforcementtracker.com/ETid-2550",null,null,null,null,"caja rural de jaen barcelona y madrid scc",null,null,null,null,null,null,null,null,null],["2025/ES/095","ETid-2582","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2025-01-16","day",72000,null,"EUR","CAJA RURAL CENTRAL, S.C.C.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00003-2024.pdf","https://www.enforcementtracker.com/ETid-2582",null,null,null,null,"caja rural central scc",null,null,null,null,null,null,null,null,null],["2025/IT/074","ETid-2649","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-01-16","day",100000,null,"EUR","Realmaps S.r.l.","Real Estate","Art. 13, Art. 14, Art. 21(2), Art. 24, Art. 25, Art. 28, Art. 29, Art. 30, Art. 35, Art. 37, Art. 6(1)(a), Art. 7","Accountability, Consent, DPIA, Data protection officer, Data subject rights, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10110241","https://www.enforcementtracker.com/ETid-2649","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10110241","gdprhub",null,null,"realmaps srl",null,null,null,null,null,null,null,null,null],["2025/IT/081","ETid-3046","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-01-16","day",6000,null,"EUR","San Pio Hospital in Benevento","Employment","Art. 6, Art. 9(2)(b)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10218564","https://www.enforcementtracker.com/ETid-3046","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10112709","gdprhub",null,null,"IT: san pio hospital in benevento",null,null,null,null,null,null,null,null,null],["2025/IT/082","ETid-3047","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-01-16","day",600,null,"EUR","Pro Loco Tourist Association of Cittareale","Accommodation and Hospitality","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10213894","https://www.enforcementtracker.com/ETid-3047",null,null,null,null,"IT: pro loco tourist association of cittareale",null,null,null,null,null,null,null,null,null],["2025/IT/083","ETid-3048","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-01-16","day",2000,null,"EUR","Alessandro Volta Classical and Scientific High School in Como","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10218932","https://www.enforcementtracker.com/ETid-3048",null,null,null,null,"IT: alessandro volta classical and scientific high school in como",null,null,null,null,null,null,null,null,null],["2025/IT/084","ETid-3049","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-01-16","day",600,null,"EUR","BAR GIOIA","Accommodation and Hospitality","Art. 13, Art. 5(1)(a)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10216253","https://www.enforcementtracker.com/ETid-3049",null,null,null,null,"IT: bar gioia",null,null,null,null,null,null,null,null,null],["2025/IT/085","ETid-3050","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-01-16","day",2000,null,"EUR","Municipality of Cori","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10220335","https://www.enforcementtracker.com/ETid-3050",null,null,null,null,"IT: municipality of cori",null,null,null,null,null,null,null,null,null],["2025/IT/086","ETid-3051","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2025-01-16","day",1500,null,"EUR","Macelleria La Costata s.r.I.s","Industry and Commerce","Art. 13, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10214411","https://www.enforcementtracker.com/ETid-3051","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10214411","gdprhub",null,null,"IT: macelleria la costata sris",null,null,null,null,null,null,null,null,null],["2025/ES/143","AEPD (Spain) - EXP202416691","gdprhub","Spain","ES","AEPD (Spain)","2025-01-15","day",42000,"42,000","EUR","Spanish Society of Medical Oncology",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00515-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202416691",null,"gdprhub",null,null,"ES: spanish society of medical oncology",null,null,null,null,null,null,null,null,null],["2025/GR/024","HDPA (Greece) - 15/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-01-15","day",5000,"5,000","EUR","Δήμος Πατρέων (Municipality of Patra)",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.dpa.gr/sites/default/files/2025-06/15_2025%20anonym_0.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_15/2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/ES/139","AEPD (Spain) - EXP202305278","gdprhub","Spain","ES","AEPD (Spain)","2025-01-14","day",42000,"42,000","EUR","EDP Solar Spain",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00028-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202305278",null,"gdprhub",null,null,"ES: edp solar spain",null,null,null,null,null,null,null,null,null],["2025/MT/002","IDPC (Malta) - CDP/COMP/332/2024","gdprhub","Malta","MT","IDPC (Malta)","2025-01-14","day",null,null,null,null,null,"Art. 15, Art. 5(1)(a)","Data principles, Data subject rights",null,"Violation found","https://idpc.org.mt/wp-content/uploads/2025/01/CDP_COMP_332_2024.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_CDP/COMP/332/2024",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2025/EE/002","ETid-2594","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2025-01-10","day",null,null,"EUR","Asper Biogene OÜ","Health Care",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aki.ee/uudised/trahviotsus-85-000-suurune-rahatrahv-asper-biogene-ou-le","https://www.enforcementtracker.com/ETid-2594",null,null,null,null,"asper biogene ou",null,null,null,null,null,null,null,null,null],["2025/GR/018","ETid-3140","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2025-01-10","day",120000,null,"EUR","National Bank of Greece S.A","Finance, Insurance and Consulting","Art. 15, Art. 25(1), Art. 32, Art. 33, Art. 34","Accountability, Data breach, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2025-03/3_2025%20anonym.pdf","https://www.enforcementtracker.com/ETid-3140",null,null,null,null,"national bank of greece sa",null,null,null,null,null,null,null,null,null],["2025/GR/020","HDPA (Greece) - 1/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-01-09","day",200000,"200,000","EUR","National Bank of Greece",null,"Art. 12(2), Art. 15, Art. 25(1)","Accountability, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2025-03/1_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_1/2025",null,"gdprhub",null,null,"national bank of greece sa",null,null,null,null,null,null,null,null,null],["2025/BE/005","APD/GBA (Belgium) - 02/2025","gdprhub","Belgium","BE","APD/GBA (Belgium)","2025-01-07","day",null,null,null,null,null,"Art. 10, Art. 12(1), Art. 12(3), Art. 12(4), Art. 15, Art. 24, Art. 32, Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)(c), Art. 6(1)(e)","Accountability, Data principles, Data security, Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-02-2025.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_02/2025",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2025/GR/029","HDPA (Greece) - 04/2025","gdprhub","Greece","GR","HDPA (Greece)","2025-01-07","day",3000,"€3,000","EUR",null,null,"Art. 12(2), Art. 12(3), Art. 15(1), Art. 58(2)(i), Art. 82","Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2025-02/4_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_04/2025",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2025/LU/002","ETid-2615","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2025-01-06","day",175000,null,"EUR","Credit Institution","Finance, Insurance and Consulting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2025/dlibration-n1fr-2025-anonymise.pdf","https://www.enforcementtracker.com/ETid-2615",null,null,null,null,"LU: credit institution",null,null,null,null,null,null,null,null,null],["2025/ES/121","AEPD (Spain) - EXP202303035","gdprhub","Spain","ES","AEPD (Spain)","2025-01-03","day",50000,"50,000","EUR","Banco Pichincha",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/reposicion-ps-00217-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202303035",null,"gdprhub",null,null,"ES: banco pichincha",null,null,null,null,null,null,null,null,null],["2025/RO/068","ETid-2685","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2025-01-03","day",2000,null,"EUR","Unirea Medical Center S.R.L.","Health Care","Art. 24, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_13.01.2025","https://www.enforcementtracker.com/ETid-2685",null,null,null,null,"unirea medical center srl",null,null,null,null,null,null,null,null,null],["2025/SK/003","ETid-2903","cms_tracker","Slovakia","SK","Slovak Data Protection Office","2025","year",200,null,"EUR","Civic Association",null,null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://dataprotection.gov.sk/files/annual-reports/sprava-o-stave-ochrany-osobnych-udajov-2024.pdf","https://www.enforcementtracker.com/ETid-2903",null,null,null,null,"SK: civic association",null,null,null,null,null,null,null,null,null],["2025/SK/002","ETid-2904","cms_tracker","Slovakia","SK","Slovak Data Protection Office","2025","year",7500,null,"EUR",null,null,null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://dataprotection.gov.sk/files/annual-reports/sprava-o-stave-ochrany-osobnych-udajov-2024.pdf","https://www.enforcementtracker.com/ETid-2904",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2025/SK/001","ETid-2905","cms_tracker","Slovakia","SK","Slovak Data Protection Office","2025","year",1500,null,"EUR",null,null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://dataprotection.gov.sk/files/annual-reports/sprava-o-stave-ochrany-osobnych-udajov-2024.pdf","https://www.enforcementtracker.com/ETid-2905",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/143","Garante per la protezione dei dati personali (Italy) 10105764","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-12-24","day",347520,"347,520","EUR","Wind Tre",null,"Art. 24, Art. 28, Art. 32, Art. 33, Art. 5(1)(a), Art. 5(1)(f), Art. 5(2), Art. 6(1), Art. 7","Accountability, Consent, Data breach, Data principles, Data security, Processor obligations, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10105764","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_10105764",null,"gdprhub",null,null,"wind tre spa",null,null,null,null,null,null,null,null,null],["2024/HR/008","AZOP (Croatia) - UP/I-034-01/24-01/33","gdprhub","Croatia","HR","AZOP (Croatia)","2024-12-23","day",12000,"12,000","EUR",null,null,"Art. 37(7), Art. 38(6)","Data protection officer",null,"Violation found","https://azop.hr/wp-content/uploads/2025/04/rjesenje-sluzbenik-za-zastitu-podataka.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_UP/I-034-01/24-01/33",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2024/NL/007","ETid-2509","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2024-12-23","day",40000,null,"EUR","Coolblue B.V","Industry and Commerce","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/boete-voor-coolblue-voor-het-ongevraagd-gebruiken-van-cookies","https://www.enforcementtracker.com/ETid-2509","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Coolblue","gdprhub",null,null,"coolblue bv",null,null,null,null,null,null,null,null,null],["2024/ES/015","ETid-2528","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-23","day",300000,null,"EUR","LÍNEA DIRECTA ASEGURADORA, S.A.","Finance, Insurance and Consulting","Art. 28, Art. 6(1)","Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00221-2022.pdf","https://www.enforcementtracker.com/ETid-2528","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202567","gdprhub",null,null,"ES: linea directa aseguradora",null,null,null,null,null,null,null,null,null],["2024/ES/012","ETid-2533","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-23","day",15000,null,"EUR","HSSERVICE LIZCON SOLUTIONS, S.L.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00478-2024.pdf","https://www.enforcementtracker.com/ETid-2533",null,null,null,null,"hsservice lizcon solutions sl",null,null,null,null,null,null,null,null,null],["2024/ES/008","ETid-2547","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-23","day",9000,null,"EUR","CRIDOLMA BARCELONA S.L.",null,"Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00429-2024.pdf","https://www.enforcementtracker.com/ETid-2547",null,null,null,null,"cridolma barcelona sl",null,null,null,null,null,null,null,null,null],["2024/ES/007","ETid-2548","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-23","day",600,null,"EUR","ENERGY WINNER, S.L.","Transportation and Energy","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00273-2024.pdf","https://www.enforcementtracker.com/ETid-2548",null,null,null,null,"energy winner sl",null,null,null,null,null,null,null,null,null],["2024/ES/006","ETid-2549","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-23","day",2000,null,"EUR","AUTOMOCIÓN 1972, S.L.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00432-2024.pdf","https://www.enforcementtracker.com/ETid-2549",null,null,null,null,"automocion 1972 sl",null,null,null,null,null,null,null,null,null],["2024/PL/001","ETid-2763","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-12-23","day",357000,null,"EUR","Panek SA","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3487","https://www.enforcementtracker.com/ETid-2763",null,null,null,null,"panek sa",null,null,null,null,null,null,null,null,null],["2024/ES/002","ETid-2575","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-20","day",1000000,null,"EUR","LIGA NACIONAL DE FÚTBOL PROFESIONAL","Individuals and Private Associations","Art. 35","DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00484-2023.pdf","https://www.enforcementtracker.com/ETid-2575","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202315637","gdprhub",null,null,"ES: liga nacional de futbol profesional",null,null,null,null,null,null,null,null,null],["2024/HR/009","AZOP (Croatia) - UP/I-034-01/24-01/30","gdprhub","Croatia","HR","AZOP (Croatia)","2024-12-19","day",40000,"40,000","EUR",null,null,"Art. 12, Art. 14, Art. 30, Art. 38, Art. 5, Art. 6","Data principles, Data protection officer, Transparency, Unlawful processing",null,"Violation found","https://azop.hr/wp-content/uploads/2025/04/nezakonita-obrada-osobnih-podataka-obrtnika.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_UP/I-034-01/24-01/30",null,"gdprhub",null,"Business information publisher",null,null,null,null,null,null,null,null,null,null],["2024/FR/031","CNIL (France) - SAN-2024-021","gdprhub","France","FR","CNIL (France)","2024-12-19","day",40000,"40,000","EUR",null,null,"Art. 12, Art. 13, Art. 32, Art. 35, Art. 5(1)(c), Art. 6(1)","DPIA, Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000051120331","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-021",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/IT/144","Garante per la protezione dei dati personali (Italy) - 10104750","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-12-19","day",10000,"10,000","EUR","Comune di Brescia",null,"Art. 4(1), Art. 4(15), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(d), Art. 5(2), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10104750","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10104750",null,"gdprhub",null,null,"IT: comune di brescia",null,null,null,null,null,null,null,null,null],["2024/IT/145","Garante per la protezione dei dati personali (Italy) - 10106904","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-12-19","day",70000,"70,000","EUR",null,null,"Art. 14, Art. 24, Art. 28, Art. 37, Art. 38, Art. 5(1)(a), Art. 5(1)(e), Art. 5(2)","Accountability, Data principles, Data protection officer, Processor obligations, Transparency",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10106904","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10106904",null,"gdprhub",null,"Credit repair company",null,null,null,null,null,null,null,null,null,null],["2024/SE/010","IMY (Sweden) - 2023-16453","gdprhub","Sweden","SE","IMY (Sweden)","2024-12-19","day",null,null,null,"Aktiebolaget Trav och Galopp",null,"Art. 6, Art. 7(3)","Consent, Unlawful processing",null,"Violation found","https://gdprhub.eu/images/d/d9/IMY_2023-16453.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_2023-16453",null,"gdprhub",null,null,"SE: aktiebolaget trav och galopp",null,null,null,null,null,null,null,null,null],["2024/DK/010","Datatilsynet (Denmark) - 2024-51-0012","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-12-18","day",null,null,null,"F.C. Copenhagen",null,"Art. 4(14), Art. 9(1), Art. 9(2)(g)","Special categories",null,null,"https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/dec/fc-koebenhavn-faar-tilladelse-til-brug-af-automatisk-ansigtsgenkendelse","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2024-51-0012",null,"gdprhub",null,null,"DK: fc copenhagen",null,null,null,null,null,null,null,null,null],["2024/ES/016","ETid-2527","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-18","day",100000,null,"EUR","ATRIUM LEX SFC","Real Estate","Art. 13, Art. 32(1)","Data security, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00457-2023.pdf","https://www.enforcementtracker.com/ETid-2527","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202309054","gdprhub",null,null,"ES: atrium lex sfc",null,null,null,null,null,null,null,null,null],["2024/PL/002","ETid-2591","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-12-18","day",135600,null,"EUR","Company","Finance, Insurance and Consulting","Art. 30(1), Art. 38(3)","Data protection officer, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5112.14.2022","https://www.enforcementtracker.com/ETid-2591","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.14.2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/AT/009","DSB (Austria) - D130.1013 2024-0.743.431","gdprhub","Austria","AT","DSB (Austria)","2024-12-17","day",null,null,null,"Google",null,"Art. 15","Data subject rights",null,"Violation found","https://gdprhub.eu/images/2/2b/D130.1013_2024-0.743.431.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D130.1013_2024-0.743.431",null,"gdprhub",null,null,"AT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2024/IE/003","ETid-2484","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2024-12-17","day",251000000,null,"EUR","Meta Platforms Ireland Limited","Media, Telecoms and Broadcasting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/en/news-media/press-releases/irish-data-protection-commission-fines-meta-eu251-million","https://www.enforcementtracker.com/ETid-2484",null,null,null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2024/FI/002","ETid-2506","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2024-12-17","day",950000,null,"EUR","Sambla Group Oy","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://tietosuoja.fi/-/lainanvertailupalveluja-tarjoavalle-sambla-groupille-seuraamusmaksu-tietoturvallisuuden-laiminlyonnista-yrityksen-on-ilmoitettava-asiakkailleen","https://www.enforcementtracker.com/ETid-2506","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/132/2022","gdprhub",null,null,"sambla group oy",null,null,null,null,null,null,null,null,null],["2024/BE/001","ETid-2521","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2024-12-17","day",200000,null,"EUR","Hospital","Health Care","Art. 24, Art. 32, Art. 35(3), Art. 5(1)(f)","Accountability, DPIA, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-166-2024.pdf","https://www.enforcementtracker.com/ETid-2521",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/011","ETid-2534","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-16","day",70000,null,"EUR","INTERURBANA DE AUTOBUSES, S.A.","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00467-2023.pdf","https://www.enforcementtracker.com/ETid-2534",null,null,null,null,"interurbana de autobuses sa",null,null,null,null,null,null,null,null,null],["2024/IT/007","ETid-2524","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-12-14","day",2000,null,"EUR","Maddaloni municipality","Public Sector and Education","Art. 37(7)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10085732","https://www.enforcementtracker.com/ETid-2524",null,null,null,null,"IT: maddaloni municipality",null,null,null,null,null,null,null,null,null],["2024/IT/006","ETid-2525","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-12-14","day",2000,null,"EUR","Torre Annunziata municipality","Public Sector and Education","Art. 37(7)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10085757","https://www.enforcementtracker.com/ETid-2525",null,null,null,null,"IT: torre annunziata municipality",null,null,null,null,null,null,null,null,null],["2024/ES/154","AEPD (Spain) - EXP202309208","gdprhub","Spain","ES","AEPD (Spain)","2024-12-13","day",10000,"10,000","EUR","El León Espanol",null,"Art. 5(1)(c), Art. 5(2)","Data principles",null,"Violation found","https://www.aepd.es/documento/reposicion-ps-00335-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202309208",null,"gdprhub",null,null,"ES: el leon espanol",null,null,null,null,null,null,null,null,null],["2024/EU/001","EDPS - 2023-1205","gdprhub","European Union","EU","EDPS","2024-12-13","day",null,null,null,"European Commission",null,null,null,null,"Violation found","https://gdprhub.eu/images/7/7d/EDPSDecision_printed_Redacted-1.pdf","https://gdprhub.eu/index.php?title=EDPS_-_2023-1205",null,"gdprhub",null,null,"EU: european commission",null,null,null,null,null,null,null,null,null],["2024/GB/014","ICO (UK) - United Lincolnshire Teaching Hospitals NHS Trust","gdprhub","United Kingdom","GB","ICO (UK)","2024-12-13","day",null,null,null,"United Lincolnshire Teaching Hospitals NHS Trust",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/reprimands/4032154/20241213-united-lincs-hospital-nhs-trust-reprimand.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_United_Lincolnshire_Teaching_Hospitals_NHS_Trust",null,"gdprhub",null,null,"GB: united lincolnshire teaching hospitals nhs trust",null,null,null,null,null,null,null,null,null],["2024/HU/004","NAIH (Hungary) - NAIH-3076-14/2024","gdprhub","Hungary","HU","NAIH (Hungary)","2024-12-13","day",null,null,null,null,null,"Art. 12(3), Art. 25(1), Art. 6(1)(a)","Accountability, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=1160:leiratkozas-hirlevelekrol-hozzajarulas-visszavonasa","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-3076-14/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/RO/027","ANSPDCP (Romania) - Compania de Transport Public Cluj-Napoca S.A.","gdprhub","Romania","RO","ANSPDCP (Romania)","2024-12-12","day",null,"19,902","RON","Compania de Transport Public Cluj-Napoca S.A.",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(2), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_12.12.2024&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Compania_de_Transport_Public_Cluj-Napoca_S.A.",null,"gdprhub",null,null,"compania de transport public cluj napoca sa",null,19902.0,4004,"day 2024-12-12|4.9704|RON",null,null,null,null,null],["2024/BE/047","APD/GBA (Belgium) - 162/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-12-12","day",null,null,null,null,null,"Art. 12(2), Art. 12(3), Art. 17, Art. 24, Art. 5(2)","Accountability, Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-162-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_162/2024",null,"gdprhub",null,"Media company",null,null,null,null,null,null,null,null,null,null],["2024/AT/011","DSB (Austria) - 2024-0.796.258","gdprhub","Austria","AT","DSB (Austria)","2024-12-12","day",2000,"2,000","EUR",null,null,"Art. 5, Art. 9","Data principles, Special categories",null,"Violation found","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20241212_2024_0_796_258_00/DSBT_20241212_2024_0_796_258_00.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2024-0.796.258",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2024/IT/008","ETid-2522","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-12-12","day",20000,null,"EUR","Physician","Health Care","Art. 5, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10095836","https://www.enforcementtracker.com/ETid-2522","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10095836","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/003","ETid-2562","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-12","day",3500000,null,"EUR","CAIXABANK, S.A.","Finance, Insurance and Consulting","Art. 25, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00477-2023.pdf","https://www.enforcementtracker.com/ETid-2562","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202213437","gdprhub",null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2024/IT/137","Garante per la protezione dei dati personali (Italy) - 10102334","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-12-12","day",6000,"6000","EUR","Comune di Portici",null,"Art. 12, Art. 13, Art. 35, Art. 5(1)(a)","DPIA, Data principles, Transparency",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10102334","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10102334",null,"gdprhub",null,null,"IT: comune di portici",null,null,null,null,null,null,null,null,null],["2024/IT/142","Garante per la protezione dei dati personali (Italy) - 10102355","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-12-12","day",6000,"6,000","EUR","Comune di Corte Franca",null,"Art. 37(7), Art. 5, Art. 6","Data principles, Data protection officer, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10102355","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10102355",null,"gdprhub",null,null,"IT: comune di corte franca",null,null,null,null,null,null,null,null,null],["2024/IT/136","Garante per la protezione dei dati personali (Italy) - 10102462","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-12-12","day",10000,"10,000","EUR",null,null,"Art. 17, Art. 6(1)(a), Art. 6(1)(f)","Data subject rights, Unlawful processing",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10102462","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10102462",null,"gdprhub",null,"Travel agency",null,null,null,null,null,null,null,null,null,null],["2024/SE/001","ETid-2599","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2024-12-11","day",18400,null,"EUR","Granit Bostad Beritsholm AB","Industry and Commerce","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-granit-bostad-beritsholm.pdf","https://www.enforcementtracker.com/ETid-2599","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_2023-15373","gdprhub",null,null,"granit bostad beritsholm ab",null,null,null,null,null,null,null,null,null],["2024/RO/029","ANSPDCP (Romania) - SYNOBIS MEDICAL S.R.L.","gdprhub","Romania","RO","ANSPDCP (Romania)","2024-12-10","day",null,"10,000","RON","SYNOBIS MEDICAL S.R.L",null,"Art. 12, Art. 14","Transparency",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_10_12_2024&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_SYNOBIS_MEDICAL_S.R.L.",null,"gdprhub",null,null,"synobis medical srl",null,10000.0,2012,"day 2024-12-10|4.9713|RON",null,null,null,null,null],["2024/ES/019","ETid-2514","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-10","day",4000000,null,"EUR","GENERALI ESPAÑA, SOCIEDAD ANONIMA DE SEGUROS Y REASEGUROS","Finance, Insurance and Consulting","Art. 25, Art. 32, Art. 35, Art. 5(1)(f)","Accountability, DPIA, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00453-2023.pdf","https://www.enforcementtracker.com/ETid-2514","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202213638","gdprhub",null,null,"ES: generali espana sociedad anonima de seguros y reaseguros",null,null,null,null,null,null,null,null,null],["2024/GR/029","HDPA (Greece) - 50 2024","gdprhub","Greece","GR","HDPA (Greece)","2024-12-08","day",null,null,null,null,null,"Art. 13, Art. 17, Art. 18, Art. 21, Art. 5(1)(a), Art. 58, Art. 6(1)(a), Art. 9","Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-12/50_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_50_2024",null,"gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2024/ES/152","AEPD (Spain) - EXP202406716","gdprhub","Spain","ES","AEPD (Spain)","2024-12-05","day",20000,"20,000","EUR",null,null,null,null,null,"Violation found","https://www.aepd.es/documento/ps-00356-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202406716",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/030","CNIL (France) - SAN-2024-020","gdprhub","France","FR","CNIL (France)","2024-12-05","day",240000,"240,000","EUR","KASPR",null,"Art. 12, Art. 14, Art. 15, Art. 5(1)(e)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000050791828","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-020",null,"gdprhub",null,null,"FR: kaspr",null,null,null,null,null,null,null,null,null],["2024/GB/013","ICO (UK) - Money Bubble Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2024-12-05","day",null,"120,000","GBP","Money Bubble Ltd",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4032079/bubble-limited-mpn-20241205.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Money_Bubble_Ltd",null,"gdprhub",null,null,"money bubble ltd",null,120000.0,144928,"day 2024-12-05|0.8280|GBP",null,null,null,null,null],["2024/ES/028","ETid-2499","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-12-03","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/reposicion-ps-00154-2023.pdf","https://www.enforcementtracker.com/ETid-2499",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/ES/160","AEPD (Spain) - EXP202400055","gdprhub","Spain","ES","AEPD (Spain)","2024-12-02","day",500000,"500,000","EUR","Caja Rural de Jaén, Barcelona y Madrid, Sociedad Cooperativa de Crédito",null,"Art. 32, Art. 33, Art. 5(1)(f), Art. 83(5)(a)","Data breach, Data principles, Data security",null,"Violation found","https://www.aepd.es/informes-y-resoluciones/resoluciones","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202400055",null,"gdprhub",null,null,"ES: caja rural de jaen barcelona y madrid sociedad cooperativa de credito",null,null,null,null,null,null,null,null,null],["2024/BE/046","APD/GBA (Belgium) - 146/24","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-11-28","day",null,null,null,"Freedelity",null,"Art. 24, Art. 25, Art. 25(1), Art. 26, Art. 5(1)(c), Art. 5(1)(e), Art. 5(2), Art. 7, Art. 7(3)","Accountability, Consent, Data principles",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-146-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_146/24",null,"gdprhub",null,null,"BE: freedelity",null,null,null,null,null,null,null,null,null],["2025/LT/013","ETid-2839","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2024-11-28","day",12000,null,"EUR","Company","Industry and Commerce","Art. 15(1), Art. 16, Art. 5(1)(d)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://vdai.lrv.lt/public/canonical/1735795244/690/12_31_Sprendimo%20del%20BDAR%2015%20str%20baudos%20apibendrinimas.pdf","https://www.enforcementtracker.com/ETid-2839",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/009","ETid-2519","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-11-27","day",892783,null,"EUR","E.ON Energia spa","Transportation and Energy","Art. 12, Art. 15, Art. 22, Art. 24, Art. 28, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10095854","https://www.enforcementtracker.com/ETid-2519",null,null,null,null,"IT: e on energia",null,null,null,null,null,null,null,null,null],["2024/DK/001","ETid-2601","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2024-11-27","day",50250,null,"EUR","Lyngby-Taarbæk Municipality","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/nov/datatilsynet-anmelder-lyngby-taarbaek-kommune-til-politiet","https://www.enforcementtracker.com/ETid-2601",null,null,null,null,"DK: lyngby taarbk municipality",null,null,null,null,null,null,null,null,null],["2024/IT/139","Garante per la protezione dei dati personali (Italy) - 10095761","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-27","day",10000,"10000","EUR","Società Molise Dati",null,"Art. 32","Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10095761","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10095761",null,"gdprhub",null,null,"IT: societa molise dati",null,null,null,null,null,null,null,null,null],["2024/IT/138","Garante per la protezione dei dati personali (Italy) - 10095791","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-27","day",10000,"10000","EUR","Regione Molise",null,"Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10095791","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10095791",null,"gdprhub",null,null,"IT: regione molise",null,null,null,null,null,null,null,null,null],["2024/IT/140","Garante per la protezione dei dati personali (Italy) - 10095810","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-27","day",10000,"10000","EUR","Engineering Ingegneria Informatica S.p.a.",null,"Art. 32","Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10095810","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10095810",null,"gdprhub",null,null,"engineering ingegneria informatica spa",null,null,null,null,null,null,null,null,null],["2024/IT/133","Garante per la protezione dei dati personali (Italy) - 10097012","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-27","day",892738,"892.738,00","EUR","E.ON Energia",null,"Art. 12, Art. 15, Art. 22, Art. 24, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10097012","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10097012",null,"gdprhub",null,null,"IT: e on energia",null,null,null,null,null,null,null,null,null],["2024/SE/008","IMY (Sweden) - IMY-2022-1558","gdprhub","Sweden","SE","IMY (Sweden)","2024-11-27","day",null,null,null,"Verisure",null,"Art. 32(1)","Data security",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2024/tillsynsbeslut-verisure-sverige-ab.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2022-1558",null,"gdprhub",null,null,"SE: verisure",null,null,null,null,null,null,null,null,null],["2024/LU/003","CNPD (Luxembourg) - 2FR/2025","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2024-11-26","day",null,null,null,null,null,"Art. 13(1), Art. 13(2), Art. 25, Art. 32(1), Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(e), Art. 5(1)(f), Art. 5(2), Art. 6(1)(f)","Accountability, Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2025/dcision-2fr-2025-version-pseudonymise.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_2FR/2025",null,"gdprhub","Ministry; Secundary school",null,null,null,null,null,null,null,null,null,null,null],["2024/PL/004","ETid-2493","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-11-26","day",6900,null,"EUR","Hospital","Health Care","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.6.2024","https://www.enforcementtracker.com/ETid-2493","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.6.2024","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/NL/008","ETid-2507","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2024-11-26","day",4750000,null,"EUR","Netflix International B.V.","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13(2), Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://autoriteitpersoonsgegevens.nl/system/files?file=2024-12/Besluit%20boete%20Netflix_0.pdf","https://www.enforcementtracker.com/ETid-2507","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Netflix","gdprhub",null,null,"netflix international bv",null,null,null,null,null,null,null,null,null],["2024/BE/048","APD/GBA (Belgium) - DOS-2019-06239","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-11-22","day",5000,"5000","EUR","X versus Y",null,"Art. 12(2), Art. 21(3), Art. 25, Art. 5(1)(a), Art. 6(1)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-147-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_DOS-2019-06239",null,"gdprhub",null,null,"BE: x versus y",null,null,null,null,null,null,null,null,null],["2024/ES/023","ETid-2510","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-22","day",220000,null,"EUR","CARTONAJES BAÑERES, S.A","Employment","Art. 15, Art. 35","DPIA, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00361-2023.pdf","https://www.enforcementtracker.com/ETid-2510",null,null,null,null,"cartonajes baneres sa",null,null,null,null,null,null,null,null,null],["2024/ES/013","ETid-2530","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-22","day",220000,null,"EUR","CARTONAJES BAÑERES, S.A.","Employment","Art. 15, Art. 35","DPIA, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00361-2023.pdf","https://www.enforcementtracker.com/ETid-2530",null,null,null,null,"cartonajes baneres sa",null,null,null,null,null,null,null,null,null],["2024/IE/001","ETid-2780","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2024-11-22","day",40000,null,"EUR","Maynooth University","Public Sector and Education","Art. 32(1), Art. 33(1), Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2025-02/MU%20Final%20Decision%20IN-19-9-3_Redacted.pdf","https://www.enforcementtracker.com/ETid-2780","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-19-9-3","gdprhub",null,null,"IE: maynooth university",null,null,null,null,null,null,null,null,null],["2024/PL/006","ETid-2491","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-11-20","day",358000,null,"EUR",null,null,"Art. 25(1), Art. 28(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5130.2415.2020","https://www.enforcementtracker.com/ETid-2491",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/PL/005","ETid-2492","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-11-20","day",4700,null,"EUR",null,null,null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5130.2415.2020","https://www.enforcementtracker.com/ETid-2492",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/LU/001","ETid-2762","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2024-11-20","day",2300,null,"EUR","Company","Industry and Commerce","Art. 25(2), Art. 32(1), Art. 6(1)","Accountability, Data principles, Data security, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2024/dcision-3fr-2024-version-pseudonymise-version-finale.pdf","https://www.enforcementtracker.com/ETid-2762",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/030","ETid-2490","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-19","day",200000,null,"EUR","VODAFONE ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00083-2024.pdf","https://www.enforcementtracker.com/ETid-2490",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/FR/029","CNIL (France) - SAN-2024-019","gdprhub","France","FR","CNIL (France)","2024-11-14","day",50000000,"50,000,000","EUR","Orange",null,null,null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000050760620","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-019",null,"gdprhub",null,null,"FR: orange","Orange",null,null,null,null,null,null,null,null],["2024/ES/020","ETid-2513","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-13","day",500,null,"EUR","4T OCIO Y CAFÉ 2009","Accommodation and Hospitality","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00402-2023.pdf","https://www.enforcementtracker.com/ETid-2513",null,null,null,null,"ES: 4t ocio y cafe 2009",null,null,null,null,null,null,null,null,null],["2024/IT/010","ETid-2516","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-11-13","day",678897,null,"EUR","Illumia Spa","Transportation and Energy","Art. 24, Art. 25, Art. 28, Art. 32, Art. 5(2), Art. 6","Accountability, Data principles, Data security, Processor obligations, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10086101","https://www.enforcementtracker.com/ETid-2516","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10086536","gdprhub",null,null,"illumia spa",null,null,null,null,null,null,null,null,null],["2024/ES/017","ETid-2523","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-13","day",2500,null,"EUR","COYARE SLU","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00395-2023.pdf","https://www.enforcementtracker.com/ETid-2523",null,null,null,null,"coyare slu",null,null,null,null,null,null,null,null,null],["2024/IT/004","ETid-2531","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-11-13","day",5000000,null,"EUR","Foodinho Srl","Employment","Art. 12, Art. 13, Art. 22(3), Art. 25, Art. 28, Art. 32, Art. 35, Art. 6, Art. 88, Art. 9(2)(b)","Accountability, DPIA, Data principles, Data security, Data subject rights, Processor obligations, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10074840","https://www.enforcementtracker.com/ETid-2531","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10074601","gdprhub",null,null,"foodinho srl","Glovo",null,null,null,null,null,null,null,null],["2024/FI/001","ETid-2544","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2024-11-13","day",2400000,null,"EUR","Posti Jakelu Oy","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://tietosuoja.fi/-/postille-seuraamusmaksu-omaposti-palvelun-tietosuojapuutteista","https://www.enforcementtracker.com/ETid-2544","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/4/2018","gdprhub",null,null,"posti jakelu oy",null,null,null,null,null,null,null,null,null],["2024/IE/002","ETid-2779","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2024-11-13","day",29500,null,"EUR","Sligo County Council","Public Sector and Education","Art. 24(1), Art. 25, Art. 30, Art. 32(1)","Accountability, Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2024-12/05.12.2024%20_%2007-SIU-2018_Final%20Decision_Sligo%20CoCo_Redacted.2.pdf","https://www.enforcementtracker.com/ETid-2779","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_07/SIU/2018","gdprhub",null,null,"IE: sligo county council",null,null,null,null,null,null,null,null,null],["2024/IT/127","Garante per la protezione dei dati personali (Italy) - 10076481","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-13","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1), Art. 8(1)","Consent, Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10076481","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10076481",null,"gdprhub",null,"Parent",null,null,null,null,null,"person",null,null,null,null],["2024/IT/128","Garante per la protezione dei dati personali (Italy) - 10084453","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-13","day",5000,"5,000","EUR",null,null,"Art. 5(1)(a), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10084453","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10084453",null,"gdprhub",null,"Health Agency",null,null,null,null,null,null,null,null,null,null],["2024/IT/135","Garante per la protezione dei dati personali (Italy) - 10091735","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-13","day",null,null,null,"Aosom Italy S.r.l.",null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 4(11), Art. 5, Art. 7","Accountability, Consent, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10091735","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10091735",null,"gdprhub",null,null,"aosom italy srl",null,null,null,null,null,null,null,null,null],["2024/IT/146","Garante per la protezione dei dati personali (Italy) - 10093485","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-13","day",null,null,null,"G.Glamour",null,"Art. 12(1), Art. 13, Art. 25(1), Art. 5(1)(a), Art. 58(2)(b)","Accountability, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10093485","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10093485",null,"gdprhub",null,null,"IT: g glamour",null,null,null,null,null,null,null,null,null],["2024/IT/147","Garante per la protezione dei dati personali (Italy) - 10095553","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-13","day",null,null,null,"Google",null,"Art. 5(1)(d)","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10095553","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10095553",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2024/GR/015","HDPA (Greece) - 8/2025","gdprhub","Greece","GR","HDPA (Greece)","2024-11-13","day",45000,"45,000","EUR","Dating agency under the name ''ANOIXIS''",null,"Art. 31",null,null,"Violation found","https://www.dpa.gr/sites/default/files/2025-03/8_2025%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_8/2025",null,"gdprhub",null,null,"GR: dating agency under the name anoixis",null,null,null,null,null,null,null,null,null],["2024/ES/148","AEPD (Spain) - EXP202303478","gdprhub","Spain","ES","AEPD (Spain)","2024-11-12","day",120000,"120,000","EUR","BANCO BILBAO VIZCAYA ARGENTARIA",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00277-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202303478",null,"gdprhub",null,null,"ES: banco bilbao vizcaya argentaria","BBVA",null,null,null,null,null,null,null,null],["2024/DE/012","ETid-2487","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024-11-12","day",900000,null,"EUR","Debt collection service provider","Finance, Insurance and Consulting","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/news/branchenweite-schwerpunktpruefung-im-forderungsmanagement","https://www.enforcementtracker.com/ETid-2487",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DK/002","ETid-2600","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2024-11-12","day",6700,null,"EUR","Uptime-IT ApS","Health Care",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/nov/databehandler-indstillet-til-boede","https://www.enforcementtracker.com/ETid-2600",null,null,null,null,"uptime it aps",null,null,null,null,null,null,null,null,null],["2024/PL/031","UODO (Poland) - DKN.5130.2415.2020","gdprhub","Poland","PL","UODO (Poland)","2024-11-12","day",null,"1.527.855","PLN",null,null,"Art. 25(1), Art. 28(1), Art. 28(3)(c), Art. 28(3)(f), Art. 28(3)(h), Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security, Processor obligations",null,"Violation found","https://www.uodo.gov.pl/decyzje/DKN.5130.2415.2020","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5130.2415.2020",null,"gdprhub",null,"Operator of a website",null,null,1527855.0,351207,"day 2024-11-12|4.3503|PLN",null,null,null,null,null],["2024/ES/014","ETid-2529","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-11","day",200000,null,"EUR","Correo Inteligente Postal, S.L.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00571-2023.pdf","https://www.enforcementtracker.com/ETid-2529","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202318430","gdprhub",null,null,"correo inteligente postal sl",null,null,null,null,null,null,null,null,null],["2024/GR/026","HDPA (Greece) - 30/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-11-09","day",1400,"1,400","EUR",null,null,"Art. 12(3), Art. 12(4), Art. 12(5)(b), Art. 13, Art. 14, Art. 15(1), Art. 15(3), Art. 15(4), Art. 22(1), Art. 22(4), Art. 31, Art. 5, Art. 51, Art. 55, Art. 58(2)(i), Art. 83(2), Art. 83(4)(a), Art. 83(5)(b)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-10/30_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_30/2024",null,"gdprhub",null,"Lawyer",null,null,null,null,null,"person",null,null,null,null],["2024/ES/029","ETid-2498","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-07","day",2000,null,"EUR","KAFFA KOFFEE ORGANISATION, S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00487-2023.pdf","https://www.enforcementtracker.com/ETid-2498",null,null,null,null,"kaffa koffee organisation sl",null,null,null,null,null,null,null,null,null],["2024/ES/022","ETid-2511","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-11-06","day",1000,null,"EUR","MINAS DE VALDECASTILLO, S.A..","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00399-2023.pdf","https://www.enforcementtracker.com/ETid-2511",null,null,null,null,"minas de valdecastillo sa",null,null,null,null,null,null,null,null,null],["2024/RO/001","ETid-2479","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-11-04","day",1000,null,"EUR","Blackcab Systems SRL","Transportation and Energy","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_04_11_2024&lang=ro","https://www.enforcementtracker.com/ETid-2479",null,null,null,null,"blackcab systems srl",null,null,null,null,null,null,null,null,null],["2024/IT/011","ETid-2497","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-11-02","day",15000000,null,"EUR","OpenAI OpCo LLC","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 24, Art. 25, Art. 32, Art. 5(1)(a), Art. 5(2), Art. 6","Accountability, Data principles, Data security, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10085455","https://www.enforcementtracker.com/ETid-2497","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10085455","gdprhub",null,null,"openai opco llc","OpenAI",null,null,null,null,null,null,null,null],["2024/IT/119","Garante per la protezione dei dati personali (Italy) - 10070521","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-11-02","day",null,null,null,"Intesa Sanpaolo S.p.A.",null,"Art. 34(1), Art. 34(3)(c), Art. 58(2)(e)","Data breach",null,"Other Outcome","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10070521","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10070521",null,"gdprhub",null,null,"intesa sanpaolo spa","Intesa Sanpaolo",null,null,null,null,null,null,null,null],["2024/ES/027","ETid-2500","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-31","day",12000,null,"EUR","NEGOCIOS R&R 2020 S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00367-2024.pdf","https://www.enforcementtracker.com/ETid-2500",null,null,null,null,"negocios r and r 2020 sl",null,null,null,null,null,null,null,null,null],["2024/ES/026","ETid-2501","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-31","day",4000,null,"EUR","GESTIÓN DE VENTAS IBERIA S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00317-2024.pdf","https://www.enforcementtracker.com/ETid-2501",null,null,null,null,"gestion de ventas iberia sl",null,null,null,null,null,null,null,null,null],["2024/ES/021","ETid-2512","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-31","day",900,null,"EUR","RIVENDELL TECHNOLOGY, S.L.",null,"Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00369-2024.pdf","https://www.enforcementtracker.com/ETid-2512",null,null,null,null,"rivendell technology sl",null,null,null,null,null,null,null,null,null],["2024/GR/028","HDPA (Greece) - 39/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-10-31","day",5000,"5,000","EUR","Εθνική Υπηρεσία Πληροφοριών (National Intelligence Service)",null,"Art. 12, Art. 13, Art. 5(1)(a), Art. 5(2)","Data principles, Transparency",null,"Violation found","https://dpa.gr/sites/default/files/2024-11/39_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_39/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/RO/002","ETid-2478","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-10-30","day",15000,null,"EUR","Untold SRL",null,"Art. 15, Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_30_10_2024&lang=ro","https://www.enforcementtracker.com/ETid-2478",null,null,null,null,"untold srl",null,null,null,null,null,null,null,null,null],["2024/AT/008","DSB (Austria) - D124.0507/24 2024-0.633.166","gdprhub","Austria","AT","DSB (Austria)","2024-10-28","day",null,null,null,"Österreichischer Rundfunk - ORF",null,"Art. 17, Art. 25(1), Art. 4(11), Art. 5(1)(a)","Accountability, Data principles, Data subject rights",null,"Violation found","https://gdprhub.eu/images/9/9e/202406331662AErledigungBescheid28102024p_schw.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D124.0507/24_2024-0.633.166",null,"gdprhub",null,null,"AT: osterreichischer rundfunk orf",null,null,null,null,null,null,null,null,null],["2024/NO/006","Datatilsynet (Norway) - 20/01801-23","gdprhub","Norway","NO","Datatilsynet (Norway)","2024-10-28","day",null,null,null,null,null,"Art. 4(4), Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/0ee209384bb14f1e8717feaf91bc75de/vedtak-om-irettesettelse---behandling-av-personopplysninger-uten-rettslig-grunnlag.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01801-23",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/RO/004","ETid-2472","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-10-28","day",5000,null,"EUR","Vodafone Romania S.A.","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_28_10_2024&lang=ro","https://www.enforcementtracker.com/ETid-2472",null,null,null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2024/BE/045","APD/GBA (Belgium) - 133/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-10-25","day",null,null,null,null,null,"Art. 17","Data subject rights",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-133-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_133/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/IE/004","ETid-2469","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2024-10-24","day",310000000,null,"EUR","LinkedIn","Media, Telecoms and Broadcasting","Art. 13(1)(c), Art. 14(1)(c), Art. 5(1)(a)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://dataprotection.ie/en/news-media/press-releases/irish-data-protection-commission-fines-linkedin-ireland-eu310-million","https://www.enforcementtracker.com/ETid-2469","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_LinkedIn_inquiry","gdprhub",null,null,"IE: linkedin","Microsoft",null,null,null,null,null,null,null,null],["2024/RO/005","ETid-2471","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-10-23","day",10000,null,"EUR","Profi Rom Food SRL","Employment","Art. 5(1)(a), Art. 5(2), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23_10_2024&lang=ro","https://www.enforcementtracker.com/ETid-2471",null,null,null,null,"profi rom food srl",null,null,null,null,null,null,null,null,null],["2024/ES/036","ETid-2473","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-22","day",180000,null,"EUR","IBERCAJA BANCO, S.A.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00380-2024.pdf","https://www.enforcementtracker.com/ETid-2473","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202315853","gdprhub",null,null,"ibercaja banco sa",null,null,null,null,null,null,null,null,null],["2024/NO/001","ETid-2482","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2024-10-21","day",20800,null,"EUR","Grue municipality","Public Sector and Education","Art. 24, Art. 32(1)(b)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2024/overtredelsesgebyr-til-grue-kommune/","https://www.enforcementtracker.com/ETid-2482",null,null,null,null,"NO: grue municipality",null,null,null,null,null,null,null,null,null],["2024/FI/014","Tietosuojavaltuutetun toimisto (Finland) - TSV/428/2022","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-10-21","day",null,null,null,null,null,"Art. 12(1), Art. 15(3)","Data subject rights, Transparency",null,"Rejected","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242343","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/428/2022",null,"gdprhub",null,"Insurance company",null,null,null,null,null,null,null,null,null,null],["2024/RO/028","ANSPDCP (Romania) - Fine against Raiffeisen Bank","gdprhub","Romania","RO","ANSPDCP (Romania)","2024-10-20","day",null,"99,466","RON","Raiffeisen Bank S.A",null,"Art. 32(1)(b), Art. 32(1)(d), Art. 32(4)","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_20_11_2024&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Raiffeisen_Bank",null,"gdprhub",null,null,"raiffeisen bank sa","Raiffeisen",99466.0,20000,"day 2024-10-18|4.9733|RON",null,null,null,null,null],["2024/PL/007","ETid-2485","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-10-18","day",5800,null,"EUR",null,null,"Art. 37(1)(a), Art. 37(7)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.7.2024","https://www.enforcementtracker.com/ETid-2485",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/031","ETid-2489","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-18","day",200000,null,"EUR","VODAFONE ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00486-2023.pdf","https://www.enforcementtracker.com/ETid-2489",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/LT/002","ETid-2596","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2024-10-18","day",9000,null,"EUR","Vilnius District Municipality Administration","Public Sector and Education","Art. 34(2), Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://vdai.lrv.lt/lt/naujienos/vilniaus-rajono-savivaldybes-administracijai-skirta-bauda-uz-netinkama-asmens-duomenu-tvarkyma/","https://www.enforcementtracker.com/ETid-2596",null,null,null,null,"LT: vilnius district municipality administration",null,null,null,null,null,null,null,null,null],["2024/ES/018","ETid-2520","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-17","day",1000,null,"EUR","KUR KLINIKUM, S.L.","Health Care","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00313-2024.pdf","https://www.enforcementtracker.com/ETid-2520",null,null,null,null,"kur klinikum sl",null,null,null,null,null,null,null,null,null],["2024/IT/122","Garante per la protezione dei dati personali (Italy) - 10073751","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-10-17","day",8000,"8,000","EUR","Comune di Offanengo",null,"Art. 5(1)(b), Art. 6(1)(c), Art. 9(1)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10039471","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10073751",null,"gdprhub",null,null,"IT: comune di offanengo",null,null,null,null,null,null,null,null,null],["2024/IT/132","Garante per la protezione dei dati personali (Italy) - 10084403","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-10-17","day",60000,"60,000","EUR","Serfin 97 S.r.l.",null,"Art. 15(1)(g), Art. 28, Art. 28(3)(a), Art. 28(3)(e), Art. 28(3)(h)","Data subject rights, Processor obligations",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10084403","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10084403",null,"gdprhub",null,null,"serfin 97 srl",null,null,null,null,null,null,null,null,null],["2024/IT/141","Garante per la protezione dei dati personali (Italy) - 10091156","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-10-17","day",null,null,null,"Società Onlinestore s.r.l.",null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 4(11), Art. 5, Art. 7","Accountability, Consent, Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10091156","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10091156",null,"gdprhub",null,null,"societa onlinestore srl",null,null,null,null,null,null,null,null,null],["2024/GB/010","ICO (UK) - Southend-on-Sea City Council Reprimand","gdprhub","United Kingdom","GB","ICO (UK)","2024-10-17","day",null,null,null,"Southend on Sea City Council",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://ico.org.uk/media/action-weve-taken/reprimands/4031391/southend-on-sea-city-council-reprimand.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Southend-on-Sea_City_Council_Reprimand",null,"gdprhub",null,null,"GB: southend on sea city council",null,null,null,null,null,null,null,null,null],["2024/DK/011","Datatilsynet (Denmark) - 2024-431-0033","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-10-16","day",null,null,null,"Bolilag",null,"Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/okt/boliglagdk-faar-kritik-for-ulovlig-behandling-af-oplysninger-om-boligejere","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2024-431-0033",null,"gdprhub",null,null,"DK: bolilag",null,null,null,null,null,null,null,null,null],["2024/RO/006","ETid-2470","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-10-16","day",3000,null,"EUR","Your Consulting SRL",null,"Art. 25(1), Art. 32(1)(a), Art. 32(2)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16_10_2024&lang=ro","https://www.enforcementtracker.com/ETid-2470",null,null,null,null,"your consulting srl",null,null,null,null,null,null,null,null,null],["2024/AT/002","ETid-2773","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2024-10-16","day",5000,null,"EUR","Company",null,"Art. 38","Data protection officer","Lack of appointment of data protection officer","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20241016_2024_0_641_771_00","https://www.enforcementtracker.com/ETid-2773","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2024-0.641.771","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/IS/005","Persónuvernd (Island) - 2023122032","gdprhub","Iceland","IS","Persónuvernd (Island)","2024-10-15","day",null,null,null,"VÍS",null,"Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vis-heimilt-ad-senda-vidskiptavini-thjonustukonnun-i-kjolfar-simtals","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2023122032",null,"gdprhub",null,null,"IS: vis",null,null,null,null,null,null,null,null,null],["2024/BE/044","APD/GBA (Belgium) - 132/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-10-14","day",null,null,null,null,null,"Art. 57(4), Art. 6, Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-132-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_132/2024",null,"gdprhub",null,"Landlord",null,null,null,null,null,"person",null,null,null,null],["2024/BE/040","APD/GBA (Belgium) - 131/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-10-11","day",null,null,null,"RTL Belgium SA",null,"Art. 4(11), Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-131-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_131/2024",null,"gdprhub",null,null,"rtl belgium sa",null,null,null,null,null,null,null,null,null],["2024/PL/029","UODO (Poland) - DKN.5131.1.2021","gdprhub","Poland","PL","UODO (Poland)","2024-10-09","day",null,"353,589","PLN",null,null,"Art. 24(1), Art. 25(1), Art. 28(1), Art. 28(3), Art. 32(1), Art. 32(2), Art. 33(3)(c), Art. 33(3)(d), Art. 34(2), Art. 5(1)(f), Art. 5(2)","Accountability, Data breach, Data principles, Data security, Processor obligations",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5131.1.2021","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.1.2021",null,"gdprhub",null,"Sole entrepreneur",null,null,353589.0,82272,"day 2024-10-09|4.2978|PLN","person",null,null,null,null],["2024/ES/032","ETid-2488","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-04","day",600,null,"EUR","VOLTIUM CONSULTORES 2020",null,"Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00314-2024.pdf","https://www.enforcementtracker.com/ETid-2488",null,null,null,null,"ES: voltium consultores 2020",null,null,null,null,null,null,null,null,null],["2024/ES/025","ETid-2502","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-04","day",900,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00210-2024.pdf","https://www.enforcementtracker.com/ETid-2502",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/ES/001","ETid-2597","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-10-04","day",5000,null,"EUR","ROCA & ASOCIADOS ABOGADOS Y ECONOMISTAS, S.L.P.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00526-2023.pdf","https://www.enforcementtracker.com/ETid-2597","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202313226","gdprhub",null,null,"roca and asociados abogados y economistas slp",null,null,null,null,null,null,null,null,null],["2024/ES/122","AEPD (Spain) - EXP202203580","gdprhub","Spain","ES","AEPD (Spain)","2024-10-03","day",null,null,null,"Mapfre España Compañia de Seguros y Reaseguros SA",null,"Art. 44, Art. 45, Art. 46(2)(c), Art. 5(1)(a)","Data principles, International transfers",null,"Violation found","https://www.aepd.es/documento/pa-00053-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202203580",null,"gdprhub",null,null,"mapfre espana compania de seguros y reaseguros sa",null,null,null,null,null,null,null,null,null],["2024/ES/164","AEPD (Spain) - EXP202209645","gdprhub","Spain","ES","AEPD (Spain)","2024-10-01","day",250000,"250,000","EUR","LORO PARQUE SA",null,"Art. 4(1), Art. 4(14), Art. 9, Art. 9(1), Art. 9(2)","Special categories",null,"Violation found","https://www.aepd.es/documento/ps-00432-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202209645",null,"gdprhub",null,null,"loro parque sa",null,null,null,null,null,null,null,null,null],["2024/ES/139","AEPD (Spain) - EXP202209677","gdprhub","Spain","ES","AEPD (Spain)","2024-09-30","day",200000,"200,000","EUR","HM HOSPITALES 1989",null,"Art. 32, Art. 57(1), Art. 58(1)","Data security",null,"Violation found","https://www.aepd.es/buscador?search=EXP202209677","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202209677",null,"gdprhub",null,null,"ES: hm hospitales 1989",null,null,null,null,null,null,null,null,null],["2024/ES/155","AEPD (Spain) - EXP202316537","gdprhub","Spain","ES","AEPD (Spain)","2024-09-30","day",1200,"1200","EUR","Posada El Azufral",null,"Art. 5(1)(c), Art. 58(2)(d), Art. 6(1)(c), Art. 83(5)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00036-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202316537",null,"gdprhub",null,null,"ES: posada el azufral",null,null,null,null,null,null,null,null,null],["2024/IE/005","ETid-2461","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2024-09-27","day",91000000,null,"EUR","Meta Platforms Ireland Limited","Media, Telecoms and Broadcasting","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/en/news-media/press-releases/DPC-announces-91-million-fine-of-Meta","https://www.enforcementtracker.com/ETid-2461","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Meta_Ireland","gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2024/ES/149","AEPD (Spain) - EXP202401934","gdprhub","Spain","ES","AEPD (Spain)","2024-09-26","day",20000,"20,000","EUR","Supervista Optics Spain",null,null,null,null,"Violation found","https://www.aepd.es/documento/ps-00195-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202401934",null,"gdprhub",null,null,"ES: supervista optics spain",null,null,null,null,null,null,null,null,null],["2024/DK/008","Datatilsynet (Denmark) - 2023-431-0013","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-09-26","day",null,null,null,"Dansk Retursystem",null,"Art. 25, Art. 5(1)(a), Art. 5(1)(c)","Accountability, Data principles",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/sep/alvorlig-kritik-paabud-og-advarsel-i-sag-om-pant-app","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-431-0013",null,"gdprhub",null,null,"DK: dansk retursystem",null,null,null,null,null,null,null,null,null],["2024/IT/016","ETid-2463","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-09-26","day",4000,null,"EUR","CI & DI Food s.r.l.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10066287","https://www.enforcementtracker.com/ETid-2463","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10066287","gdprhub",null,null,"ci and di food srl",null,null,null,null,null,null,null,null,null],["2024/ES/024","ETid-2508","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-09-26","day",1300000,null,"EUR","TELEFÓNICA DE ESPAÑA SAU","Media, Telecoms and Broadcasting","Art. 5(1)(c), Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00291-2023.pdf","https://www.enforcementtracker.com/ETid-2508","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202210465","gdprhub",null,null,"telefonica de espana sau","Telefonica",null,null,null,null,null,null,null,null],["2024/GB/001","ETid-2555","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2024-09-26","day",904000,null,"EUR","Police Service of Northern Ireland","Public Sector and Education","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/10/what-price-privacy-poor-psni-procedures-culminate-in-750k-fine/","https://www.enforcementtracker.com/ETid-2555",null,null,null,null,"GB: police service of northern ireland",null,null,null,null,null,null,null,null,null],["2024/FR/002","ETid-2616","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-09-26","day",250000,null,"EUR","COSMOSPACE","Media, Telecoms and Broadcasting","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://cnil.fr/fr/voyance-en-ligne-sanctions-de-250-000-et-150-000-euros-cosmospace-telemaque","https://www.enforcementtracker.com/ETid-2616","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-014","gdprhub",null,null,"FR: cosmospace",null,null,null,null,null,null,null,null,null],["2024/FR/001","ETid-2617","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-09-26","day",150000,null,"EUR","TELEMAQUE","Media, Telecoms and Broadcasting","Art. 5(1)(e), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://cnil.fr/fr/voyance-en-ligne-sanctions-de-250-000-et-150-000-euros-cosmospace-telemaque","https://www.enforcementtracker.com/ETid-2617","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-015","gdprhub",null,null,"FR: telemaque",null,null,null,null,null,null,null,null,null],["2024/IT/115","Garante per la protezione dei dati personali (Italy) - 10066215","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-09-26","day",null,null,null,"Ministero dell'Interno",null,"Art. 12(3), Art. 12(4), Art. 17(3)(b)","Data subject rights, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10066215","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10066215",null,"gdprhub",null,null,"IT: ministero dell interno",null,null,null,null,null,null,null,null,null],["2024/IT/124","Garante per la protezione dei dati personali (Italy) - 10072031","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-09-26","day",null,null,null,"Telerama News",null,"Art. 12(1), Art. 12(2), Art. 13, Art. 14, Art. 5(1)(a)","Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10072031","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10072031",null,"gdprhub",null,null,"IT: telerama news",null,null,null,null,null,null,null,null,null],["2024/IT/123","Garante per la protezione dei dati personali (Italy) - 10072622","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-09-26","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 14, Art. 15, Art. 21, Art. 5, Art. 58, Art. 6, Art. 7","Consent, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10072622","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10072622",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/GB/009","ICO (UK) - Police Service of Northern Ireland","gdprhub","United Kingdom","GB","ICO (UK)","2024-09-26","day",null,"75,000","GBP","Police Service of Northern Ireland (PSNI)",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4031177/psni-penalty-notice.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Police_Service_of_Northern_Ireland",null,"gdprhub",null,null,"GB: police service of northern ireland",null,75000.0,89898,"day 2024-09-26|0.8343|GBP",null,null,null,null,null],["2024/RO/010","ETid-2452","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-09-23","day",2000,null,"EUR","PPC ENERGIE MUNTENIA S.A.","Transportation and Energy","Art. 12(3), Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23_09_2024&lang=ro","https://www.enforcementtracker.com/ETid-2452",null,null,null,null,"ppc energie muntenia sa",null,null,null,null,null,null,null,null,null],["2024/GR/003","ETid-2453","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-09-23","day",1400,null,"EUR","Attorney","Finance, Insurance and Consulting","Art. 12(3), Art. 31","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/parabiasi-diataxeon-toy-gkpd-os-pros-dikaioma-prosbasis","https://www.enforcementtracker.com/ETid-2453",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/114","ETid-3097","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-09-23","day",600,null,"EUR","SERVICIOS INMOBILIARIOS Y GESTIÓN RCL-MADRID, S.L.","Real Estate","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00211-2025.pdf","https://www.enforcementtracker.com/ETid-3097",null,null,null,null,"servicios inmobiliarios y gestion rcl madrid sl",null,null,null,null,null,null,null,null,null],["2024/GR/022","HDPA (Greece) - HDPA - 32/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-09-23","day",150000,"150000","EUR","Ministry of Citizan Protection",null,"Art. 12, Art. 13, Art. 14, Art. 24, Art. 25(1), Art. 35, Art. 5(1), Art. 83","Accountability, DPIA, Data principles, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-09/32_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_HDPA_-_32/2024",null,"gdprhub",null,null,"GR: ministry of citizan protection",null,null,null,null,null,null,null,null,null],["2024/SI/011","IP (Slovenia) - 0603 30 2023 12","gdprhub","Slovenia","SI","IP (Slovenia)","2024-09-23","day",25000,"25,000","EUR",null,null,"Art. 13(1), Art. 5(1)(a), Art. 6(1), Art. 83(5)(a)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0603_30_2023_12",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/IS/004","Persónuvernd (Island) - 2021061342","gdprhub","Iceland","IS","Persónuvernd (Island)","2024-09-20","day",null,null,null,null,null,"Art. 4(1)",null,null,"Rejected","https://www.personuvernd.is/urlausnir/kvortun-yfir-vinnslu-personuupplysinga-af-halfu-starfsmanna-logreglunnar-a-hofudborgarsvaedinu","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2021061342",null,"gdprhub",null,"Police",null,null,null,null,null,null,null,null,null,null],["2024/ES/163","AEPD (Spain) - EXP202304821","gdprhub","Spain","ES","AEPD (Spain)","2024-09-17","day",100000,"100,000","EUR","NATURGY IBERIA, S.A. (\"Naturgy\")",null,"Art. 6(1)(b)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00541-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202304821",null,"gdprhub",null,null,"naturgy iberia sa",null,null,null,null,null,null,null,null,null],["2024/RO/007","ETid-2456","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-09-17","day",3000,null,"EUR","Constanța South Container Terminal SRL","Transportation and Energy","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_17.09.2024&lang=ro","https://www.enforcementtracker.com/ETid-2456",null,null,null,null,"constanta south container terminal srl",null,null,null,null,null,null,null,null,null],["2024/FI/012","Tietosuojavaltuutetun toimisto (Finland) - TSV/12/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-09-17","day",null,null,null,null,null,"Art. 12(6), Art. 15(3), Art. 58(2)(b), Art. 58(2)(c)","Data subject rights, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242303","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/12/2019",null,"gdprhub",null,"Telecommunications operator",null,null,null,null,null,null,null,null,null,null],["2024/RO/009","ETid-2454","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-09-16","day",1000,null,"EUR","SC Class IT Outsourcing SRL","Industry and Commerce","Art. 12(3), Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16_09_2024&lang=ro","https://www.enforcementtracker.com/ETid-2454",null,null,null,null,"class it outsourcing srl",null,null,null,null,null,null,null,null,null],["2024/RO/008","ETid-2455","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-09-16","day",3000,null,"EUR","Vodafone România SA","Media, Telecoms and Broadcasting","Art. 12(3), Art. 15, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16_09_2024&lang=ro","https://www.enforcementtracker.com/ETid-2455",null,null,null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2024/HR/003","ETid-2494","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2024-09-13","day",190000,null,"EUR","Hospital","Health Care","Art. 12(1), Art. 13(1)(c), Art. 33(1), Art. 38(1), Art. 5(1)(e), Art. 6(1)","Data breach, Data principles, Data protection officer, Data security, Transparency, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izdane-nove-upravne-novcane-kazne-u-ukupnom-iznosu-od-270-700-eura/","https://www.enforcementtracker.com/ETid-2494",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/HR/002","ETid-2495","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2024-09-13","day",35700,null,"EUR","Company",null,null,null,"Unknown","Fine issued","https://azop.hr/izdane-nove-upravne-novcane-kazne-u-ukupnom-iznosu-od-270-700-eura/","https://www.enforcementtracker.com/ETid-2495",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/HR/001","ETid-2496","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2024-09-13","day",45000,null,"EUR","Hotel","Accommodation and Hospitality",null,null,"Unknown","Fine issued","https://azop.hr/izdane-nove-upravne-novcane-kazne-u-ukupnom-iznosu-od-270-700-eura/","https://www.enforcementtracker.com/ETid-2496",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/118","Garante per la protezione dei dati personali (Italy) - 10052798","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-09-13","day",10000,"10,000","EUR","Nomodidattica S.r.l. (owner of the Moltocomuni website)",null,"Art. 5(1)(a), Art. 5(1)(c), Art. 58(2), Art. 83","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10052798","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10052798",null,"gdprhub",null,null,"nomodidattica srl",null,null,null,null,null,null,null,null,null],["2024/IT/014","ETid-2475","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-09-12","day",5000,null,"EUR","Top Quality Corporation s.r.l.s.","Employment","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10065911","https://www.enforcementtracker.com/ETid-2475",null,null,null,null,"top quality corp srls",null,null,null,null,null,null,null,null,null],["2024/IT/013","ETid-2476","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-09-12","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10065894","https://www.enforcementtracker.com/ETid-2476",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/IT/005","ETid-2526","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-09-12","day",842062,null,"EUR","Sky Italia S.r.l.","Media, Telecoms and Broadcasting","Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10076504","https://www.enforcementtracker.com/ETid-2526",null,null,null,null,"sky italia srl",null,null,null,null,null,null,null,null,null],["2024/FR/004","ETid-2542","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-09-12","day",800000,null,"EUR","CEGEDIM SANTÉ","Health Care","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/en/health-data-cegedim-sante-fined-eu800000","https://www.enforcementtracker.com/ETid-2542","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-013","gdprhub",null,null,"FR: cegedim sante",null,null,null,null,null,null,null,null,null],["2024/IT/113","Garante per la protezione dei dati personali (Italy) - 10064226","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-09-12","day",8000,"8,000","EUR","Ordine delle Professioni Infermieristiche di Udine",null,"Art. 12(1), Art. 15, Art. 26, Art. 4(7), Art. 5(1)(a), Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10064226","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10064226",null,"gdprhub",null,null,"IT: ordine delle professioni infermieristiche di udine",null,null,null,null,null,null,null,null,null],["2024/ES/033","ETid-2486","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-09-11","day",600,null,"EUR","KVIKU SPAIN, S.L","Finance, Insurance and Consulting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00183-2024.pdf","https://www.enforcementtracker.com/ETid-2486",null,null,null,null,"kviku spain sl",null,null,null,null,null,null,null,null,null],["2024/FI/013","Tietosuojavaltuutetun toimisto (Finland) - TSV/16/2023","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-09-11","day",null,null,null,"National Police Board of Finland",null,null,null,null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242323","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/16/2023",null,"gdprhub",null,null,"FI: national police board of finland",null,null,null,null,null,null,null,null,null],["2024/ES/143","AEPD (Spain) - EXP202315571","gdprhub","Spain","ES","AEPD (Spain)","2024-09-09","day",50000,"50,000","EUR","Quirón Prevención",null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.aepd.es/documento/ps-00001-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202315571",null,"gdprhub",null,null,"ES: quiron prevencion",null,null,null,null,null,null,null,null,null],["2024/ES/146","AEPD (Spain) - EXP202316737","gdprhub","Spain","ES","AEPD (Spain)","2024-09-09","day",20000,"20,000","EUR","The Nude Project",null,null,null,null,"Violation found","https://www.aepd.es/documento/ps-00110-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202316737",null,"gdprhub",null,null,"ES: the nude project",null,null,null,null,null,null,null,null,null],["2024/BE/037","APD/GBA (Belgium) - 112/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-09-06","day",null,null,null,"Roularta Media Group N.V.",null,"Art. 80(1), Art. 80(2)",null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-112-2024-van-6-september-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_112/2024",null,"gdprhub",null,null,"BE: roularta media group",null,null,null,null,null,null,null,null,null],["2024/BE/036","APD/GBA (Belgium) - 113/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-09-06","day",null,null,null,"MediaHuis",null,"Art. 5(1)(a), Art. 6(1)(a), Art. 7(3)","Consent, Data principles, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-113-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_113/2024",null,"gdprhub",null,null,"BE: mediahuis",null,null,null,null,null,null,null,null,null],["2024/BE/039","APD/GBA (Belgium) - 114/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-09-06","day",45000,"45,000","EUR",null,null,"Art. 12(1), Art. 13(1)(c), Art. 13(2)(c), Art. 13(2)(d), Art. 13(2)(e), Art. 15(1), Art. 30(1)(a), Art. 30(1)(b), Art. 30(1)(c), Art. 30(1)(d), Art. 35, Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(2), Art. 6(1)(a), Art. 9(1), Art. 9(2)(a)","DPIA, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-114-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_114/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/NO/003","ETid-2445","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2024-09-06","day",20900,null,"EUR","Eidskog municipality","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2024/overtredelsesgebyr-til-eidskog-kommune/","https://www.enforcementtracker.com/ETid-2445",null,null,null,null,"NO: eidskog municipality",null,null,null,null,null,null,null,null,null],["2024/ES/034","ETid-2481","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-09-05","day",3000,null,"EUR","PLAY FUL KIDS, S.L.",null,"Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00202-2023.pdf","https://www.enforcementtracker.com/ETid-2481","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202303215","gdprhub",null,null,"play ful kids sl",null,null,null,null,null,null,null,null,null],["2024/NO/005","Datatilsynet (Norway) - 24/00793-9","gdprhub","Norway","NO","Datatilsynet (Norway)","2024-09-04","day",null,"150,000","NOK","The University of Agder",null,"Art. 24, Art. 32","Accountability, Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/bb061f3a6e444cdeae12e08263b20db9/~-24_00793-9-vedtak-om-overtredelsesgebyr---universitetet-i-agder-529679_7_1.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_24/00793-9",null,"gdprhub",null,null,"NO: the university of agder",null,150000.0,12706,"day 2024-09-04|11.8050|NOK",null,null,null,null,null],["2024/NO/002","ETid-2458","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2024-09-04","day",12700,null,"EUR","University of Agder","Public Sector and Education","Art. 24, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2024/overtredelsesgebyr-til-universitetet-i-agder/","https://www.enforcementtracker.com/ETid-2458",null,null,null,null,"NO: university of agder",null,null,null,null,null,null,null,null,null],["2024/CY/001","ETid-2515","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2024-09-04","day",3000,null,"EUR","Senira Limited","Finance, Insurance and Consulting","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/9D51EA60B8CB6E33C2258BF2004C7F8F?OpenDocument","https://www.enforcementtracker.com/ETid-2515","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.011.218","gdprhub",null,null,"senira ltd",null,null,null,null,null,null,null,null,null],["2024/GR/025","HDPA (Greece) - 26/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-09-03","day",28000,"28,000","EUR","Δ.Ε.Η. Α.Ε. (Public Power Corporation)",null,"Art. 12(2), Art. 16, Art. 17, Art. 2(3), Art. 5(1)(a), Art. 5(1)(d)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-10/26_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_26/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/PL/012","ETid-2446","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-09-02","day",19800,null,"EUR","National Prosecutor's Office","Public Sector and Education","Art. 33(1), Art. 34(1), Art. 6(1), Art. 9(1)","Data breach, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.33.2023","https://www.enforcementtracker.com/ETid-2446","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.33.2023","gdprhub",null,null,"PL: national prosecutor s office",null,null,null,null,null,null,null,null,null],["2024/GB/008","ICO (UK) - Bonne Terre Ltd and Sky Betting and Gaming","gdprhub","United Kingdom","GB","ICO (UK)","2024-09-02","day",null,null,null,"Sky Betting and Gaming",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/reprimands/4031023/bonne-terre-limited-reprimand.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Bonne_Terre_Ltd_and_Sky_Betting_and_Gaming",null,"gdprhub",null,null,"GB: sky betting and gaming",null,null,null,null,null,null,null,null,null],["2024/PL/010","ETid-2466","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-08-30","day",4500,null,"EUR",null,null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/decyzje/DOKE.561.4.2024","https://www.enforcementtracker.com/ETid-2466",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/FI/011","Tietosuojavaltuutetun toimisto (Finland) - TSV/91/2020","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-08-30","day",null,null,null,"Finnish Tax Administration",null,"Art. 12(2), Art. 15, Art. 15(3), Art. 58(2)(b), Art. 58(2)(d)","Data subject rights, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242283","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/91/2020",null,"gdprhub",null,null,"FI: finnish tax administration",null,null,null,null,null,null,null,null,null],["2024/BE/042","APD/GBA (Belgium) - 109/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-08-29","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 16, Art. 22, Art. 24, Art. 32, Art. 4(11), Art. 9(2)","Accountability, Data security, Data subject rights, Special categories, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-109-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_109/2024",null,"gdprhub",null,"Broker",null,null,null,null,null,null,null,null,null,null],["2024/SE/003","ETid-2449","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2024-08-29","day",3200000,null,"EUR","Apoteket AB.","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-apoteket-ab.pdf","https://www.enforcementtracker.com/ETid-2449","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2022-3270","gdprhub",null,null,"apoteket ab",null,null,null,null,null,null,null,null,null],["2024/SE/002","ETid-2450","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2024-08-29","day",698000,null,"EUR","Apohem AB","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-apohem.pdf","https://www.enforcementtracker.com/ETid-2450",null,null,null,null,"apohem ab",null,null,null,null,null,null,null,null,null],["2024/BE/038","APD/GBA (Belgium) - 107/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-08-23","day",100000,"100,000","EUR",null,null,"Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-107-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_107/2024",null,"gdprhub",null,"Telecom provider",null,null,null,null,null,null,null,null,null,null],["2024/ES/041","ETid-2459","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-08-22","day",50000,null,"EUR","SANTANDER CONSUMER FINANCE, S.A.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00380-2023.pdf","https://www.enforcementtracker.com/ETid-2459","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202307696","gdprhub",null,null,"santander consumer finance sa","Santander",null,null,null,null,null,null,null,null],["2024/NL/004","AP (The Netherlands) - Takeaway B.V. - z2022-04011","gdprhub","Netherlands","NL","AP (The Netherlands)","2024-08-20","day",null,null,null,null,null,"Art. 44, Art. 46","International transfers",null,"Violation found","https://gdprhub.eu/images/e/eb/2024.08.20_-_Courtesy_translation_-_redacted.pdf","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Takeaway_B.V._-_z2022-04011",null,"gdprhub",null,"Food delivery company",null,null,null,null,null,null,null,null,null,null],["2024/PL/011","ETid-2457","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-08-20","day",940000,null,"EUR","mBank","Finance, Insurance and Consulting",null,"Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/pl/138/3343","https://www.enforcementtracker.com/ETid-2457",null,null,null,null,"PL: mbank",null,null,null,null,null,null,null,null,null],["2024/RO/003","ETid-2477","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-08-20","day",8000,null,"EUR","Ana Hotels SRL","Accommodation and Hospitality","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20.08.2024&lang=ro","https://www.enforcementtracker.com/ETid-2477",null,null,null,null,"ana hotels srl",null,null,null,null,null,null,null,null,null],["2024/PL/028","UODO (Poland) - DKN.5131.1.2024","gdprhub","Poland","PL","UODO (Poland)","2024-08-20","day",null,"4,053,173","PLN","mBank",null,"Art. 34, Art. 4(12)","Data breach",null,"Violation found","https://www.uodo.gov.pl/decyzje/DKN.5131.1.2024","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.1.2024",null,"gdprhub",null,null,"PL: mbank",null,4053173.0,950490,"day 2024-08-20|4.2643|PLN",null,null,null,null,null],["2024/AT/003","ETid-2772","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2024-08-16","day",1500000,null,"EUR","Company","Industry and Commerce",null,null,"Unknown","Fine issued","https://dsb.gv.at/sites/site0344/media/downloads/datenschutzbericht_2024.pdf","https://www.enforcementtracker.com/ETid-2772",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/AT/001","ETid-2909","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2024-08-16","day",1500000,null,"EUR","IKEA","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20240816_2023_0_680_196_00","https://www.enforcementtracker.com/ETid-2909",null,null,null,null,"AT: ikea",null,null,null,null,null,"confirmed","Confirmed in court: the Federal Administrative Court upheld the decision largely and the EUR 1.5 million fine in full (25 July 2025). A further appeal to the Supreme Administrative Court (VwGH) is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20240816_2023_0_680_196_00",1500000],["2024/BE/043","APD/GBA (Belgium) - 103/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-08-14","day",null,null,null,"Cumuleo.be",null,"Art. 17(3)(a), Art. 21(1)","Data subject rights",null,"Rejected","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n0-103-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_103/2024",null,"gdprhub",null,null,"BE: cumuleo be",null,null,null,null,null,null,null,null,null],["2024/DK/003","ETid-2432","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2024-08-14","day",26800,null,"EUR","Municipality of Vejen","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/aug/endnu-en-kommune-indstillet-til-boede-for-manglende-kryptering","https://www.enforcementtracker.com/ETid-2432",null,null,null,null,"DK: municipality of vejen",null,null,null,null,null,null,null,null,null],["2024/ES/045","ETid-2431","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-08-12","day",270000,null,"EUR","UNIQLO EUROPE, LTD, SUCURSAL EN ESPAÑA","Employment","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00238-2024.pdf","https://www.enforcementtracker.com/ETid-2431",null,null,null,null,"uniqlo europe ltd sucursal en espana",null,null,null,null,null,null,null,null,null],["2024/RO/011","ETid-2419","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-08-06","day",1000,null,"EUR","BEST ELAN ONLINE SRL",null,"Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_06.08.2024&lang=ro","https://www.enforcementtracker.com/ETid-2419",null,null,null,null,"best elan online srl",null,null,null,null,null,null,null,null,null],["2024/ES/040","ETid-2460","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-08-06","day",10000,null,"EUR","LOCAL VERTICALS, S.L.",null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00546-2023.pdf","https://www.enforcementtracker.com/ETid-2460",null,null,null,null,"local verticals sl",null,null,null,null,null,null,null,null,null],["2024/ES/037","ETid-2465","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-08-06","day",1000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00001-2023.pdf","https://www.enforcementtracker.com/ETid-2465",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/ES/035","ETid-2480","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-08-06","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00362-2023.pdf","https://www.enforcementtracker.com/ETid-2480",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/PL/025","UODO (Poland) - DS.523.4480.2024","gdprhub","Poland","PL","UODO (Poland)","2024-08-05","day",null,null,null,"Meta Platforms Ireland",null,"Art. 5(1), Art. 6(1), Art. 66(1)","Data principles, Unlawful processing",null,"Other Outcome","https://uodo.gov.pl/pl/file/5092","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DS.523.4480.2024",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2024/PL/024","UODO (Poland) - DS.523.4486.2024","gdprhub","Poland","PL","UODO (Poland)","2024-08-05","day",null,null,null,"Meta Platforms Ireland",null,"Art. 5(1), Art. 6(1), Art. 66(1)","Data principles, Unlawful processing",null,"Other Outcome","https://uodo.gov.pl/pl/file/5093","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DS.523.4486.2024",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2024/ES/142","AEPD (Spain) - EXP202307313","gdprhub","Spain","ES","AEPD (Spain)","2024-07-31","day",60000,"60,000","EUR","Curenergía",null,"Art. 6(1), Art. 83(5)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00245-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202307313",null,"gdprhub",null,null,"ES: curenergia",null,null,null,null,null,null,null,null,null],["2024/BE/034","APD/GBA (Belgium) - 101/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-07-25","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-101-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_101/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/033","APD/GBA (Belgium) - 98/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-07-24","day",null,null,null,null,null,"Art. 12(3), Art. 15, Art. 31","Data subject rights, Transparency",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-98-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_98/2024",null,"gdprhub",null,"Resident",null,null,null,null,null,"person",null,null,null,null],["2024/BE/041","APD/GBA (Belgium) - 99/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-07-24","day",null,null,null,null,null,"Art. 12, Art. 15","Data subject rights, Transparency",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-99-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_99/2024",null,"gdprhub",null,"Employee of a company",null,null,null,null,null,"person",null,null,null,null],["2024/AT/013","DSB (Austria) - 2025-0.587.686","gdprhub","Austria","AT","DSB (Austria)","2024-07-24","day",null,null,null,null,null,"Art. 4, Art. 6","Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20250724_2025_0_587_686_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.587.686",null,"gdprhub",null,"Real estate company",null,null,null,null,null,null,null,null,null,null],["2024/GR/027","HDPA (Greece) - 37/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-07-24","day",15000,"15,000","EUR",null,null,"Art. 12(2), Art. 13, Art. 14, Art. 5(1)(a), Art. 6(1), Art. 6(4), Art. 9(1), Art. 9(2)","Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-ypopsifio-boyleyti-iatro-dimosioy-nosokomeioy-gia","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_37/2024",null,"gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2024/FR/017","ETid-2410","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-07-22","day",6900,null,"EUR","Municipality of Korou","Public Sector and Education","Art. 31, Art. 37","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.cnil.fr/fr/sanction-non-designation-dun-dpo-commune-kourou","https://www.enforcementtracker.com/ETid-2410",null,null,null,null,"FR: municipality of korou",null,null,null,null,null,null,null,null,null],["2024/NL/009","ETid-2447","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2024-07-22","day",290000000,null,"EUR","Uber Technologies Inc., Uber B.V.","Employment","Art. 44","Data principles, International transfers","Non-compliance with general data processing principles","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/ap-legt-uber-boete-op-van-290-miljoen-euro-om-doorgifte-data-chauffeurs-naar-vs","https://www.enforcementtracker.com/ETid-2447","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Uber","gdprhub",null,null,"uber technologies inc uber bv","Uber",null,null,null,null,null,null,null,null],["2024/ES/052","ETid-2402","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-07-18","day",200000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00306-2023.pdf","https://www.enforcementtracker.com/ETid-2402","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202308186","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/ES/051","ETid-2403","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-07-18","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00421-2023.pdf","https://www.enforcementtracker.com/ETid-2403",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/ES/053","ETid-2401","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-07-17","day",600,null,"EUR","DIGIMAN ALICANTE S.L.","Transportation and Energy","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00096-2024.pdf","https://www.enforcementtracker.com/ETid-2401",null,null,null,null,"digiman alicante sl",null,null,null,null,null,null,null,null,null],["2024/IT/012","ETid-2483","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-07-17","day",80000,null,"EUR","Selectra S.p.A.","Employment","Art. 13, Art. 88","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/1006611","https://www.enforcementtracker.com/ETid-2483","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10053224","gdprhub",null,null,"selectra spa",null,null,null,null,null,null,null,null,null],["2024/IT/003","ETid-2535","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-07-17","day",5000000,null,"EUR","Hera Comm S.p.A.","Transportation and Energy","Art. 12(3), Art. 15, Art. 24, Art. 28, Art. 32, Art. 5(2)","Accountability, Data principles, Data security, Data subject rights, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10053275","https://www.enforcementtracker.com/ETid-2535","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10053211","gdprhub",null,null,"hera comm spa",null,null,null,null,null,null,null,null,null],["2024/IT/126","Garante per la protezione dei dati personali (Italy) - 10057346","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-17","day",null,null,null,null,null,"Art. 32(1), Art. 32(2), Art. 33, Art. 9","Data breach, Data security, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10057346%20","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10057346",null,"gdprhub",null,"Clinic",null,null,null,null,null,null,null,null,null,null],["2024/IT/114","Garante per la protezione dei dati personali (Italy) - 10057648","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-17","day",null,null,null,"Istituto Nazionale Previdenza Sociale",null,"Art. 25, Art. 32, Art. 33, Art. 34, Art. 5","Accountability, Data breach, Data principles, Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10057648","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10057648",null,"gdprhub",null,null,"IT: istituto nazionale previdenza sociale",null,null,null,null,null,null,null,null,null],["2024/IT/112","Garante per la protezione dei dati personali (Italy) - 10058595","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-17","day",22000,"22,000","EUR","Azienda ULSS 6 Euganea",null,"Art. 32, Art. 33(1), Art. 34(1), Art. 5(1)(f)","Data breach, Data principles, Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10058595","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10058595",null,"gdprhub",null,null,"IT: azienda ulss 6 euganea",null,null,null,null,null,null,null,null,null],["2024/IT/120","Garante per la protezione dei dati personali (Italy) - 10070252","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-17","day",null,null,null,"Avis Budget Italia S.p.A.",null,"Art. 4(12), Art. 56(1), Art. 60(4), Art. 60(6)",null,null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10070252","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10070252",null,"gdprhub",null,null,"avis budget italia spa",null,null,null,null,null,null,null,null,null],["2024/IT/121","Garante per la protezione dei dati personali (Italy) - 10070330","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-17","day",4000,"4,000","EUR",null,null,"Art. 15","Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10070330","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10070330",null,"gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2024/BE/031","APD/GBA (Belgium) - 97/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-07-16","day",null,null,null,null,null,"Art. 12(4), Art. 17(1), Art. 5(1)(b), Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-97-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_97/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/LT/006","VDAI (Lithuania) - 3R-741","gdprhub","Lithuania","LT","VDAI (Lithuania)","2024-07-16","day",2000,"2,000","EUR",null,null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://vdai.lrv.lt/public/canonical/1725442009/582/2024-09-02%20Sprendimo%203R-741%20apibendrinimas%20(MM)%20fn.pdf","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_3R-741",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2024/EE/001","ETid-2593","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2024-07-15","day",30000,null,"EUR","Pere Sihtkapital SA",null,null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aki.ee/uudised/aki-vaarteootsus-pere-sihtkapitali-lastetu-pereuuringu-osas","https://www.enforcementtracker.com/ETid-2593",null,null,null,null,"pere sihtkapital sa",null,null,null,null,null,null,null,null,null],["2024/ES/133","AEPD (Spain) - EXP202302929","gdprhub","Spain","ES","AEPD (Spain)","2024-07-12","day",180000,"180,000","EUR","ID Finance",null,"Art. 17, Art. 37(7), Art. 6(1)(a)","Data protection officer, Data subject rights, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00091-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202302929",null,"gdprhub",null,null,"ES: id finance",null,null,null,null,null,null,null,null,null],["2024/ES/157","AEPD (Spain) - EXP202310096","gdprhub","Spain","ES","AEPD (Spain)","2024-07-11","day",15000,"15,000","EUR","Gomera Trail Paradise",null,"Art. 13(1), Art. 13(2), Art. 30, Art. 5(2), Art. 9(2)(a)","Data principles, Special categories, Transparency",null,"Violation found","https://www.aepd.es/documento/ps-00363-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202310096",null,"gdprhub",null,null,"ES: gomera trail paradise",null,null,null,null,null,null,null,null,null],["2024/ES/038","ETid-2464","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-07-11","day",600,null,"EUR","ASSOCIACIO CANNABICA DEL MARESME ACANNAM","Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00081-2023.pdf","https://www.enforcementtracker.com/ETid-2464",null,null,null,null,"ES: associacio cannabica del maresme acannam",null,null,null,null,null,null,null,null,null],["2024/ES/055","ETid-2396","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-07-10","day",300,null,"EUR","WWPD CINVENTO INTERNATIONAL PATENT TRADING, S.L.",null,"Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00206-2024.pdf","https://www.enforcementtracker.com/ETid-2396",null,null,null,null,"wwpd cinvento international patent trading sl",null,null,null,null,null,null,null,null,null],["2024/PL/009","ETid-2467","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-07-10","day",5000,null,"EUR",null,null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/decyzje/DOKE.561.1.2024.","https://www.enforcementtracker.com/ETid-2467",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/121","AEPD (Spain) - EXP202202415","gdprhub","Spain","ES","AEPD (Spain)","2024-07-09","day",15000,"15,000","EUR","GlovoApp23 SA",null,"Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/documento/ps-00168-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202415",null,"gdprhub",null,null,"glovoapp23 sa",null,null,null,null,null,null,null,null,null],["2024/ES/138","AEPD (Spain) - EXP202304146","gdprhub","Spain","ES","AEPD (Spain)","2024-07-08","day",72000,"72,000","EUR","Wenance Lending de España S.A.",null,"Art. 12, Art. 6(1)","Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00354-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202304146",null,"gdprhub",null,null,"wenance lending de espana sa",null,null,null,null,null,null,null,null,null],["2024/ES/136","AEPD (Spain) - EXP202310875","gdprhub","Spain","ES","AEPD (Spain)","2024-07-08","day",4000,"4,000","EUR","Asociación Escuela Nacional de Equitación",null,"Art. 14, Art. 6","Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00051-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202310875",null,"gdprhub",null,null,"ES: asociacion escuela nacional de equitacion",null,null,null,null,null,null,null,null,null],["2024/ES/039","ETid-2462","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-07-05","day",10000,null,"EUR","Clinic owner","Health Care","Art. 6(1), Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00130-2024.pdf","https://www.enforcementtracker.com/ETid-2462","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202403915","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/GR/023","HDPA (Greece) - 18/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-07-05","day",15000,"15,000","EUR","the Municipality of Alimos",null,"Art. 25(1), Art. 28(3), Art. 32(1), Art. 33(4), Art. 34(1), Art. 34(2), Art. 5(1)(f)","Accountability, Data breach, Data principles, Data security, Processor obligations",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-07/18_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_18/2024",null,"gdprhub",null,null,"GR: the municipality of alimos",null,null,null,null,null,null,null,null,null],["2024/AT/012","DSB (Austria) - 2024-0.199.724","gdprhub","Austria","AT","DSB (Austria)","2024-07-04","day",null,null,null,"Court of Auditors Austria",null,"Art. 2(2)(a), Art. 4(1), Art. 4(2), Art. 4(7), Art. 55(1), Art. 77(1), Art. 9(1), Art. 9(2)(g)","Special categories",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20240704_2024_0_199_724_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2024-0.199.724",null,"gdprhub",null,null,"AT: court of auditors austria",null,null,null,null,null,"appealed","Not final: the complainant appealed to the Federal Administrative Court (BVwG); the case is pending.","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20240704_2024_0_199_724_00",null],["2024/ES/044","ETid-2434","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-07-04","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00179-2023.pdf","https://www.enforcementtracker.com/ETid-2434",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/IT/015","ETid-2474","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-07-04","day",900000,null,"EUR","Postel S.p.A",null,"Art. 25, Art. 32, Art. 33, Art. 5(1)(f)","Accountability, Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10066116","https://www.enforcementtracker.com/ETid-2474","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10063782","gdprhub",null,null,"postel spa",null,null,null,null,null,null,null,null,null],["2024/IT/103","Garante per la protezione dei dati personali (Italy) - 10039592","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-04","day",null,null,null,"Istituto Statale \"Duca degli Abruzzi\"",null,"Art. 6(1)(c), Art. 6(1)(e), Art. 6(2)","Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10039592","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10039592",null,"gdprhub",null,null,"IT: istituto statale duca degli abruzzi",null,null,null,null,null,null,null,null,null],["2024/IT/109","Garante per la protezione dei dati personali (Italy) - 10050145","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-04","day",4000,"4,000","EUR","Comune di Villasimius",null,"Art. 12(3), Art. 17, Art. 5(1)(a), Art. 6(1)(c), Art. 6(1)(e)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10050145","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10050145",null,"gdprhub",null,null,"IT: comune di villasimius",null,null,null,null,null,null,null,null,null],["2024/IT/108","Garante per la protezione dei dati personali (Italy) - 10050298","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-07-04","day",7000,"7,000","EUR","Comune di Treviso",null,"Art. 24(1), Art. 25(1), Art. 25(2), Art. 28(3), Art. 5(2)","Accountability, Data principles, Processor obligations",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10050298","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10050298",null,"gdprhub",null,null,"IT: comune di treviso",null,null,null,null,null,null,null,null,null],["2024/FI/010","Tietosuojavaltuutetun toimisto (Finland) - TSV/955/2023","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-07-04","day",null,null,null,"Finnish Golf Union",null,"Art. 25(1), Art. 32(1)(b), Art. 58(2)(b), Art. 58(2)(d)","Accountability, Data security",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242263","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/955/2023",null,"gdprhub",null,null,"FI: finnish golf union",null,null,null,null,null,null,null,null,null],["2024/LT/003","ETid-2398","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2024-07-02","day",2385276,null,"EUR","Vinted","Industry and Commerce","Art. 5(1)(a), Art. 5(2)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://vdai.lrv.lt/en/news/a-company-operating-an-online-second-hand-clothing-trading-and-exchange-platform-is-fined-under-the-general-data-protection-regulation/","https://www.enforcementtracker.com/ETid-2398","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_Vinted_UAB","gdprhub",null,null,"vinted uab","Vinted",null,null,null,null,"appealed","Appealed: Vinted took the decision to the Regional Administrative Court. The outcome is not yet published.","https://vdai.lrv.lt/public/canonical/1725452254/587/2024-07-02_apibendrinimas%20OSS.pdf",2385276],["2024/HU/002","NAIH (Hungary) - NAIH-3932-5/2024","gdprhub","Hungary","HU","NAIH (Hungary)","2024-07-02","day",null,"80,000,000","HUF","ALDI MAGYARORSZÁG ÉLELMISZER Élelmiszer Kereskedelmi Betéti Társaság",null,"Art. 12(1), Art. 13, Art. 32, Art. 5(1)(a), Art. 5(1)(c)","Data principles, Data security, Transparency",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=944:alkoholtartalmu-italok-vasarlasa-kapcsan-kialakitott-adatkezelesi-gyakorlat-dontes-a-megismetelt-eljarasban","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-3932-5/2024",null,"gdprhub",null,null,"HU: aldi magyarorszag elelmiszer elelmiszer kereskedelmi beteti tarsasag",null,80000000.0,202224,"day 2024-07-02|395.6000|HUF",null,null,null,null,null],["2024/DK/007","Datatilsynet (Denmark) - 2023-431-0018","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-06-27","day",null,null,null,"IDA Forsikring Forsikringsformidling F.M.B.A.",null,"Art. 6(1)(c), Art. 6(1)(f), Art. 9","Special categories, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/jun/ida-forsikrings-brug-af-kunstig-intelligens-til-analyse-af-optagne-telefonsamtaler#_ftn2","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-431-0018",null,"gdprhub",null,null,"DK: ida forsikring forsikringsformidling fmba",null,null,null,null,null,null,null,null,null],["2024/GR/004","ETid-2400","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-06-27","day",50000,null,"EUR","METRO SA","Industry and Commerce","Art. 15, Art. 17, Art. 24, Art. 32, Art. 33","Accountability, Data breach, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-etaireia-gia-peristatiko-parabiasis-dedomenon-kai","https://www.enforcementtracker.com/ETid-2400",null,null,null,null,"metro sa",null,null,null,null,null,null,null,null,null],["2024/ES/066","ETid-2383","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-26","day",600,null,"EUR","Homeowners' association","Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00561-2023.pdf","https://www.enforcementtracker.com/ETid-2383",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/054","ETid-2397","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-26","day",80000,null,"EUR","AXA REAL ESTATE INVESTMENT MANAGERS IBERICA S.A. y SEUR GEOPOST, S.L.","Real Estate","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00117-2024.pdf","https://www.enforcementtracker.com/ETid-2397","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00117-2024","gdprhub",null,null,"axa real estate investment managers iberica say seur geopost sl",null,null,null,null,null,null,null,null,null],["2024/ES/043","ETid-2436","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-26","day",4000,null,"EUR","ALTERNATIVA CORELLANA INDEPENDIENTE","Individuals and Private Associations","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00441-2023.pdf","https://www.enforcementtracker.com/ETid-2436",null,null,null,null,"ES: alternativa corellana independiente",null,null,null,null,null,null,null,null,null],["2024/RO/013","ETid-2375","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-06-25","day",3000,null,"EUR","Rețele Electrice Muntenia SA.","Transportation and Energy","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20.06.2024&lang=ro","https://www.enforcementtracker.com/ETid-2375",null,null,null,null,"retele electrice muntenia sa",null,null,null,null,null,null,null,null,null],["2024/RO/012","ETid-2376","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-06-25","day",1000,null,"EUR","Rețele Electrice Dobrogea SA","Transportation and Energy","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20.06.2024&lang=ro","https://www.enforcementtracker.com/ETid-2376",null,null,null,null,"retele electrice dobrogea sa",null,null,null,null,null,null,null,null,null],["2024/ES/065","ETid-2384","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-25","day",150000,null,"EUR","BANCO CETELEM, S.A.","Finance, Insurance and Consulting","Art. 17(1)(d), Art. 6","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00061-2024.pdf","https://www.enforcementtracker.com/ETid-2384",null,null,null,null,"banco cetelem sa",null,null,null,null,null,null,null,null,null],["2024/ES/042","ETid-2451","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-25","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00282-2023.pdf","https://www.enforcementtracker.com/ETid-2451",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/DK/009","Datatilsynet (Denmark) - 2023-31-0053","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-06-24","day",null,null,null,"Clemens Bar ApS",null,"Art. 15","Data subject rights",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/jun/natklub-faar-alvorlig-kritik-manglende-indsigt-i-og-sletning-af-tv-overvaagningsoptagelser","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-31-0053",null,"gdprhub",null,null,"clemens bar aps",null,null,null,null,null,null,null,null,null],["2024/SE/004","ETid-2377","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2024-06-24","day",1300000,null,"EUR","Avanza Bank AB","Finance, Insurance and Consulting","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2024/beslut-tillsyn-avanza.pdf","https://www.enforcementtracker.com/ETid-2377","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-5544_Avanza_Bank","gdprhub",null,null,"avanza bank ab",null,null,null,null,null,null,null,null,null],["2024/ES/070","ETid-2371","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-20","day",42000,null,"EUR","CUI ZSQ FOOD, S.L.","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00435-2023.pdf","https://www.enforcementtracker.com/ETid-2371",null,null,null,null,"cui zsq food sl",null,null,null,null,null,null,null,null,null],["2024/IT/022","ETid-2404","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-20","day",4000,null,"EUR","Medical association","Health Care","Art. 12(3), Art. 13(2)(a), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10037411","https://www.enforcementtracker.com/ETid-2404",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/018","ETid-2411","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-20","day",20000,null,"EUR","Municipality of Nepi","Public Sector and Education","Art. 28, Art. 5(1)(a), Art. 6","Data principles, Processor obligations, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10039471","https://www.enforcementtracker.com/ETid-2411","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10039471","gdprhub",null,null,"IT: municipality of nepi",null,null,null,null,null,null,null,null,null],["2024/IT/017","ETid-2427","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-20","day",10000,null,"EUR","TS Food Processing s.r.l.","Employment","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10043600","https://www.enforcementtracker.com/ETid-2427","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10043600","gdprhub",null,null,"ts food processing srl",null,null,null,null,null,null,null,null,null],["2024/IT/001","ETid-2540","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-20","day",1000000,null,"EUR","Fastweb S.p.A.","Media, Telecoms and Broadcasting","Art. 13, Art. 15, Art. 16, Art. 17, Art. 18, Art. 19, Art. 20, Art. 21, Art. 22, Art. 24(1), Art. 25, Art. 5(2), Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10040382","https://www.enforcementtracker.com/ETid-2540","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10040382","gdprhub",null,null,"fastweb spa",null,null,null,null,null,null,null,null,null],["2024/IT/092","Garante per la protezione dei dati personali (Italy) - 10028498","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-06-20","day",15000,"15,000","EUR","Comune di Forlì",null,"Art. 12(1), Art. 13, Art. 13(2)(a), Art. 25(1), Art. 28(3), Art. 28(9), Art. 32, Art. 35(1), Art. 5(1)(a), Art. 5(1)(f), Art. 5(2)","Accountability, DPIA, Data principles, Data security, Processor obligations, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10028498","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10028498",null,"gdprhub",null,null,"IT: comune di forli",null,null,null,null,null,null,null,null,null],["2024/IT/104","Garante per la protezione dei dati personali (Italy) - 10039570","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-06-20","day",null,null,null,"Comune di Torri del Benaco",null,"Art. 5(1)(a), Art. 5(1)(c), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10039570","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10039570",null,"gdprhub",null,null,"IT: comune di torri del benaco",null,null,null,null,null,null,null,null,null],["2024/FI/009","Tietosuojavaltuutetun toimisto (Finland) - TSV/206/2022","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-06-20","day",null,null,null,null,null,"Art. 58(2)(b), Art. 58(2)(d), Art. 6(1), Art. 6(1)(b)","Unlawful processing",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242243","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/206/2022",null,"gdprhub",null,"Bus operator",null,null,null,null,null,null,null,null,null,null],["2024/SI/010","IP (Slovenia) - 07100-10/2023/14","gdprhub","Slovenia","SI","IP (Slovenia)","2024-06-19","day",null,null,null,null,null,"Art. 12(2), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2024/julij/Julij_2024-Odlocbe-ZIN.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07100-10/2023/14",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/035","APD/GBA (Belgium) - 93/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-06-17","day",null,null,null,null,null,"Art. 15, Art. 17(3)(e)","Data subject rights",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-93-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_93/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/069","ETid-2372","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-17","day",600,null,"EUR","Club Balonmano Gijón","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00494-2023.pdf","https://www.enforcementtracker.com/ETid-2372",null,null,null,null,"ES: club balonmano gijon",null,null,null,null,null,null,null,null,null],["2024/ES/061","ETid-2388","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-17","day",3000,null,"EUR","20 AÑOS DE MÚSICA A.I.E.","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00570-2023.pdf","https://www.enforcementtracker.com/ETid-2388",null,null,null,null,"ES: 20 anos de musica aie",null,null,null,null,null,null,null,null,null],["2024/SI/009","IP (Slovenia) - 0602-11/2024/9","gdprhub","Slovenia","SI","IP (Slovenia)","2024-06-17","day",null,null,null,null,null,"Art. 12(3), Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2024/julij/Julij_2024-Odlocbe-ZIN.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0602-11/2024/9",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/060","ETid-2389","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-13","day",3000,null,"EUR","DQG NORTE A.I.E","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00569-2023.pdf","https://www.enforcementtracker.com/ETid-2389",null,null,null,null,"ES: dqg norte aie",null,null,null,null,null,null,null,null,null],["2024/PL/008","ETid-2468","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-06-13","day",9200,null,"EUR","Healthcare facility","Health Care","Art. 24(1), Art. 25(1), Art. 34(1)","Accountability, Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.57.2022","https://www.enforcementtracker.com/ETid-2468",null,null,null,null,"PL: healthcare facility",null,null,null,null,null,null,null,null,null],["2024/SI/008","IP (Slovenia) - 07101-37/2023/30","gdprhub","Slovenia","SI","IP (Slovenia)","2024-06-13","day",null,null,null,null,null,"Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2024/julij/Julij_2024-Odlocbe-ZIN.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07101-37/2023/30",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2024/ES/067","ETid-2379","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-12","day",120000,null,"EUR","BANCO BILBAO VIZCAYA ARGENTARIA, S.A.","Finance, Insurance and Consulting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00088-2024.pdf","https://www.enforcementtracker.com/ETid-2379","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202402432","gdprhub",null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2024/ES/072","ETid-2367","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-10","day",100000,null,"EUR","NATURGY IBERIA, S.A.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00366-2023.pdf","https://www.enforcementtracker.com/ETid-2367",null,null,null,null,"naturgy iberia sa",null,null,null,null,null,null,null,null,null],["2024/ES/068","ETid-2378","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-10","day",160000,null,"EUR","ALLIANZ COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00158-2024.pdf","https://www.enforcementtracker.com/ETid-2378",null,null,null,null,"allianz compania de seguros y reaseguros sa",null,null,null,null,null,null,null,null,null],["2024/FR/012","ETid-2420","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-06-10","day",5000,null,"EUR","Bakery","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2420",null,null,null,null,"FR: bakery",null,null,null,null,null,null,null,null,null],["2024/ES/158","AEPD (Spain) - EXP202403325","gdprhub","Spain","ES","AEPD (Spain)","2024-06-07","day",10000,"10000","EUR",null,null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00111-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202403325",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2024/IE/008","DPC (Ireland) - Inquiry Concerning Mediahuis Ireland Group Limited (MIG)","gdprhub","Ireland","IE","DPC (Ireland)","2024-06-07","day",null,null,null,"Mediahuis Ireland Group Limited",null,"Art. 5(1)(f)","Data principles",null,"Rejected","https://www.dataprotection.ie/en/dpc-guidance/law/decisions-made-under-data-protection-act-2018/inquiry-concerning-mediahuis-ireland-group-limited-june-2024","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Inquiry_Concerning_Mediahuis_Ireland_Group_Limited_%28MIG%29",null,"gdprhub",null,null,"mediahuis ireland group ltd",null,null,null,null,null,null,null,null,null],["2024/ES/047","ETid-2417","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-07","day",2000,null,"EUR","EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00093-2023.pdf","https://www.enforcementtracker.com/ETid-2417",null,null,null,null,"explotaciones hosteleras y de ocio albacetenas sl",null,null,null,null,null,null,null,null,null],["2024/HU/003","NAIH (Hungary) - NAIH-5461-2/2024","gdprhub","Hungary","HU","NAIH (Hungary)","2024-06-07","day",null,null,null,"Mediaworks Hungary Zrt.",null,"Art. 13, Art. 14, Art. 6(1)(f)","Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=952:kozszereplo-politikus-maganlakasa-kepmasanak-es-epitesi-e-naplo-adatainak-nyilvanossaga-egy-kozeleti-kerdes-sajto-altali-publikalasa-soran","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-5461-2/2024",null,"gdprhub",null,null,"mediaworks hungary zrt",null,null,null,null,null,null,null,null,null],["2024/DK/006","Datatilsynet (Denmark) - 2024-32-0283","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-06-06","day",null,null,null,"Indenrigs- og Sundhedsministeriet",null,"Art. 15(1), Art. 23(1)","Data subject rights",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/jun/hvad-gaelder-for-indsigt-i-logfiler","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2024-32-0283",null,"gdprhub",null,null,"DK: indenrigs og sundhedsministeriet",null,null,null,null,null,null,null,null,null],["2024/IT/027","ETid-2380","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-06","day",120000,null,"EUR","Cappello Giovanni & Figli s.r.l.","Employment","Art. 13, Art. 6, Art. 9(2)(b)","Data principles, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10029500","https://www.enforcementtracker.com/ETid-2380","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10029500","gdprhub",null,null,"cappello giovanni and figli srl",null,null,null,null,null,null,null,null,null],["2024/IT/026","ETid-2381","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-06","day",6419631,null,"EUR","Eni Plenitude S.p.A.","Transportation and Energy","Art. 24, Art. 25, Art. 28, Art. 5(2), Art. 6","Accountability, Data principles, Processor obligations, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10029424","https://www.enforcementtracker.com/ETid-2381","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10029424","gdprhub",null,null,"eni plenitude spa",null,null,null,null,null,null,null,null,null],["2024/IT/023","ETid-2394","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-06","day",500,null,"EUR","Comune di Ustica","Public Sector and Education","Art. 37(7), Art. 6(2), Art. 6(3)(b)","Data principles, Data protection officer, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10032683","https://www.enforcementtracker.com/ETid-2394",null,null,null,null,"IT: comune di ustica",null,null,null,null,null,null,null,null,null],["2024/IT/002","ETid-2536","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-06-06","day",1000000,null,"EUR","CA Autobank S.p.A.","Transportation and Energy","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10042684","https://www.enforcementtracker.com/ETid-2536",null,null,null,null,"ca autobank spa",null,null,null,null,null,null,null,null,null],["2024/AT/004","ETid-2771","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2024-06-06","day",100000,null,"EUR","Covid 19 Test Lab","Health Care","Art. 28(3), Art. 32, Art. 34, Art. 5(1)(f), Art. 9","Data breach, Data principles, Data security, Processor obligations, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://dsb.gv.at/sites/site0344/media/downloads/datenschutzbericht_2024.pdf","https://www.enforcementtracker.com/ETid-2771",null,null,null,null,"AT: covid 19 test lab",null,null,null,null,null,null,null,null,null],["2024/IT/098","Garante per la protezione dei dati personali (Italy) - 10039453","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-06-06","day",24000,"24,000","EUR","Azienda Unità Sanitaria Locale della Romagna",null,"Art. 32(1), Art. 5(1)(c), Art. 5(1)(f), Art. 9(1), Art. 9(2)(h), Art. 9(4)","Data principles, Data security, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10039453","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10039453",null,"gdprhub",null,null,"IT: azienda unita sanitaria locale della romagna",null,null,null,null,null,null,null,null,null],["2024/IT/101","Garante per la protezione dei dati personali (Italy) - 10043007","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-06-06","day",1000000,"1,000,000","EUR","CA Autobank S.p.A.",null,"Art. 28(3), Art. 5(1)(a)","Data principles, Processor obligations",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10043007","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10043007",null,"gdprhub",null,null,"ca autobank spa",null,null,null,null,null,null,null,null,null],["2024/FI/008","Tietosuojavaltuutetun toimisto (Finland) - TSV/88/2022","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-06-06","day",null,null,null,null,null,"Art. 12(2), Art. 12(6), Art. 5(1)(c), Art. 58(2)(d)","Data principles, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242223","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/88/2022",null,"gdprhub",null,"Media company",null,null,null,null,null,null,null,null,null,null],["2024/FR/021","ETid-2344","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-06-05","day",null,null,"EUR","Company",null,"Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-neuf-nouvelles-sanctions-procedure-simplifiee","https://www.enforcementtracker.com/ETid-2344",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/020","ETid-2345","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-06-05","day",null,null,"EUR","Company",null,"Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-neuf-nouvelles-sanctions-procedure-simplifiee","https://www.enforcementtracker.com/ETid-2345",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/019","ETid-2346","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-06-05","day",null,null,"EUR",null,null,null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-neuf-nouvelles-sanctions-procedure-simplifiee","https://www.enforcementtracker.com/ETid-2346",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/018","ETid-2347","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-06-05","day",null,null,"EUR",null,null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-neuf-nouvelles-sanctions-procedure-simplifiee","https://www.enforcementtracker.com/ETid-2347",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/073","ETid-2360","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-05","day",6000,null,"EUR","EUROBOX S.A.",null,"Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00109-2024.pdf","https://www.enforcementtracker.com/ETid-2360",null,null,null,null,"eurobox sa",null,null,null,null,null,null,null,null,null],["2024/ES/063","ETid-2386","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-05","day",180,null,"EUR","Website operator",null,"Art. 5(1)(e)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00098-2024.pdf","https://www.enforcementtracker.com/ETid-2386",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/062","ETid-2387","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-06-05","day",800,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00105-2023.pdf","https://www.enforcementtracker.com/ETid-2387",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/NL/010","ETid-2351","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2024-06-04","day",6000,null,"EUR","Ambitious People Group B.V.","Finance, Insurance and Consulting","Art. 12(3), Art. 17(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/boete-voor-recruitmentbedrijf-om-negeren-verwijderverzoeken","https://www.enforcementtracker.com/ETid-2351","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_z2019-28837","gdprhub",null,null,"ambitious people group bv",null,null,null,null,null,null,null,null,null],["2024/BE/028","APD/GBA (Belgium) - 87/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-06-03","day",172431,"172,431","EUR",null,null,"Art. 17, Art. 21, Art. 21(2), Art. 38(2), Art. 5(1)(a)","Data principles, Data protection officer, Data subject rights",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-87-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_87/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/009","ETid-2545","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-31","day",600000,null,"EUR","GSMA Limited","Individuals and Private Associations","Art. 14, Art. 9(2)","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00541-2022.pdf","https://www.enforcementtracker.com/ETid-2545",null,null,null,null,"gsma ltd",null,null,null,null,null,null,null,null,null],["2024/RO/014","ETid-2348","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-05-30","day",2000,null,"EUR","Corint Logistic SRL.",null,"Art. 17, Art. 21(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_30.05.2024&lang=ro","https://www.enforcementtracker.com/ETid-2348",null,null,null,null,"corint logistic srl",null,null,null,null,null,null,null,null,null],["2024/ES/076","ETid-2349","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-30","day",4200,null,"EUR","PILLOW HOTELS, S.L.","Accommodation and Hospitality","Art. 32(1), Art. 33(1), Art. 5(1)(f)","Data breach, Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00133-2024.pdf","https://www.enforcementtracker.com/ETid-2349",null,null,null,null,"pillow hotels sl",null,null,null,null,null,null,null,null,null],["2024/ES/049","ETid-2407","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-28","day",70000,null,"EUR","CAIXABANK S.A.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00143-2023.pdf","https://www.enforcementtracker.com/ETid-2407","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202105363","gdprhub",null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2024/ES/046","ETid-2418","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-28","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00663-2022.pdf","https://www.enforcementtracker.com/ETid-2418","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202210212","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/BE/027","APD/GBA (Belgium) - 86/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-05-27","day",null,null,null,null,null,"Art. 12(1), Art. 13, Art. 15(1), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-86-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_86/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/GR/002","ETid-2556","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-05-27","day",400000,null,"EUR","Ministry of Interior (Greece)","Public Sector and Education","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-kai-entoli-symmorfosis-se-eyroboyleyti-kai-sto","https://www.enforcementtracker.com/ETid-2556",null,null,null,null,"GR: ministry of interior",null,null,null,null,null,null,null,null,null],["2024/GR/001","ETid-2559","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-05-27","day",40000,null,"EUR","Member of the European Parliament","Public Sector and Education","Art. 14, Art. 5(1)(a), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-kai-entoli-symmorfosis-se-eyroboyleyti-kai-sto","https://www.enforcementtracker.com/ETid-2559",null,null,null,null,"GR: member of the european parliament",null,null,null,null,null,null,null,null,null],["2024/GR/020","HDPA (Greece) - 16/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-05-27","day",440000,"440.000","EUR",null,null,"Art. 13, Art. 14, Art. 15, Art. 29, Art. 30, Art. 32, Art. 4, Art. 5(1), Art. 6","Data principles, Data security, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-05/16_2024%20anonym_0.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_16/2024",null,"gdprhub","Hellenic Ministry of Interior; MEP Anna Michelle Asimakopoulou",null,null,null,null,null,null,null,null,null,null,null],["2024/FR/008","ETid-2424","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-05-25","day",10000,null,"EUR","Association","Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2424",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/007","ETid-2425","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-05-25","day",15000,null,"EUR","Association","Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2425",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/059","ETid-2391","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-24","day",1000,null,"EUR","VOX ESPAÑA","Public Sector and Education","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00191-2023.pdf","https://www.enforcementtracker.com/ETid-2391",null,null,null,null,"ES: vox espana",null,null,null,null,null,null,null,null,null],["2024/ES/075","ETid-2350","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-23","day",600,null,"EUR","President of a workers' council","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00068-2024.pdf","https://www.enforcementtracker.com/ETid-2350",null,null,null,null,"ES: president of a workers council",null,null,null,null,null,null,null,null,null],["2024/IT/024","ETid-2390","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-05-23","day",3500,null,"EUR","Professional association","Public Sector and Education","Art. 27(7), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10030785","https://www.enforcementtracker.com/ETid-2390",null,null,null,null,"IT: professional association",null,null,null,null,null,null,null,null,null],["2024/IT/021","ETid-2405","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-05-23","day",4500,null,"EUR","Azienda Socio-sanitaria Territoriale Rhodense","Health Care","Art. 12, Art. 16, Art. 5(1)(d)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10036837","https://www.enforcementtracker.com/ETid-2405","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10036837","gdprhub",null,null,"IT: azienda socio sanitaria territoriale rhodense",null,null,null,null,null,null,null,null,null],["2024/IT/020","ETid-2408","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-05-23","day",8400,null,"EUR","Azienda Sanitaria Locale TO4","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10037439","https://www.enforcementtracker.com/ETid-2408","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10037439","gdprhub",null,null,"IT: azienda sanitaria locale to4",null,null,null,null,null,null,null,null,null],["2024/FR/011","ETid-2421","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-05-23","day",6000,null,"EUR","Pubilc educational institution","Public Sector and Education",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2421",null,null,null,null,"FR: pubilc educational institution",null,null,null,null,null,null,null,null,null],["2024/BE/032","APD/GBA (Belgium) - 79/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-05-22","day",null,null,null,null,null,"Art. 77",null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-79-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_79/2024",null,"gdprhub",null,"Technician",null,null,null,null,null,"person",null,null,null,null],["2024/ES/079","ETid-2339","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-22","day",96000,null,"EUR","WATIUM S.L.","Transportation and Energy","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00168-2024.pdf","https://www.enforcementtracker.com/ETid-2339",null,null,null,null,"watium sl",null,null,null,null,null,null,null,null,null],["2024/ES/058","ETid-2392","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-22","day",3000,null,"EUR","CUBILLO GALLEGO S.L.","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00458-2023.pdf","https://www.enforcementtracker.com/ETid-2392",null,null,null,null,"cubillo gallego sl",null,null,null,null,null,null,null,null,null],["2024/LU/002","CNPD (Luxembourg) - Délibération n° 2FR/2024","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2024-05-21","day",null,null,null,null,null,"Art. 5(1)(b)","Data principles",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2024/projet-dcision-anonymise-2fr-2024-version-clean.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_2FR/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/IT/082","Garante per la protezione dei dati personali (Italy) - 10013356","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-05-21","day",3000,"3,000","EUR",null,null,"Art. 12, Art. 13, Art. 5(1)(a), Art. 5(1)(b), Art. 6","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10013356","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10013356",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2024/PL/013","ETid-2428","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-05-20","day",336000,null,"EUR","Company","Health Care","Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5112.35.2021","https://www.enforcementtracker.com/ETid-2428","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.35.2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/025","APD/GBA (Belgium) - 74/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-05-16","day",null,null,null,null,null,"Art. 6, Art. 6(1)(a), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-74-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_74/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/CH/001","EDÖB/PFPDT/IFPDT (Switzerland) - Xplain","gdprhub","Switzerland","CH","EDÖB/PFPDT/IFPDT (Switzerland)","2024-05-16","day",null,null,null,"Xplain",null,null,null,null,"Violation found","https://www.edoeb.admin.ch/edoeb/fr/home/kurzmeldungen/nsb_mm.msg-id-100884.html","https://gdprhub.eu/index.php?title=ED%C3%96B/PFPDT/IFPDT_%28Switzerland%29_-_Xplain",null,"gdprhub",null,null,"CH: xplain",null,null,null,null,null,null,null,null,null],["2024/NL/011","ETid-2448","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2024-05-16","day",30500000,null,"EUR","Clearview AI Inc.","Industry and Commerce","Art. 27(1), Art. 5(1)(a), Art. 6(1), Art. 9(1)","Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/ap-legt-clearview-boete-op-voor-illegale-dataverzameling-voor-gezichtsherkenning","https://www.enforcementtracker.com/ETid-2448","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Clearview","gdprhub",null,null,"clearview ai inc","Clearview AI",null,null,null,null,null,null,null,null],["2024/ES/048","ETid-2416","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-14","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00164-2023.pdf","https://www.enforcementtracker.com/ETid-2416",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/GB/011","ICO (UK) - Birmingham Children's Trust Community Interest Company","gdprhub","United Kingdom","GB","ICO (UK)","2024-05-14","day",null,null,null,"Birmingham Children's Trust Community Interest Company",null,"Art. 32(1)(b), Art. 32(2), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/birmingham-childrens-trust-community-interest-company/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Birmingham_Children%27s_Trust_Community_Interest_Company",null,"gdprhub",null,null,"GB: birmingham children s trust community interest company",null,null,null,null,null,null,null,null,null],["2024/BE/026","APD/GBA (Belgium) - 73/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-05-13","day",null,null,null,null,null,"Art. 6","Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-73-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_73/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/RO/017","ETid-2314","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-05-09","day",2000,null,"EUR","IRIDEX GROUP SALUBRIZARE SRL",null,"Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09_05_2024&lang=ro","https://www.enforcementtracker.com/ETid-2314",null,null,null,null,"iridex group salubrizare srl",null,null,null,null,null,null,null,null,null],["2024/RO/016","ETid-2315","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-05-09","day",1000,null,"EUR","MEDICOVER SRL","Health Care","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09_05_2024&lang=ro","https://www.enforcementtracker.com/ETid-2315",null,null,null,null,"medicover srl",null,null,null,null,null,null,null,null,null],["2024/ES/085","ETid-2325","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-09","day",1600,null,"EUR","Homeowners' association","Individuals and Private Associations","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00365-2023.pdf","https://www.enforcementtracker.com/ETid-2325",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/035","ETid-2359","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-05-09","day",10000,null,"EUR","Azzurro Club Hotels S.r.l.","Accommodation and Hospitality","Art. 12(3), Art. 15, Art. 6(1)(a)","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10025887","https://www.enforcementtracker.com/ETid-2359",null,null,null,null,"azzurro club hotels srl",null,null,null,null,null,null,null,null,null],["2024/IT/034","ETid-2361","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-05-09","day",3000,null,"EUR","Medical association","Health Care","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10026235","https://www.enforcementtracker.com/ETid-2361",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/033","ETid-2362","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-05-09","day",3000,null,"EUR","Polisportiva Mimmo Ferrito s.r.l..","Individuals and Private Associations","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10026220","https://www.enforcementtracker.com/ETid-2362",null,null,null,null,"polisportiva mimmo ferrito srl",null,null,null,null,null,null,null,null,null],["2024/IT/028","ETid-2370","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-05-09","day",75000,null,"EUR","Azienda ospedale università di Padova","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data principles, Data security, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10027595","https://www.enforcementtracker.com/ETid-2370","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10027595","gdprhub",null,null,"IT: azienda ospedale universita di padova",null,null,null,null,null,null,null,null,null],["2024/IT/105","Garante per la protezione dei dati personali (Italy) - 10021468","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-05-09","day",null,null,null,null,null,"Art. 28, Art. 33(2)","Data breach, Processor obligations",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10021468","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10021468",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2024/IT/094","Garante per la protezione dei dati personali (Italy) - 10025870","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-05-09","day",null,null,null,"Azienda Ospedaliera Complesso Ospedaliero San Giovanni – Addolorata",null,"Art. 5(1)(a), Art. 9(1), Art. 9(2)(b)","Data principles, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10025870","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10025870",null,"gdprhub",null,null,"IT: azienda ospedaliera complesso ospedaliero san giovanni addolorata",null,null,null,null,null,null,null,null,null],["2024/IT/129","Garante per la protezione dei dati personali (Italy) - Provvedimento del 9 maggio 2024","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-05-09","day",null,null,null,"InfoCert S.p.A.",null,"Art. 28, Art. 32, Art. 33, Art. 34, Art. 5","Data breach, Data principles, Data security, Processor obligations",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10070397","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_Provvedimento_del_9_maggio_2024",null,"gdprhub",null,null,"infocert spa",null,null,null,null,null,null,null,null,null],["2024/ES/147","AEPD (Spain) - EXP202301160","gdprhub","Spain","ES","AEPD (Spain)","2024-05-08","day",200000,"200,000","EUR","Vodafone Spain",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00425-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202301160",null,"gdprhub",null,null,"ES: vodafone spain","Vodafone",null,null,null,null,null,null,null,null],["2024/RO/015","ETid-2316","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-05-08","day",5000,null,"EUR","CENTRUL MEDICAL UNIREA SRL","Health Care","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08.05.2024&lang=ro","https://www.enforcementtracker.com/ETid-2316",null,null,null,null,"centrul medical unirea srl",null,null,null,null,null,null,null,null,null],["2024/ES/081","ETid-2336","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-08","day",12000,null,"EUR","DENTALCUADROS BCN S.L.P.","Health Care","Art. 32, Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00078-2024.pdf","https://www.enforcementtracker.com/ETid-2336",null,null,null,null,"dentalcuadros bcn slp",null,null,null,null,null,null,null,null,null],["2024/DK/005","Datatilsynet (Denmark) - 2024-442-4149","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-05-07","day",null,null,null,"City of Copenhagen",null,"Art. 32(1), Art. 4(12)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/maj/koebenhavns-kommune-faar-alvorlig-kritik-for-manglende-sikkerhedsforanstaltninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2024-442-4149",null,"gdprhub",null,null,"DK: city of copenhagen",null,null,null,null,null,null,null,null,null],["2024/ES/086","ETid-2324","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-07","day",480,null,"EUR","Homeowners' association","Individuals and Private Associations","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00085-2024.pdf","https://www.enforcementtracker.com/ETid-2324",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/080","ETid-2338","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-07","day",360000,null,"EUR","4FINANCE SPAIN FINANCIAL SERVICES, S.A.U.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00424-2023.pdf","https://www.enforcementtracker.com/ETid-2338","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202304633","gdprhub",null,null,"4finance spain financial services sau",null,null,null,null,null,null,null,null,null],["2024/ES/077","ETid-2343","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-05-07","day",1200,null,"EUR","ARRENDAMIENTOS DEUDORES, S.L.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00034-2024.pdf","https://www.enforcementtracker.com/ETid-2343",null,null,null,null,"arrendamientos deudores sl",null,null,null,null,null,null,null,null,null],["2024/BE/029","APD/GBA (Belgium) - 70/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-05-06","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 58(2)(c)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-70-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_70/2024",null,"gdprhub",null,"Provider of a weekly magazine",null,null,null,null,null,null,null,null,null,null],["2024/BE/022","APD/GBA (Belgium) - 71/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-05-06","day",null,null,null,null,null,"Art. 12(3), Art. 25, Art. 5(1)(a)","Accountability, Data principles, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-71-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_71/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/SI/007","IP (Slovenia) - 0600-3/2024/7","gdprhub","Slovenia","SI","IP (Slovenia)","2024-05-06","day",null,null,null,null,null,"Art. 5(1)(c), Art. 5(1)(d)","Data principles",null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2024/Junij/Junij_2024-Odlocbe_ZIN.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0600-3/2024/7",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/FI/007","Tietosuojavaltuutetun toimisto (Finland) - TSV/2/2018","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-05-06","day",null,null,null,null,null,"Art. 17(3)(e), Art. 58(2)(b)","Data subject rights",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242183","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/2/2018",null,"gdprhub",null,"Telecom operator",null,null,null,null,null,null,null,null,null,null],["2024/NL/001","AP (The Netherlands) - z-2021-14274","gdprhub","Netherlands","NL","AP (The Netherlands)","2024-05-02","day",600000,"600,000","EUR","AS Watson (Health & Beauty Continental Europe) B.V.",null,"Art. 4(11), Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://autoriteitpersoonsgegevens.nl/system/files?file=2024-07/Besluit%20boete%20A.S.%20Watson%20-%20Kruidvat.pdf","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_z-2021-14274",null,"gdprhub",null,null,"as watson bv",null,null,null,null,null,null,null,null,null],["2024/BE/024","APD/GBA (Belgium) - 69/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-05-02","day",null,null,null,null,null,"Art. 32","Data security",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-69-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_69/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/NL/012","ETid-2399","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2024-05-02","day",50000,null,"EUR","A.S. Watson Health & Beauty Continental Europe B.V.","Industry and Commerce","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/boete-van-600000-euro-voor-tracking-cookies-op-kruidvatnl","https://www.enforcementtracker.com/ETid-2399",null,null,null,null,"as watson health and beauty continental europe bv",null,null,null,null,null,null,null,null,null],["2024/BE/021","APD/GBA (Belgium) - 67/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-04-30","day",null,null,null,null,null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-67-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_67/2024",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2024/GB/002","ETid-2317","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2024-04-30","day",8700,null,"EUR","Central Young Men’s Christian Association","Individuals and Private Associations","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/action-weve-taken/enforcement/the-central-young-men-s-christian-association-mpn/","https://www.enforcementtracker.com/ETid-2317",null,null,null,null,"GB: central young mens christian association",null,null,null,null,null,null,null,null,null],["2024/PL/016","ETid-2326","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-04-30","day",210,null,"EUR","Association","Individuals and Private Associations","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.58.2022","https://www.enforcementtracker.com/ETid-2326",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/084","ETid-2328","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-30","day",1200,null,"EUR","DELPASO CAR HIRE, S.L.U.","Industry and Commerce","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00201-2023.pdf","https://www.enforcementtracker.com/ETid-2328",null,null,null,null,"delpaso car hire slu",null,null,null,null,null,null,null,null,null],["2024/GB/004","ICO (UK) - The Central Young Men’s Christian Association","gdprhub","United Kingdom","GB","ICO (UK)","2024-04-30","day",null,"7,500","GBP","The Central Young Men’s Christian Association (Central YMCA)",null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4029420/central-ymca-monetary-penalty-notice.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_The_Central_Young_Men%E2%80%99s_Christian_Association",null,"gdprhub",null,null,"GB: the central young mens christian association",null,7500.0,8774,"day 2024-04-30|0.8548|GBP",null,null,null,null,null],["2024/PL/015","ETid-2333","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-04-29","day",56000,null,"EUR","Res-Gastro M. Gaweł Sp. k.","Accommodation and Hospitality","Art. 24(1), Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3095","https://www.enforcementtracker.com/ETid-2333",null,null,null,null,"PL: res gastro m gawe sp k",null,null,null,null,null,null,null,null,null],["2024/HU/001","NAIH (Hungary) - NAIH 6737 1/2024","gdprhub","Hungary","HU","NAIH (Hungary)","2024-04-29","day",null,"5,000,000","HUF",null,null,"Art. 13(1), Art. 13(2), Art. 5(1)(a)","Data principles, Transparency",null,"Violation found","https://naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH_6737_1/2024",null,"gdprhub",null,"Postal service",null,null,5000000.0,12767,"day 2024-04-29|391.6400|HUF",null,null,null,null,null],["2024/PL/022","UODO (Poland) - DKN.5131.29.2023","gdprhub","Poland","PL","UODO (Poland)","2024-04-29","day",null,"238,345","PLN","Res-Gastro M. Gaweł Sp. k.",null,"Art. 24(1), Art. 32(1), Art. 32(2), Art. 5(1)(f)","Accountability, Data principles, Data security",null,"Violation found","https://www.uodo.gov.pl/decyzje/DKN.5131.29.2023","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.29.2023",null,"gdprhub",null,null,"PL: res gastro m gawe sp k",null,238345.0,55102,"day 2024-04-29|4.3255|PLN",null,null,null,null,null],["2024/ES/064","ETid-2385","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-26","day",10000,null,"EUR","ASSOCIACIO OASIS CULTURAL","Accommodation and Hospitality","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00557-2023.pdf","https://www.enforcementtracker.com/ETid-2385",null,null,null,null,"ES: associacio oasis cultural",null,null,null,null,null,null,null,null,null],["2024/GR/030","HDPA (Greece) - 43/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-04-26","day",50000,"50,000","EUR","Ministry of Climate Crisis and Civil Protection",null,"Art. 12, Art. 31, Art. 32, Art. 37, Art. 58","Data protection officer, Data security, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-12/43_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_43/2024",null,"gdprhub",null,null,"GR: ministry of climate crisis and civil protection",null,null,null,null,null,null,null,null,null],["2024/BE/023","APD/GBA (Belgium) - 63/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-04-25","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 4(7)","Data subject rights, Transparency",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-63-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_63/2024",null,"gdprhub",null,"Doctor's appointment booking platform",null,null,null,null,null,null,null,null,null,null],["2024/FR/010","ETid-2422","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-04-25","day",16000,null,"EUR","Association","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2422",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/032","ETid-2363","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-24","day",5000,null,"EUR","Dly S.r.l.","Employment","Art. 5(1)(a), Art. 88","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10019506","https://www.enforcementtracker.com/ETid-2363",null,null,null,null,"dly srl",null,null,null,null,null,null,null,null,null],["2024/IT/031","ETid-2364","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-24","day",3000,null,"EUR","I.N.P.A.S.","Public Sector and Education","Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10019389","https://www.enforcementtracker.com/ETid-2364",null,null,null,null,"IT: inpas",null,null,null,null,null,null,null,null,null],["2024/IT/030","ETid-2365","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-24","day",10000,null,"EUR","C.I.E.L. S.p.A.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10021452","https://www.enforcementtracker.com/ETid-2365","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10021452","gdprhub",null,null,"IT: cielspa",null,null,null,null,null,null,null,null,null],["2024/IT/029","ETid-2366","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-24","day",30000,null,"EUR","Gestore Dei Servizi Energetici - Gse S.p.A.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10018813","https://www.enforcementtracker.com/ETid-2366","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10018813","gdprhub",null,null,"gestore dei servizi energetici gse spa",null,null,null,null,null,null,null,null,null],["2024/PL/014","ETid-2369","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-04-24","day",2500,null,"EUR","Committee","Individuals and Private Associations","Art. 25(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/3078","https://www.enforcementtracker.com/ETid-2369",null,null,null,null,"PL: committee",null,null,null,null,null,null,null,null,null],["2024/IT/019","ETid-2409","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-24","day",30000,null,"EUR","Rossi Carta S.r.l.","Industry and Commerce","Art. 12(3), Art. 15, Art. 6, Art. 7","Consent, Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10025835","https://www.enforcementtracker.com/ETid-2409","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10025835","gdprhub",null,null,"rossi carta srl",null,null,null,null,null,null,null,null,null],["2024/IT/084","Garante per la protezione dei dati personali (Italy) - 10021491","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-04-24","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6, Art. 88, Art. 9","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10021491","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10021491",null,"gdprhub",null,"Ministry of Justice",null,null,null,null,null,null,null,null,null,null],["2024/RO/018","ETid-2297","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-04-23","day",2000,null,"EUR","ALPHA BANK ROMANIA SA.","Finance, Insurance and Consulting","Art. 29, Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23_04_2024&lang=ro","https://www.enforcementtracker.com/ETid-2297",null,null,null,null,"alpha bank romania sa",null,null,null,null,null,null,null,null,null],["2024/GB/006","ICO (UK) - Outsource Strategies Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2024-04-23","day",null,"240,000","GBP","Outsource Strategies Ltd",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4029274/outsource-strategies-ltd-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Outsource_Strategies_Ltd",null,"gdprhub",null,null,"outsource strategies ltd",null,240000.0,278908,"day 2024-04-23|0.8605|GBP",null,null,null,null,null],["2024/RO/019","ETid-2296","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-04-22","day",2000,null,"EUR","S.C. Tensa Art Design S.A..",null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_22_04_2024&lang=ro","https://www.enforcementtracker.com/ETid-2296",null,null,null,null,"tensa art design sa",null,null,null,null,null,null,null,null,null],["2024/HR/006","ETid-2303","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2024-04-22","day",5004000,null,"EUR",null,null,"Art. 13, Art. 27","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/devet-novih-upravnih-novcanih-kazni-u-ukupnom-iznosu-od-51-000-eura/","https://www.enforcementtracker.com/ETid-2303",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/HR/005","ETid-2304","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2024-04-22","day",15000,null,"EUR","Betting company","Industry and Commerce","Art. 6(1)(a), Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/devet-novih-upravnih-novcanih-kazni-u-ukupnom-iznosu-od-51-000-eura/","https://www.enforcementtracker.com/ETid-2304",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/HR/004","ETid-2305","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2024-04-22","day",20000,null,"EUR","Betting company","Industry and Commerce","Art. 6(1)(a), Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/devet-novih-upravnih-novcanih-kazni-u-ukupnom-iznosu-od-51-000-eura/","https://www.enforcementtracker.com/ETid-2305",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/074","ETid-2352","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-19","day",1000,null,"EUR","CONSULTORÍA PERITACIONES ALMERIENSES, S.L","Finance, Insurance and Consulting","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00563-2023.pdf","https://www.enforcementtracker.com/ETid-2352",null,null,null,null,"consultoria peritaciones almerienses sl",null,null,null,null,null,null,null,null,null],["2024/BE/020","APD/GBA (Belgium) - 57/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-04-18","day",null,null,null,null,null,"Art. 12","Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-57-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_57/2024",null,"gdprhub",null,"Mobility aid rental provider",null,null,null,null,null,null,null,null,null,null],["2024/GB/012","ICO (UK) - Clyde Valley Housing Association","gdprhub","United Kingdom","GB","ICO (UK)","2024-04-18","day",null,null,null,"Clyde Valley Housing Association",null,"Art. 5(1)(f), Art. 58(2)(b)","Data principles",null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/clyde-valley-housing-association/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Clyde_Valley_Housing_Association",null,"gdprhub",null,null,"GB: clyde valley housing association",null,null,null,null,null,null,null,null,null],["2024/GR/021","HDPA (Greece) - 15/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-04-16","day",null,null,null,"Google Inc.",null,"Art. 17","Data subject rights",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-05/15_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_15/2024",null,"gdprhub",null,null,"google llc","Google (Alphabet)",null,null,null,null,null,null,null,null],["2024/CZ/001","ETid-2298","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2024-04-15","day",13900000,null,"EUR","Avast Software s.r.o.","Industry and Commerce",null,null,"Unknown","Fine issued","https://uoou.gov.cz/novinky/vse/uoou-ulozil-pokutu-351-mil-kc-za-poruseni-gdpr","https://www.enforcementtracker.com/ETid-2298",null,null,null,null,"avast software sro",null,null,null,null,null,null,null,null,null],["2024/ES/050","ETid-2406","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-15","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00548-2023.pdf","https://www.enforcementtracker.com/ETid-2406",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/GR/014","HDPA (Greece) - 3/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-04-15","day",null,null,null,"Omilos Iatriki Diagnosi",null,"Art. 24, Art. 24(2), Art. 32, Art. 5","Accountability, Data principles, Data security",null,"Rejected","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-kata-diagnostikoy-kentroy-gia-parabiasi-tis","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_3/2024",null,"gdprhub",null,null,"GR: omilos iatriki diagnosi",null,null,null,null,null,null,null,null,null],["2024/ES/099","ETid-2285","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-12","day",1800,null,"EUR","PRESTAMER, S.L.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00466-2023.pdf","https://www.enforcementtracker.com/ETid-2285",null,null,null,null,"prestamer sl",null,null,null,null,null,null,null,null,null],["2024/ES/094","ETid-2295","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-12","day",1200000,null,"EUR","CAIXABANK, S.A","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00032-2024.pdf","https://www.enforcementtracker.com/ETid-2295","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202300944","gdprhub",null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2024/ES/071","ETid-2368","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-12","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00111-2023.pdf","https://www.enforcementtracker.com/ETid-2368",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/ES/057","ETid-2393","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-12","day",600,null,"EUR","Website operator","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00415-2023.pdf","https://www.enforcementtracker.com/ETid-2393",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/056","ETid-2395","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-12","day",1000,null,"EUR","DELSA ALQUILERES S.L.","Real Estate","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00244-2023.pdf","https://www.enforcementtracker.com/ETid-2395",null,null,null,null,"delsa alquileres sl",null,null,null,null,null,null,null,null,null],["2024/IT/040","ETid-2334","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-11","day",25000,null,"EUR","Innova Camara","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10013321","https://www.enforcementtracker.com/ETid-2334","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10013321","gdprhub",null,null,"IT: innova camara",null,null,null,null,null,null,null,null,null],["2024/IT/039","ETid-2335","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-11","day",6000,null,"EUR","Libero Consorzio comunale di Enna","Public Sector and Education",null,"Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10013391","https://www.enforcementtracker.com/ETid-2335",null,null,null,null,"IT: libero consorzio comunale di enna",null,null,null,null,null,null,null,null,null],["2024/IT/038","ETid-2337","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-11","day",1000,null,"EUR","Store owner","Industry and Commerce","Art. 13, Art. 5","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10015419","https://www.enforcementtracker.com/ETid-2337",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/037","ETid-2340","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-11","day",100000,null,"EUR","Facile.Energy S.r.l.","Transportation and Energy","Art. 24(1), Art. 25, Art. 28, Art. 32, Art. 5(2), Art. 6(1)(a)","Accountability, Data principles, Data security, Processor obligations, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10008076","https://www.enforcementtracker.com/ETid-2340","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10008076","gdprhub",null,null,"facile energy srl",null,null,null,null,null,null,null,null,null],["2024/IT/036","ETid-2341","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-11","day",100000,null,"EUR","Olimpia S.r.l.","Transportation and Energy","Art. 24(1), Art. 25, Art. 28, Art. 32, Art. 5(2), Art. 6(1)(a)","Accountability, Data principles, Data security, Processor obligations, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10015453","https://www.enforcementtracker.com/ETid-2341",null,null,null,null,"olimpia srl",null,null,null,null,null,null,null,null,null],["2024/IT/025","ETid-2382","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-04-11","day",20000,null,"EUR","Istituto Nazionale di Previdenza Sociale","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10019523","https://www.enforcementtracker.com/ETid-2382","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10019523","gdprhub",null,null,"IT: istituto nazionale di previdenza sociale",null,null,null,null,null,null,null,null,null],["2024/CZ/002","UOOU (Czech Republic) - UOOU-01025/20-121","gdprhub","Czech Republic","CZ","UOOU (Czech Republic)","2024-04-10","day",null,"351000000","CZK","Avast Software, s.r.o.",null,"Art. 13, Art. 13(1)(c), Art. 5, Art. 6, Art. 6(1)(f)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://uoou.gov.cz/media/rozhodnuti/rozhodnuti-predsedy/2024/cj-uoou-0102520-121.pdf","https://gdprhub.eu/index.php?title=UOOU_%28Czech_Republic%29_-_UOOU-01025/20-121",null,"gdprhub",null,null,"avast software sro",null,351000000.0,13836329,"day 2024-04-10|25.3680|CZK",null,null,null,null,null],["2024/ES/129","AEPD (Spain) - EXP202213792","gdprhub","Spain","ES","AEPD (Spain)","2024-04-09","day",120000,"120,000","EUR","Burgos Club de Fútbol, S.A.D.",null,"Art. 13, Art. 35, Art. 5(1)(c), Art. 8, Art. 9","Consent, DPIA, Data principles, Special categories, Transparency",null,"Violation found","https://www.aepd.es/documento/ps-00483-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202213792",null,"gdprhub",null,null,"ES: burgos club de futbol sad",null,null,null,null,null,null,null,null,null],["2024/CH/002","EDÖB/PFPDT/IFPDT (Switzerland) - EDÖB-A-26B43401/1","gdprhub","Switzerland","CH","EDÖB/PFPDT/IFPDT (Switzerland)","2024-04-09","day",null,"3,750","CHF","Bürgerforum Schweiz",null,null,null,null,"Violation found","https://www.edoeb.admin.ch/dam/de/sd-web/FP6zwhG5Wcxk/Verf%C3%BCgung%20des%20ED%C3%96B%20vom%20%209.%20April%202024%2C%20B%C3%BCrgerforum%20Schweiz.pdf","https://gdprhub.eu/index.php?title=ED%C3%96B/PFPDT/IFPDT_%28Switzerland%29_-_ED%C3%96B-A-26B43401/1",null,"gdprhub",null,null,"CH: burgerforum schweiz",null,3750.0,3819,"day 2024-04-09|0.9819|CHF",null,null,null,null,null],["2024/ES/098","ETid-2286","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-04-05","day",112000,null,"EUR","VODAFONE ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00364-2023.pdf","https://www.enforcementtracker.com/ETid-2286",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/FR/003","ETid-2560","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-04-04","day",525000,null,"EUR","HUBSIDE.STORE","Industry and Commerce","Art. 14, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049382214","https://www.enforcementtracker.com/ETid-2560","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-004","gdprhub",null,null,"FR: hubside store",null,null,null,null,null,null,null,null,null],["2024/GR/006","ETid-2266","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-04-02","day",175000,null,"EUR","Greek Ministry of Immigration and Asylum","Public Sector and Education","Art. 25, Art. 31, Art. 35","Accountability, DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/el/enimerwtiko/deltia/dioikitiko-prostimo-kai-entoli-gia-symmorfosi-me-ton-gkpd-sto-yma-sto-plaisio","https://www.enforcementtracker.com/ETid-2266",null,null,null,null,"GR: greek ministry of immigration and asylum",null,null,null,null,null,null,null,null,null],["2024/BE/030","APD/GBA (Belgium) - 49/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-03-29","day",null,null,null,null,null,"Art. 17(3)(e)","Data subject rights",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-49-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_49/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/018","APD/GBA (Belgium) - 50/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-03-29","day",null,null,null,null,null,"Art. 17(3)(e)","Data subject rights",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-50-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_50/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/017","APD/GBA (Belgium) - 48/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-03-28","day",null,null,null,null,null,"Art. 12(3), Art. 15(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-48-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_48/2024",null,"gdprhub",null,"Embassy",null,null,null,null,null,null,null,null,null,null],["2024/LV/004","DVI (Latvia) - SIA “JK Media group”","gdprhub","Latvia","LV","DVI (Latvia)","2024-03-28","day",1000,"1,000","EUR","JK Media group SIA",null,"Art. 24(1), Art. 5(2), Art. 58(2), Art. 83(5)(e)","Accountability, Data principles",null,"Violation found","https://www.dvi.gov.lv/lv/media/3123/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_%E2%80%9CJK_Media_group%E2%80%9D",null,"gdprhub",null,null,"jk media group sia",null,null,null,null,null,null,null,null,null],["2024/SI/004","IP (Slovenia) - 0609-20/2024/6","gdprhub","Slovenia","SI","IP (Slovenia)","2024-03-28","day",null,null,null,null,null,"Art. 32, Art. 6(1)(a)","Data security, Unlawful processing",null,"Violation found","https://gdprhub.eu/images/9/9c/SI_0609-20-2024-6.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0609-20/2024/6",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2024/PT/001","CNPD (Portugal) - Deliberação 2024/137","gdprhub","Portugal","PT","CNPD (Portugal)","2024-03-25","day",null,null,null,"Worldcoin Foundation",null,"Art. 13(2)(c), Art. 17(1), Art. 5(1)(a), Art. 58(2)(f), Art. 7(3), Art. 9(1)","Consent, Data principles, Data subject rights, Special categories, Transparency",null,"Violation found","https://www.cnpd.pt/decisoes/deliberacoes/","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2024/137",null,"gdprhub",null,null,"PT: worldcoin foundation",null,null,null,null,null,null,null,null,null],["2024/ES/100","ETid-2278","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-25","day",27000,null,"EUR","20 MINUTOS EDITORA, S.L.","Media, Telecoms and Broadcasting","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00101-2024.pdf","https://www.enforcementtracker.com/ETid-2278",null,null,null,null,"20 minutos editora sl",null,null,null,null,null,null,null,null,null],["2024/ES/082","ETid-2332","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-25","day",2400,null,"EUR","Restaurant owner","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00087-2024.pdf","https://www.enforcementtracker.com/ETid-2332",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IS/001","ETid-2257","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2024-03-24","day",10000,null,"EUR","Stjörnuna ehf","Industry and Commerce","Art. 12, Art. 13, Art. 6","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/voktun-med-vinnuskilum-starfsmanns-a-veitingastadnum-subway","https://www.enforcementtracker.com/ETid-2257",null,null,null,null,"stjornuna ehf",null,null,null,null,null,null,null,null,null],["2024/ES/126","AEPD (Spain) - EXP202315744","gdprhub","Spain","ES","AEPD (Spain)","2024-03-21","day",null,null,null,null,null,"Art. 17","Data subject rights",null,"Rejected","https://www.aepd.es/documento/pd-00238-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202315744",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/166","APDCAT (Catalonia) - PS 46/2024","gdprhub","Spain","ES","APDCAT (Catalonia)","2024-03-21","day",31000,"31,000","EUR","Fundació Universitat Oberta de Catalunya (FUOC)",null,"Art. 5(1)(c), Art. 5(2), Art. 83(5)(a), Art. 9","Data principles, Special categories",null,"Violation found","https://apdcat.gencat.cat/ca/inici","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_PS_46/2024",null,"gdprhub",null,null,"ES: fundacio universitat oberta de catalunya",null,null,null,null,null,null,null,null,null],["2024/IT/045","ETid-2289","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-03-21","day",10000,null,"EUR","Azienda sanitaria locale Roma 3","Health Care",null,"Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10002533","https://www.enforcementtracker.com/ETid-2289","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10009296","gdprhub",null,null,"IT: azienda sanitaria locale roma 3",null,null,null,null,null,null,null,null,null],["2024/ES/092","ETid-2313","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-21","day",500,null,"EUR","JUNTA DE CONSERVACION SECTOR RESIDENCIAL ELORDIGAN SAT","Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00183-2023.pdf","https://www.enforcementtracker.com/ETid-2313",null,null,null,null,"ES: junta de conservacion sector residencial elordigan sat",null,null,null,null,null,null,null,null,null],["2024/ES/088","ETid-2322","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-21","day",1000,null,"EUR","CLÍNICA PARÍS, S.L.","Health Care","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00530-2023.pdf","https://www.enforcementtracker.com/ETid-2322",null,null,null,null,"clinica paris sl",null,null,null,null,null,null,null,null,null],["2024/ES/078","ETid-2342","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-21","day",5000,null,"EUR","HIPERBAZAR YONGFA 2018 SL",null,"Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00450-2023.pdf","https://www.enforcementtracker.com/ETid-2342",null,null,null,null,"hiperbazar yongfa 2018 sl",null,null,null,null,null,null,null,null,null],["2024/IT/078","Garante per la protezione dei dati personali (Italy) - 10002324","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-03-21","day",271000,"271,000","EUR","LAZIOcrea S.p.A.",null,"Art. 33(1), Art. 33(2), Art. 33(5), Art. 42, Art. 5(1)(f)","Data breach, Data principles",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10002324","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10002324",null,"gdprhub",null,null,"laziocrea spa",null,null,null,null,null,null,null,null,null],["2024/IT/071","Garante per la protezione dei dati personali (Italy) - 9998877","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-03-21","day",null,null,null,"Worldcoin Foundation",null,"Art. 4(14), Art. 58(2)(a), Art. 7, Art. 9(1), Art. 9(2)","Consent, Special categories",null,"Other Outcome","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9998877","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9998877",null,"gdprhub",null,null,"IT: worldcoin foundation",null,null,null,null,null,null,null,null,null],["2024/GB/003","ICO (UK) - Enforcement Notice and Warning Letter - Home Office","gdprhub","United Kingdom","GB","ICO (UK)","2024-03-21","day",null,null,null,"Home Office",null,"Art. 35, Art. 5(2)","DPIA, Data principles",null,null,"https://ico.org.uk/media/action-weve-taken/enforcement-notices/4028870/ho-migrant-tagging-20240228-en.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Enforcement_Notice_and_Warning_Letter_-_Home_Office",null,"gdprhub",null,null,"GB: home office",null,null,null,null,null,null,null,null,null],["2024/SI/006","IP (Slovenia) - 0600-10/2024/2","gdprhub","Slovenia","SI","IP (Slovenia)","2024-03-21","day",null,null,null,null,null,"Art. 17, Art. 85(1)","Data subject rights",null,"Rejected","https://gdprhub.eu/images/9/9a/SI.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0600-10/2024/2",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/161","AEPD (Spain) - EXP202310203","gdprhub","Spain","ES","AEPD (Spain)","2024-03-19","day",2000,"2,000","EUR",null,null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00056-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202310203",null,"gdprhub",null,"Residents' association",null,null,null,null,null,null,null,null,null,null],["2024/BE/016","APD/GBA (Belgium) - 47/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-03-19","day",null,null,null,null,null,"Art. 57(4)",null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-47-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_47/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/NO/004","Datatilsynet (Norway) - 23/00708-28","gdprhub","Norway","NO","Datatilsynet (Norway)","2024-03-18","day",null,"20,000,000","NOK","Norwegian Labour and Welfare Administration",null,"Art. 32, Art. 5(1)(f), Art. 5(2), Art. 83","Data principles, Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/d2599e319d4a4cf689de64d3f2b89350/vedtak-om-palegg-og-overtredelsesgebyr-nav.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_23/00708-28",null,"gdprhub",null,null,"NO: norwegian labour and welfare administration",null,20000000.0,1730628,"day 2024-03-18|11.5565|NOK",null,null,null,null,null],["2024/ES/124","AEPD (Spain) - EXP202301323","gdprhub","Spain","ES","AEPD (Spain)","2024-03-15","day",null,null,null,"Turner Broadcasting System España, S.L.",null,"Art. 60(8), Art. 7(3)","Consent",null,"Rejected","https://www.aepd.es/documento/reposicion-ai-00057-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202301323",null,"gdprhub",null,null,"turner broadcasting system espana sl",null,null,null,null,null,null,null,null,null],["2024/BE/019","APD/GBA (Belgium) - 46/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-03-15","day",null,null,null,null,null,"Art. 5(1)(b), Art. 6(1), Art. 6(4)","Data principles, Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-46-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_46/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/101","ETid-2276","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-15","day",800,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00017-2023.pdf","https://www.enforcementtracker.com/ETid-2276",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/ES/093","ETid-2312","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-15","day",500,null,"EUR","CORPORACIÓN DUAL GRUPO LC, S.L.",null,"Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00528-2023.pdf","https://www.enforcementtracker.com/ETid-2312",null,null,null,null,"corporacion dual grupo lc sl",null,null,null,null,null,null,null,null,null],["2024/ES/083","ETid-2329","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-15","day",200000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00384-2023.pdf","https://www.enforcementtracker.com/ETid-2329",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/PL/018","ETid-2260","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-03-12","day",326000,null,"EUR","Santander Bank Polska S.A.","Finance, Insurance and Consulting","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.59.2022","https://www.enforcementtracker.com/ETid-2260","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.59.2022","gdprhub",null,null,"santander bank polska sa","Santander",null,null,null,null,null,null,null,null],["2024/PL/017","ETid-2261","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-03-12","day",18000,null,"EUR","Toyota Bank Polska S.A.","Finance, Insurance and Consulting","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/pl/138/3049","https://www.enforcementtracker.com/ETid-2261","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.28.2023","gdprhub",null,null,"toyota bank polska sa",null,null,null,null,null,null,null,null,null],["2024/IS/003","Persónuvernd (Island) - 2021051091","gdprhub","Iceland","IS","Persónuvernd (Island)","2024-03-12","day",null,"1,500,00","ISK","Stjörnuna ehf, the operator of Subway in Iceland",null,"Art. 12, Art. 13, Art. 30, Art. 5(1)(a), Art. 5(1)(b), Art. 58(2), Art. 6(1), Art. 83","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/voktun-med-vinnuskilum-starfsmanns-a-veitingastadnum-subway%20","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2021051091",null,"gdprhub",null,null,"stjornuna ehf the operator of subway in iceland",null,1500000.0,10087,"day 2024-03-12|148.7000|ISK",null,null,null,null,null],["2024/FI/006","Tietosuojavaltuutetun toimisto (Finland) - TSV/29/2020","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-03-12","day",null,null,null,null,null,"Art. 25(2), Art. 5(1)(c), Art. 58(2)(d), Art. 87","Accountability, Data principles",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242123","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/29/2020",null,"gdprhub",null,"Hospital",null,null,null,null,null,null,null,null,null,null],["2024/IE/007","DPC (Ireland) - Groupon Ireland Operations Limited","gdprhub","Ireland","IE","DPC (Ireland)","2024-03-08","day",null,null,null,"Groupon Ireland",null,"Art. 12(2), Art. 15(1), Art. 15(3), Art. 17(1), Art. 5(1)(c), Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2024-06/Final-Decision-Groupon-International-Limited-March-2024-EN_0.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Groupon_Ireland_Operations_Limited",null,"gdprhub",null,null,"IE: groupon ireland",null,null,null,null,null,null,null,null,null],["2024/IE/009","DPC (Ireland) - Inquiry into Apple Distribution International Limited - March 2024","gdprhub","Ireland","IE","DPC (Ireland)","2024-03-07","day",null,null,null,"Apple",null,"Art. 12(1), Art. 13(1), Art. 17(1), Art. 6(1)(f)","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2024-08/Inquiry-into-Apple-Distribution-International-Limited-Final-Decision-March-2024-EN.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Inquiry_into_Apple_Distribution_International_Limited_-_March_2024",null,"gdprhub",null,null,"IE: apple",null,null,null,null,null,null,null,null,null],["2024/ES/091","ETid-2318","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-07","day",1000,null,"EUR","DENTAL REY-GAR, S.L.","Health Care","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00481-2023.pdf","https://www.enforcementtracker.com/ETid-2318",null,null,null,null,"dental rey gar sl",null,null,null,null,null,null,null,null,null],["2024/IT/043","ETid-2320","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-03-07","day",2000,null,"EUR","Bar","Accommodation and Hospitality","Art. 13, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10007486","https://www.enforcementtracker.com/ETid-2320",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/042","ETid-2330","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-03-07","day",20000,null,"EUR","Banca di Credito Cooperativo Appulo Lucana soc. cooperativa","Employment","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10007853","https://www.enforcementtracker.com/ETid-2330","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10007853","gdprhub",null,null,"IT: banca di credito cooperativo appulo lucana soc cooperativa",null,null,null,null,null,null,null,null,null],["2024/IT/041","ETid-2331","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-03-07","day",20000,null,"EUR","Centro Riparazioni Piacentino S.p.A.","Employment","Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10009004","https://www.enforcementtracker.com/ETid-2331",null,null,null,null,"centro riparazioni piacentino spa",null,null,null,null,null,null,null,null,null],["2024/SI/005","IP (Slovenia) - 0609-6/2024/7","gdprhub","Slovenia","SI","IP (Slovenia)","2024-03-07","day",null,null,null,null,null,"Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://gdprhub.eu/images/8/89/SI_0609-6-2024-7.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0609-6/2024/7",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2024/FI/003","ETid-2243","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2024-03-06","day",856000,null,"EUR","Verkkokauppa.com","Industry and Commerce","Art. 25(2), Art. 5(1)(e)","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","https://tietosuoja.fi/-/verkkokauppa.comille-seuraamusmaksu-asiakastietojen-sailytysajan-maarittelematta-jattamisesta-myos-vaatimus-asiakkaan-rekisteroitymisesta-oli-lainvastainen","https://www.enforcementtracker.com/ETid-2243","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/26/2020","gdprhub",null,null,"FI: verkkokauppa com",null,null,null,null,null,null,null,null,null],["2024/RO/020","ETid-2244","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-03-05","day",5000,null,"EUR","EURO MINI STORAGE ROMANIA SRL","Industry and Commerce","Art. 24, Art. 32(2)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_05_03_2024&lang=ro","https://www.enforcementtracker.com/ETid-2244",null,null,null,null,"euro mini storage romania srl",null,null,null,null,null,null,null,null,null],["2024/EE/002","AKI (Estonia) - 2.1.-1/24/181-367-3","gdprhub","Estonia","EE","AKI (Estonia)","2024-03-01","day",null,null,null,null,null,null,null,null,"Violation found","https://gdprhub.eu/images/e/eb/EE.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-1/24/181-367-3",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/096","ETid-2293","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-03-01","day",200000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00246-2023.pdf","https://www.enforcementtracker.com/ETid-2293",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/GB/005","ICO (UK) - Chief Constable West Midlands Police","gdprhub","United Kingdom","GB","ICO (UK)","2024-03-01","day",null,null,null,"West Midlands Police",null,"Art. 34(3), Art. 38(1), Art. 38(3), Art. 40, Art. 57(1)","Data breach, Data protection officer",null,null,"https://ico.org.uk/media/action-weve-taken/reprimands/4028638/20240226-wmp-final-reprimand.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Chief_Constable_West_Midlands_Police",null,"gdprhub",null,null,"GB: west midlands police",null,null,null,null,null,null,null,null,null],["2024/ES/095","ETid-2294","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-29","day",200000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00203-2023.pdf","https://www.enforcementtracker.com/ETid-2294",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/GR/018","HDPA (Greece) - 11/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-02-29","day",null,null,null,"Google LLC",null,"Art. 17, Art. 17(1)","Data subject rights",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-04/11_2024%20anoym%20final.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_11/2024",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2024/GR/017","HDPA (Greece) - 12/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-02-29","day",null,null,null,"Google LLC.",null,"Art. 17, Art. 17(1)","Data subject rights",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-04/12_2024%20anonym%20final.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_12/2024",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2024/CY/005","Commissioner (Cyprus) - 11.17.001.008.228","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2024-02-28","day",null,null,null,"Cyprus News Agency",null,"Art. 44, Art. 5(2)","Data principles, International transfers",null,"Violation found","https://gdprhub.eu/images/7/74/CY_6_greek_noyb.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.008.228",null,"gdprhub",null,null,"CY: cyprus news agency",null,null,null,null,null,null,null,null,null],["2024/CY/004","Commissioner (Cyprus) - 11.17.001.008.229","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2024-02-28","day",null,null,null,"ARKTINOS” Publications Ltd",null,"Art. 44, Art. 5(2)","Data principles, International transfers",null,"Violation found","https://gdprhub.eu/images/4/45/111700_2.PDF","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.008.229",null,"gdprhub",null,null,"arktinos publications ltd",null,null,null,null,null,null,null,null,null],["2024/GR/005","ETid-2284","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-02-28","day",2995140,null,"EUR","Hellenic Post (ΕΛΛΗΝΙΚΑ ΤΑΧΥΔΡΟΜΕΙΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ)","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-etairia-gia-mi-orthi-tirisi-tehnikon-kai-organotikon","https://www.enforcementtracker.com/ETid-2284",null,null,null,null,"GR: hellenic post",null,null,null,null,null,null,null,null,null],["2024/GR/013","HDPA (Greece) - 9/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-02-28","day",168709,"168,709","EUR","Elpedison",null,"Art. 32, Art. 5(1)(a)","Data principles, Data security",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-04/9_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_9/2024",null,"gdprhub",null,null,"GR: elpedison",null,null,null,null,null,null,null,null,null],["2024/RO/021","ETid-2210","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-02-26","day",3000,null,"EUR","VESTA CEU ROMÂNIA SRL.","Transportation and Energy","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_26.02.2024&lang=ro","https://www.enforcementtracker.com/ETid-2210",null,null,null,null,"vesta ceu romania srl",null,null,null,null,null,null,null,null,null],["2024/HR/007","ETid-3103","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2024-02-26","day",20000,null,"EUR","Company",null,"Art. 6(1), Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/wp-content/uploads/2025/07/obrada-osobnih-podataka-putem-kolacica-novcanakazna1.pdf","https://www.enforcementtracker.com/ETid-3103","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Cookie_Consent_Violation","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/LT/004","ADA (Lithuania) - 2024-02-23","gdprhub","Lithuania","LT","ADA (Lithuania)","2024-02-23","day",null,null,null,null,null,"Art. 21(1), Art. 6(1)(b), Art. 6(1)(f)","Data subject rights, Unlawful processing",null,"Violation found","https://vdai.lrv.lt/media/viesa/saugykla/2024/6/8_zcLbuxFqE.pdf","https://gdprhub.eu/index.php?title=ADA_%28Lithuania%29_-_2024-02-23",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/123","AEPD (Spain) - RR/00075/2024","gdprhub","Spain","ES","AEPD (Spain)","2024-02-23","day",null,null,null,"Euskaltel",null,"Art. 15, Art. 18","Data subject rights",null,"Violation found","https://www.aepd.es/documento/reposicion-pd-00197-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_RR/00075/2024",null,"gdprhub",null,null,"ES: euskaltel",null,null,null,null,null,null,null,null,null],["2024/BE/013","APD/GBA (Belgium) - 40/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-23","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 17(1)","Data subject rights, Transparency",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-40-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_40/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/087","ETid-2323","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-23","day",90000,null,"EUR","TELEFÓNICA DE ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00339-2023.pdf","https://www.enforcementtracker.com/ETid-2323","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00524/2023","gdprhub",null,null,"telefonica de espana sau","Telefonica",null,null,null,null,null,null,null,null],["2024/BE/009","APD/GBA (Belgium) - 39/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-22","day",null,null,null,null,null,"Art. 80(1)",null,null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-39-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_39/2024",null,"gdprhub",null,"E-reputation consultancy company",null,null,null,null,null,null,null,null,null,null],["2024/IT/049","ETid-2259","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-22","day",50000,null,"EUR","Azienda Trasporto Passeggeri Emilia-Romagna S.p.A.","Transportation and Energy","Art. 12(1), Art. 13, Art. 21(4), Art. 5(2), Art. 6(1)(a), Art. 7","Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9995808","https://www.enforcementtracker.com/ETid-2259","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9995808","gdprhub",null,null,"azienda trasporto passeggeri emilia romagna spa",null,null,null,null,null,null,null,null,null],["2024/IT/046","ETid-2273","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-22","day",2000,null,"EUR","Camera di Commercio Industria Artigianato e Agricoltura","Public Sector and Education","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/10000804","https://www.enforcementtracker.com/ETid-2273",null,null,null,null,"IT: camera di commercio industria artigianato e agricoltura",null,null,null,null,null,null,null,null,null],["2024/IT/076","Garante per la protezione dei dati personali (Italy) - 0007060","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-02-22","day",90000,"90,000","EUR","Coop Italia Società Cooperativa",null,"Art. 12(3), Art. 15, Art. 21(2), Art. 5(1)(e)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10007060","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_0007060",null,"gdprhub",null,null,"IT: coop italia societa cooperativa",null,null,null,null,null,null,null,null,null],["2024/IT/086","Garante per la protezione dei dati personali (Italy) - 10001279","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-02-22","day",75000,"75,000","EUR","Azienda sanitaria dell'Alto Adige - Südtiroler Sanitätsbetrieb",null,"Art. 25, Art. 32, Art. 34, Art. 5(1)(a), Art. 5(1)(f), Art. 9","Accountability, Data breach, Data principles, Data security, Special categories",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10001279","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10001279",null,"gdprhub",null,null,"IT: azienda sanitaria dell alto adige sudtiroler sanitatsbetrieb",null,null,null,null,null,null,null,null,null],["2024/IT/079","Garante per la protezione dei dati personali (Italy) - 10007895","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-02-22","day",150000,"150,000","EUR","Sigma s.r.l.",null,"Art. 13, Art. 24(1), Art. 25(1), Art. 5(1)(a), Art. 5(2), Art. 6","Accountability, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10007895","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10007895",null,"gdprhub",null,null,"sigma srl",null,null,null,null,null,null,null,null,null],["2024/BE/011","APD/GBA (Belgium) - 37/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-21","day",null,null,null,null,null,"Art. 6(1)(a)","Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-37-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_37/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/014","APD/GBA (Belgium) - 38/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-21","day",null,null,null,null,null,"Art. 7(3)","Consent",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-38-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_38/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/010","APD/GBA (Belgium) - 35/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-20","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 17(1)(d), Art. 4(1), Art. 4(11), Art. 4(2), Art. 5(1)(a), Art. 6(1)(a), Art. 6(1)(b), Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-35-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_35/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/GR/024","HDPA (Greece) - 31/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-02-20","day",null,null,null,null,null,"Art. 5(1)(a), Art. 5(1)(c)","Data principles",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-10/31_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_31/2024",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2024/ES/097","ETid-2290","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-19","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00423-2023.pdf","https://www.enforcementtracker.com/ETid-2290",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/ES/090","ETid-2319","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-19","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00438-2023.pdf","https://www.enforcementtracker.com/ETid-2319",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/FI/004","Tietosuojavaltuutetun toimisto (Finland) - TSV/224/2023","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2024-02-19","day",null,null,null,null,null,"Art. 12(2), Art. 12(6), Art. 25(2), Art. 5(1)(c), Art. 5(1)(e), Art. 58(2)(c), Art. 58(2)(d)","Accountability, Data principles, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2024/20242103","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/224/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/GR/012","HDPA (Greece) - 7/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-02-16","day",null,null,null,null,null,"Art. 12, Art. 58(2)(c)","Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-03/7_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_7/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/GB/007","ICO (UK) - Dr Telemarketing","gdprhub","United Kingdom","GB","ICO (UK)","2024-02-15","day",null,"100,000","GBP","Dr Telemarketing Ltd",null,null,null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/dr-telemarketing-enforcement-notice/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Dr_Telemarketing",null,"gdprhub",null,null,"dr telemarketing ltd",null,100000.0,116775,"day 2024-02-15|0.8563|GBP",null,null,null,null,null],["2024/EE/004","AKI (Estonia) - 14.02.2024","gdprhub","Estonia","EE","AKI (Estonia)","2024-02-14","day",null,null,null,"Bolt",null,"Art. 12(3), Art. 12(4), Art. 16, Art. 24(1), Art. 32(1), Art. 5(1)(d), Art. 5(1)(f)","Accountability, Data principles, Data security, Data subject rights, Transparency",null,"Violation found","https://noyb.eu/en","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_14.02.2024",null,"gdprhub",null,null,"EE: bolt",null,null,null,null,null,null,null,null,null],["2024/BE/015","APD/GBA (Belgium) - 32/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-13","day",null,null,null,null,null,"Art. 15(1), Art. 15(3)","Data subject rights",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-32-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_32/2024",null,"gdprhub",null,"Lender",null,null,null,null,null,null,null,null,null,null],["2024/ES/109","ETid-2262","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-13","day",40000,null,"EUR","IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA.","Transportation and Energy","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00138-2023.pdf","https://www.enforcementtracker.com/ETid-2262",null,null,null,null,"iberia lineas aereas de espana sa operadora",null,null,null,null,null,null,null,null,null],["2024/ES/104","ETid-2271","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-13","day",4000,null,"EUR","ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L.","Finance, Insurance and Consulting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00556-2023.pdf","https://www.enforcementtracker.com/ETid-2271",null,null,null,null,"asnef equifax servicios de informacion sobre solvencia y credito sl",null,null,null,null,null,null,null,null,null],["2024/ES/103","ETid-2272","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-13","day",100000,null,"EUR","VODAFONE ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00260-2023.pdf","https://www.enforcementtracker.com/ETid-2272",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/ES/106","ETid-2267","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-12","day",365000,null,"EUR","CTC EXTERNALIZACIÓN, S.L","Employment","Art. 13, Art. 32, Art. 35","DPIA, Data security, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00170-2023.pdf","https://www.enforcementtracker.com/ETid-2267","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202960","gdprhub",null,null,"ctc externalizacion sl",null,null,null,null,null,null,null,null,null],["2024/BE/008","APD/GBA (Belgium) - 29/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-09","day",2000,"2,000","EUR",null,null,"Art. 12(3), Art. 12(4), Art. 17(1), Art. 31","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-29-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_29/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/LV/003","DVI (Latvia) - SIA \"QUANTRUM\"","gdprhub","Latvia","LV","DVI (Latvia)","2024-02-08","day",null,null,null,"SIA Quantrum",null,"Art. 25(1), Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)","Accountability, Data principles, Unlawful processing",null,"Violation found","https://www.dvi.gov.lv/lv/media/2988/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_%22QUANTRUM%22",null,"gdprhub",null,null,"sia quantrum",null,null,null,null,null,null,null,null,null],["2024/IT/053","ETid-2227","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-08","day",2800000,null,"EUR","UniCredit S.p.a.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9991020","https://www.enforcementtracker.com/ETid-2227","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9991020","gdprhub",null,null,"unicredit spa","UniCredit",null,null,null,null,"confirmed","Confirmed in court: the Milan Tribunal rejected UniCredit's challenge (judgment 4499/2026 of 28 July 2026).","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9991101",2800000],["2024/IT/051","ETid-2242","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-08","day",null,null,"EUR","NTT Data Italia S.P.A","Industry and Commerce","Art. 28(2), Art. 33(2)","Data breach, Processor obligations","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9991064","https://www.enforcementtracker.com/ETid-2242","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9991064","gdprhub",null,null,"ntt data italia spa",null,null,null,null,null,"annulled","The Garante removed this decision from its website after a final court judgment against it.","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9991064",800000],["2024/IT/050","ETid-2245","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-08","day",300000,null,"EUR","Medtronic Italia","Health Care","Art. 12, Art. 13, Art. 32, Art. 9","Data principles, Data security, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9991101","https://www.enforcementtracker.com/ETid-2245","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9991183","gdprhub",null,null,"IT: medtronic italia",null,null,null,null,null,null,null,null,null],["2024/ES/108","ETid-2263","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-08","day",200000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00314-2023.pdf","https://www.enforcementtracker.com/ETid-2263",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2024/ES/107","ETid-2265","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-08","day",30000,null,"EUR","CENTRO MÉDICO SALUS BALEARES, S.L.","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00317-2022.pdf","https://www.enforcementtracker.com/ETid-2265",null,null,null,null,"centro medico salus baleares sl",null,null,null,null,null,null,null,null,null],["2024/IT/047","ETid-2268","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-08","day",18000,null,"EUR","Azienda socio-sanitaria locale n. 1 di Sassari","Health Care","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9994882","https://www.enforcementtracker.com/ETid-2268","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9994882","gdprhub",null,null,"IT: azienda socio sanitaria locale n1 di sassari",null,null,null,null,null,null,null,null,null],["2024/IT/044","ETid-2306","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-08","day",79100000,null,"EUR","Enel Energia SpA","Transportation and Energy","Art. 24(1), Art. 25, Art. 28, Art. 32, Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9988921","https://www.enforcementtracker.com/ETid-2306",null,null,null,null,"enel energia spa","Enel",null,null,null,null,null,null,null,null],["2024/CY/003","ETid-2373","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2024-02-08","day",1500,null,"EUR","Aylo Social LTD","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/302559D9BA5154FFC2258B3F003066F6/$file/20240208%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20AYLO.pdf?openelement","https://www.enforcementtracker.com/ETid-2373",null,null,null,null,"aylo social ltd",null,null,null,null,null,null,null,null,null],["2024/CY/002","ETid-2374","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2024-02-08","day",2000,null,"EUR","Brivio Limited",null,"Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/302559D9BA5154FFC2258B3F003066F6/$file/20240228%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20BRIVIO.pdf?openelement","https://www.enforcementtracker.com/ETid-2374","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.010.239","gdprhub",null,null,"brivio ltd",null,null,null,null,null,null,null,null,null],["2024/IT/072","Garante per la protezione dei dati personali (Italy) - 9988710","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-02-08","day",79107101,"79,107,101","EUR","Enel Energia S.p.A.",null,"Art. 24(1), Art. 25, Art. 28, Art. 32, Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security, Processor obligations",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9988710","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9988710",null,"gdprhub",null,null,"enel energia spa","Enel",null,null,null,null,null,null,null,null],["2024/IT/106","Garante per la protezione dei dati personali (Italy) - 9994597","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-02-08","day",6000,"6,000","EUR","Territorial Agency of the Puglia Region for the waste management service (AGER)",null,"Art. 13(1)(b), Art. 37(1)(a), Art. 37(7), Art. 58(2), Art. 83","Data protection officer, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9994597","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9994597",null,"gdprhub",null,null,"IT: territorial agency of the puglia region for the waste management service",null,null,null,null,null,null,null,null,null],["2024/BE/007","APD/GBA (Belgium) - 26/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-07","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 17(1)","Data subject rights, Transparency",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-26-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_26/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/012","APD/GBA (Belgium) - 28/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-07","day",null,null,null,null,null,"Art. 32","Data security",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-28-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_28/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/RO/022","ETid-2209","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-02-07","day",2000,null,"EUR","Account Exchange SRL","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07_02_2024&lang=ro","https://www.enforcementtracker.com/ETid-2209",null,null,null,null,"account exchange srl",null,null,null,null,null,null,null,null,null],["2024/IT/048","ETid-2264","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-02-07","day",5000,null,"EUR","Wi-Planet sas di Torri Carlo Alberto e c.","Media, Telecoms and Broadcasting","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9996588","https://www.enforcementtracker.com/ETid-2264","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9996588","gdprhub",null,null,"wi planet sas di torri carlo alberto ec",null,null,null,null,null,null,null,null,null],["2024/ES/005","ETid-2557","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-07","day",3000000,null,"EUR","IBERDROLA, S.A.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00221-2023.pdf","https://www.enforcementtracker.com/ETid-2557",null,null,null,null,"iberdrola sa","Iberdrola",null,null,null,null,null,null,null,null],["2024/GR/019","HDPA (Greece) - 14/2014","gdprhub","Greece","GR","HDPA (Greece)","2024-02-07","day",null,null,null,null,null,null,null,null,"Violation found","https://www.dpa.gr/sites/default/files/2024-04/14_2024%2520anonym_0.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_14/2014",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/102","ETid-2274","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-06","day",160000,null,"EUR","SANITAS, S.A. DE SEGUROS","Finance, Insurance and Consulting","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00479-2023.pdf","https://www.enforcementtracker.com/ETid-2274",null,null,null,null,"sanitas sa de seguros",null,null,null,null,null,null,null,null,null],["2024/ES/010","ETid-2543","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-06","day",5000000,null,"EUR","ENERGYA VM GESTIÓN DE ENERGÍA, S.L.","Transportation and Energy","Art. 5(1)(a), Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00216-2023.pdf","https://www.enforcementtracker.com/ETid-2543","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202304117","gdprhub",null,null,"energya vm gestion de energia sl",null,null,null,null,null,null,null,null,null],["2024/BE/006","APD/GBA (Belgium) - 25/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-02-05","day",null,null,null,"Federale Overheidsdienst Financiën",null,"Art. 13, Art. 5(1)(d)","Data principles, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-25-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_25/2024",null,"gdprhub",null,null,"BE: federale overheidsdienst financien",null,null,null,null,null,null,null,null,null],["2024/RO/023","ETid-2208","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-02-05","day",500,null,"EUR","Owners' association","Individuals and Private Associations","Art. 5(2), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_05_02_2024&lang=ro","https://www.enforcementtracker.com/ETid-2208",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/004","ETid-2558","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-05","day",3500000,null,"EUR","I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00145-2023.pdf","https://www.enforcementtracker.com/ETid-2558","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202205206","gdprhub",null,null,"i de redes electricas inteligentes sau",null,null,null,null,null,null,null,null,null],["2024/LV/002","DVI (Latvia) - 02/02/2024","gdprhub","Latvia","LV","DVI (Latvia)","2024-02-02","day",1000,"1,000","EUR","AQAPHOTO",null,"Art. 12, Art. 12(1), Art. 5(1)(a), Art. 6, Art. 7","Consent, Data principles, Transparency, Unlawful processing",null,"Violation found","https://gdprhub.eu/images/6/6d/LV.pdf","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_02/02/2024",null,"gdprhub",null,null,"LV: aqaphoto",null,null,null,null,null,null,null,null,null],["2024/ES/111","ETid-2246","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-02-01","day",36000,null,"EUR","HISPAPOST, S.A.","Transportation and Energy","Art. 28(3)","Data breach, Processor obligations","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.aepd.es/documento/ps-00443-2023.pdf","https://www.enforcementtracker.com/ETid-2246",null,null,null,null,"hispapost sa",null,null,null,null,null,null,null,null,null],["2024/FR/023","CNIL (France) - SAN-2024-002","gdprhub","France","FR","CNIL (France)","2024-01-31","day",100000,"100000","EUR","De Particulier à Particulier - Editions Neressis",null,"Art. 13, Art. 28, Art. 32, Art. 5(1)(e)","Data principles, Data security, Processor obligations, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049128617?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-002",null,"gdprhub",null,null,"FR: de particulier a particulier editions neressis",null,null,null,null,null,null,null,null,null],["2024/FR/024","CNIL (France) - SAN-2024-003","gdprhub","France","FR","CNIL (France)","2024-01-31","day",310000,"310,000","EUR",null,null,"Art. 32, Art. 4(11), Art. 6(1), Art. 6(1)(a), Art. 6(1)(f)","Data security, Unlawful processing",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049231950?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2024-003",null,"gdprhub",null,"Telemarketing company",null,null,null,null,null,null,null,null,null,null],["2024/IE/006","DPC (Ireland) - Inquiry into Airbnb Ireland UC - January 2024","gdprhub","Ireland","IE","DPC (Ireland)","2024-01-31","day",null,null,null,"Airbnb Ireland UC",null,"Art. 5(1)(c), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/en/dpc-guidance/decisions/inquiry-airbnb-ireland-uc-january-2024","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Inquiry_into_Airbnb_Ireland_UC_-_January_2024",null,"gdprhub",null,null,"airbnb ireland uc","Airbnb",null,null,null,null,null,null,null,null],["2024/IT/057","ETid-2221","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-01-31","day",5000,null,"EUR","Municipality of Siracusa","Public Sector and Education","Art. 37(7)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9979112","https://www.enforcementtracker.com/ETid-2221","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9979112","gdprhub",null,null,"IT: municipality of siracusa",null,null,null,null,null,null,null,null,null],["2024/IT/056","ETid-2222","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-01-31","day",2000,null,"EUR","Libero Consorzio comunale di Caltanissetta","Public Sector and Education","Art. 37(7)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9979128","https://www.enforcementtracker.com/ETid-2222",null,null,null,null,"IT: libero consorzio comunale di caltanissetta",null,null,null,null,null,null,null,null,null],["2024/IT/055","ETid-2223","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-01-31","day",2000,null,"EUR","Provincia di Catanzaro","Public Sector and Education","Art. 37(7)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9979152","https://www.enforcementtracker.com/ETid-2223",null,null,null,null,"IT: provincia di catanzaro",null,null,null,null,null,null,null,null,null],["2024/IT/054","ETid-2224","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-01-31","day",2000,null,"EUR","Provincia di Sassari","Public Sector and Education","Art. 37(7)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9979171","https://www.enforcementtracker.com/ETid-2224",null,null,null,null,"IT: provincia di sassari",null,null,null,null,null,null,null,null,null],["2024/FR/009","ETid-2423","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-31","day",5000,null,"EUR","Dentist","Health Care",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2423",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/006","ETid-2429","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-31","day",10000,null,"EUR",null,null,null,null,"Unknown","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2429",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/005","ETid-2430","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-31","day",20000,null,"EUR","Website editor",null,null,null,"Unknown","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2430",null,null,null,null,"FR: website editor",null,null,null,null,null,null,null,null,null],["2024/DK/004","Datatilsynet (Denmark) - 2023-431-0001","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2024-01-30","day",null,null,null,"53 Danish municipalities",null,"Art. 5(1)(a), Art. 5(2), Art. 58(2)(d), Art. 6(1), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2024/jan/datatilsynet-giver-paabud-i-chromebook-sag","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-431-0001",null,"gdprhub",null,null,"DK: 53 danish municipalities",null,null,null,null,null,null,null,null,null],["2024/RO/024","ETid-2195","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-01-30","day",2000,null,"EUR","Sectorul 1 al Municipiului București","Public Sector and Education",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_31_01_2024&lang=ro","https://www.enforcementtracker.com/ETid-2195",null,null,null,null,"RO: sectorul 1 al municipiului bucuresti",null,null,null,null,null,null,null,null,null],["2024/ES/117","AEPD (Spain) - EXP202204501","gdprhub","Spain","ES","AEPD (Spain)","2024-01-29","day",null,null,null,"Ayuntamiento de Llucmajor",null,"Art. 32, Art. 37, Art. 5(1)(f)","Data principles, Data protection officer, Data security",null,"Violation found","https://www.aepd.es/documento/ps-00293-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202204501",null,"gdprhub",null,null,"ES: ayuntamiento de llucmajor",null,null,null,null,null,null,null,null,null],["2024/LV/001","DVI (Latvia) - SIA GZ AUTO","gdprhub","Latvia","LV","DVI (Latvia)","2024-01-29","day",null,null,null,"SIA GZ AUTO",null,"Art. 5(1)(a), Art. 6(1), Art. 7","Consent, Data principles, Unlawful processing",null,"Violation found","https://gdprhub.eu/images/a/ad/Lemums_dvi_sia_par-korektiva-lidzekla-piemerosanu2.pdf","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_GZ_AUTO",null,"gdprhub",null,null,"sia gz auto",null,null,null,null,null,null,null,null,null],["2024/GR/008","ETid-2202","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-01-29","day",25000,null,"EUR","Ministry of Rural Development and Food","Public Sector and Education","Art. 31, Art. 37","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/mi-orismos-ypd-kai-mi-synergasia-toy-ypoyrgeioy-agrotikis-anaptyxis-kai","https://www.enforcementtracker.com/ETid-2202","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_2/2024","gdprhub",null,null,"GR: ministry of rural development and food",null,null,null,null,null,null,null,null,null],["2024/GR/007","ETid-2203","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2024-01-29","day",5000,null,"EUR","Municipality of Athens","Public Sector and Education","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/mi-synergasia-toy-dimoy-athinaion-me-tin-arhi","https://www.enforcementtracker.com/ETid-2203","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_1/2024","gdprhub",null,null,"GR: municipality of athens",null,null,null,null,null,null,null,null,null],["2024/ES/116","AEPD (Spain) - EXP202202954","gdprhub","Spain","ES","AEPD (Spain)","2024-01-26","day",null,null,null,"Consejería de Economía, Conocimiento y Empleo",null,"Art. 5(1)(c), Art. 6(1)(c), Art. 9(1)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00070-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202954",null,"gdprhub",null,null,"ES: consejeria de economia conocimiento y empleo",null,null,null,null,null,null,null,null,null],["2024/GR/016","HDPA (Greece) - 48/2023","gdprhub","Greece","GR","HDPA (Greece)","2024-01-26","day",1000,"1000","EUR",null,null,"Art. 12(3), Art. 12(4), Art. 15, Art. 5(1)(a), Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-02/48_2023%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_48/2023",null,"gdprhub",null,"Accountant",null,null,null,null,null,"person",null,null,null,null],["2024/IT/059","ETid-2211","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-01-24","day",6000,null,"EUR","Municipality","Public Sector and Education","Art. 37(7), Art. 5(1)(a), Art. 9","Data principles, Data protection officer, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9986304","https://www.enforcementtracker.com/ETid-2211",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IT/058","ETid-2212","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-01-24","day",8000,null,"EUR","Municipality of Salento","Public Sector and Education","Art. 58(2)(c)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9986278","https://www.enforcementtracker.com/ETid-2212",null,null,null,null,"IT: municipality of salento",null,null,null,null,null,null,null,null,null],["2024/ES/112","ETid-2226","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-01-24","day",1200,null,"EUR","VUKMAL TRADE, S.L.","Employment","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00446-2023.pdf","https://www.enforcementtracker.com/ETid-2226",null,null,null,null,"vukmal trade sl",null,null,null,null,null,null,null,null,null],["2024/IT/052","ETid-2228","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2024-01-24","day",2000,null,"EUR","Istituto Comprensivo Statale “F.S. Cabrini","Public Sector and Education","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9987578","https://www.enforcementtracker.com/ETid-2228","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9987578","gdprhub",null,null,"IT: istituto comprensivo statale fs cabrini",null,null,null,null,null,null,null,null,null],["2024/FR/013","ETid-2415","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-24","day",20000,null,"EUR","Pharmaceutical wholesaler","Industry and Commerce",null,null,"Unknown","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2415",null,null,null,null,"FR: pharmaceutical wholesaler",null,null,null,null,null,null,null,null,null],["2024/IT/073","Garante per la protezione dei dati personali (Italy) - 9988614","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-24","day",null,null,null,"Azienda Socio Sanitaria Territoriale degli Spedali Civili di Brescia",null,"Art. 13, Art. 14, Art. 14(5)(b), Art. 9, Art. 9(2)(a)","Special categories, Transparency",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9988614","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9988614",null,"gdprhub",null,null,"IT: azienda socio sanitaria territoriale degli spedali civili di brescia",null,null,null,null,null,null,null,null,null],["2024/IT/095","Garante per la protezione dei dati personali (Italy) - 9990640","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-24","day",8000,"8000","EUR","Dedalus Italia S.p.A.",null,"Art. 28, Art. 32(1)(b), Art. 32(1)(d), Art. 5(1)(f), Art. 58(2)(i), Art. 83(4), Art. 83(5)(a), Art. 9","Data principles, Data security, Processor obligations, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9990640","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9990640",null,"gdprhub",null,null,"dedalus italia spa",null,null,null,null,null,null,null,null,null],["2024/IT/065","Garante per la protezione dei dati personali (Italy) - 9993105","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-24","day",15000,"15,000","EUR","MP1 s.r.l.",null,"Art. 12, Art. 17, Art. 17(3)(e), Art. 5(1)(c)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9993105","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9993105",null,"gdprhub",null,null,"mp1 srl",null,null,null,null,null,null,null,null,null],["2024/IT/070","Garante per la protezione dei dati personali (Italy) - 9993531","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-24","day",2000,"2,000","EUR","Emme ci.service s.r.l.",null,"Art. 12, Art. 15, Art. 17, Art. 5(1)(a), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9993531","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9993531",null,"gdprhub",null,null,"emme ci service srl",null,null,null,null,null,null,null,null,null],["2024/SI/003","IP (Slovenia) - 07106-8-2023","gdprhub","Slovenia","SI","IP (Slovenia)","2024-01-24","day",null,null,null,null,null,null,null,null,"Violation found","https://gdprhub.eu/images/0/0a/07106-8-2023-9_odlo%25C4%258Dba_po_42_%25C4%258Dlenu_ZPacP_vrnjeno_v_novo_odlo%25C4%258Danje_24012024.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07106-8-2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/165","APDCAT (Catalonia) - PS 57/2023","gdprhub","Spain","ES","APDCAT (Catalonia)","2024-01-23","day",3000,"3000","EUR","Eulen, Servicios sociosanitarios SA",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://apdcat.gencat.cat/web/.content/Resolucio/Resolucions_Cercador/Resolucions/Documents/ca_ps_2023_057.pdf","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_PS_57/2023",null,"gdprhub",null,null,"eulen servicios sociosanitarios sa",null,null,null,null,null,null,null,null,null],["2024/FR/022","ETid-2192","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-23","day",15000000,null,"EUR","AMAZON FRANCE LOGISTIQUE","Industry and Commerce","Art. 12, Art. 13, Art. 32, Art. 5(1)(c), Art. 6","Data principles, Data security, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/surveillance-des-salaries-la-cnil-sanctionne-amazon-france-logistique-dune-amende-de-32-millions","https://www.enforcementtracker.com/ETid-2192",null,null,null,null,"FR: amazon france logistique","Amazon",null,null,null,null,null,null,null,null],["2024/ES/110","ETid-2250","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-01-23","day",200000,null,"EUR","ORANGE ESPAGNE S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00307-2023.pdf","https://www.enforcementtracker.com/ETid-2250","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202210101","gdprhub",null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2024/ES/105","ETid-2269","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-01-23","day",7500,null,"EUR","ROUNDED TECHNOLOGIES, S.L.","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00378-2023.pdf","https://www.enforcementtracker.com/ETid-2269",null,null,null,null,"rounded technologies sl",null,null,null,null,null,null,null,null,null],["2024/BE/003","APD/GBA (Belgium) - 11/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-01-22","day",null,null,null,null,null,"Art. 12(2), Art. 12(3), Art. 15, Art. 24, Art. 5(2)","Accountability, Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-11-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_11/2024",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/FR/014","ETid-2414","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-22","day",500,null,"EUR","Attorney","Finance, Insurance and Consulting",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2414",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/IS/002","Persónuvernd (Island) - 2022040716","gdprhub","Iceland","IS","Persónuvernd (Island)","2024-01-22","day",null,null,null,"University of Iceland",null,"Art. 5(1)(a)","Data principles",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-haskola-islands","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2022040716",null,"gdprhub",null,null,"IS: university of iceland",null,null,null,null,null,null,null,null,null],["2024/ES/130","AEPD (Spain) - EXP202213323","gdprhub","Spain","ES","AEPD (Spain)","2024-01-19","day",72000,"72,000","EUR","Shanghai Moonton Technology Co. Ltd.",null,"Art. 27, Art. 32, Art. 33, Art. 5(1)(c), Art. 5(1)(f)","Data breach, Data principles, Data security",null,"Violation found","https://www.aepd.es/documento/ps-00511-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202213323",null,"gdprhub",null,null,"shanghai moonton technology co ltd",null,null,null,null,null,null,null,null,null],["2024/PL/019","ETid-2213","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-01-18","day",2300,null,"EUR",null,null,"Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.53.2021","https://www.enforcementtracker.com/ETid-2213",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/PL/003","ETid-2518","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2024-01-17","day",273000,null,"EUR","Centrum Medyczne Ujastek Sp. z o.o.","Health Care","Art. 25(1), Art. 5(2), Art. 6(1), Art. 9(1)","Accountability, Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.4.2024","https://www.enforcementtracker.com/ETid-2518","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.4.2024","gdprhub",null,null,"centrum medyczne ujastek spzoo",null,null,null,null,null,null,null,null,null],["2024/BE/002","ETid-2225","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2024-01-16","day",174640,null,"EUR","Black Tiger Belgium","Industry and Commerce","Art. 12, Art. 14, Art. 15, Art. 25, Art. 30, Art. 5, Art. 6","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.autoriteprotectiondonnees.be/citoyen/lapd-sanctionne-lentreprise-de-gestion-de-donnees-black-tiger-belgium-pour-manque-de-transparence","https://www.enforcementtracker.com/ETid-2225",null,null,null,null,"BE: black tiger belgium",null,null,null,null,null,null,null,null,null],["2024/NL/013","ETid-2183","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2024-01-15","day",150000,null,"EUR","International Card Services B.V.","Finance, Insurance and Consulting","Art. 35","DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/boete-voor-creditcardbedrijf-ics-na-ontbrekende-risicoanalyse","https://www.enforcementtracker.com/ETid-2183",null,null,null,null,"international card services bv",null,null,null,null,null,null,null,null,null],["2024/RO/025","ETid-2186","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-01-15","day",3000,null,"EUR","TECHNINK LEB SRL","Industry and Commerce","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15.01.2024&lang=ro","https://www.enforcementtracker.com/ETid-2186",null,null,null,null,"technink leb srl",null,null,null,null,null,null,null,null,null],["2024/FR/015","ETid-2413","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-15","day",5000,null,"EUR","Attorney","Finance, Insurance and Consulting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2413",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/RO/026","ETid-2185","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2024-01-12","day",17000,null,"EUR","Alior Bank SA","Finance, Insurance and Consulting","Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_12.01.2024&lang=ro","https://www.enforcementtracker.com/ETid-2185",null,null,null,null,"alior bank sa",null,null,null,null,null,null,null,null,null],["2024/ES/113","ETid-2205","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-01-11","day",1000,null,"EUR","ATLAS ENTERTAINMENT, S.L.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00437-2023.pdf","https://www.enforcementtracker.com/ETid-2205",null,null,null,null,"atlas entertainment sl",null,null,null,null,null,null,null,null,null],["2024/IT/060","Garante per la protezione dei dati personali (Italy) - 9977020","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-11","day",50000,"50,000","EUR","Comune di Trento",null,"Art. 10, Art. 13, Art. 14, Art. 35, Art. 5(1)(a), Art. 6, Art. 83, Art. 9","DPIA, Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9977020","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9977020",null,"gdprhub",null,null,"IT: comune di trento",null,null,null,null,null,null,null,null,null],["2024/IT/063","Garante per la protezione dei dati personali (Italy) - 9983210","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-11","day",8000,"8000","EUR","David S.r.l.",null,"Art. 12, Art. 13, Art. 5(1), Art. 6, Art. 9","Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9983210","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9983210",null,"gdprhub",null,null,"david srl",null,null,null,null,null,null,null,null,null],["2024/IT/062","Garante per la protezione dei dati personali (Italy) - 9983244","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-11","day",20000,"20,000","EUR",null,null,"Art. 32, Art. 5(1)(f), Art. 9","Data principles, Data security, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9983244","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9983244",null,"gdprhub",null,"General practitioner",null,null,null,null,null,"person",null,null,null,null],["2024/IT/067","Garante per la protezione dei dati personali (Italy) - 9993548","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2024-01-11","day",5000,"5,000","EUR","Euro Servizi per i Notai S.r.l.",null,"Art. 13, Art. 14, Art. 32, Art. 5(1)(a), Art. 5(1)(f), Art. 6(1)(a), Art. 6(1)(f)","Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9993548","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9993548",null,"gdprhub",null,null,"euro servizi per i notai srl",null,null,null,null,null,null,null,null,null],["2024/GR/011","HDPA (Greece) - 6/2024","gdprhub","Greece","GR","HDPA (Greece)","2024-01-10","day",2000,"2.000","EUR",null,null,"Art. 12(1), Art. 13, Art. 4(7), Art. 5(1), Art. 5(2)","Data principles, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-02/6_2024%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_6/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/BE/005","APD/GBA (Belgium) - 03/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-01-09","day",null,null,null,null,null,"Art. 12, Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-03-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_03/2024",null,"gdprhub",null,"Recruitment agency",null,null,null,null,null,null,null,null,null,null],["2024/FR/016","ETid-2412","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2024-01-09","day",1500,null,"EUR","Website operator",null,null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/les-sanctions-prononcees-par-la-cnil","https://www.enforcementtracker.com/ETid-2412",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/SE/005","IMY (Sweden) - IMY 2023-8336","gdprhub","Sweden","SE","IMY (Sweden)","2024-01-09","day",null,null,null,"Klarna Bank AB",null,"Art. 12(2), Art. 16, Art. 25, Art. 5(1)(d), Art. 56, Art. 58(2)(b)","Accountability, Data principles, Data subject rights, Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2024/beslut-klarna-bank-imy-2023-8336.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY_2023-8336",null,"gdprhub",null,null,"klarna bank ab","Klarna",null,null,null,null,null,null,null,null],["2024/ES/089","ETid-2321","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2024-01-08","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00336-2023.pdf","https://www.enforcementtracker.com/ETid-2321",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/SI/001","IP (Slovenia) - 07101-22-2023-7 34","gdprhub","Slovenia","SI","IP (Slovenia)","2024-01-08","day",null,null,null,null,null,"Art. 12, Art. 12(3), Art. 15, Art. 15(1)","Data subject rights, Transparency",null,"Violation found","https://gdprhub.eu/index.php?title=File:07101-22-2023-7_34._%C4%8Dlen_ZVOP-2_kr%C5%A1itev_brez_ukrepa_08012024.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07101-22-2023-7_34",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/SI/002","IP (Slovenia) - 07101-22/2023/7","gdprhub","Slovenia","SI","IP (Slovenia)","2024-01-08","day",null,null,null,null,null,"Art. 12, Art. 15, Art. 6(1)","Data subject rights, Transparency, Unlawful processing",null,"Rejected","https://gdprhub.eu/images/5/5e/07101-22-2023-7_34._%25C4%258Dlen_ZVOP-2_kr%25C5%25A1itev_brez_ukrepa_08012024.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07101-22/2023/7",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/ES/115","AEPD (Spain) - EXP202201673","gdprhub","Spain","ES","AEPD (Spain)","2024-01-05","day",null,null,null,null,null,"Art. 15, Art. 18","Data subject rights",null,"Violation found","https://www.aepd.es/documento/pd-00197-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202201673",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/BE/004","APD/GBA (Belgium) - 01/2024","gdprhub","Belgium","BE","APD/GBA (Belgium)","2024-01-05","day",null,null,null,null,null,"Art. 12, Art. 13(1)(c), Art. 15, Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(e), Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-01-2024.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_01/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2024/AT/006","ETid-2327","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2024-01-04","day",11000,null,"EUR","Website operator","Individuals and Private Associations","Art. 17(1), Art. 25(1), Art. 58(2)(c)","Accountability, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20240104_2023_0_592_319_00","https://www.enforcementtracker.com/ETid-2327","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.592.319","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2024/EE/003","AKI (Estonia) - 2.1.-5/24/2203-8","gdprhub","Estonia","EE","AKI (Estonia)","2024-01-02","day",null,null,null,"Simtan Kaubandus OÜ",null,"Art. 12, Art. 13, Art. 5(1), Art. 6(1)(f)","Data principles, Transparency, Unlawful processing",null,null,"https://www.aki.ee/ettekirjutused","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-5/24/2203-8",null,"gdprhub",null,null,"simtan kaubandus ou",null,null,null,null,null,null,null,null,null],["2024/AT/005","ETid-2770","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2024-01-02","day",15200,null,"EUR","Media Company","Media, Telecoms and Broadcasting","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://dsb.gv.at/sites/site0344/media/downloads/datenschutzbericht_2024.pdf","https://www.enforcementtracker.com/ETid-2770",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/021","ETid-2435","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",16000,null,"EUR","Hotel","Accommodation and Hospitality",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2435",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/020","ETid-2437","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",6000,null,"EUR","Online retailer","Industry and Commerce",null,"Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2437",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/019","ETid-2438","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2438",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/DE/018","ETid-2439","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2439",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2024/DE/017","ETid-2440","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",null,null,"EUR","Police employees","Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2440",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/016","ETid-2441","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",null,null,"EUR","Company",null,null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2441",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/015","ETid-2442","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",null,null,"EUR","Company",null,null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2442",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/014","ETid-2443","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",11500,null,"EUR","Company","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2443",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/013","ETid-2444","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2024","year",32000,null,"EUR","Company","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/news/zwischenbilanz-2024-hmbbfdi-verhaengt-bussgelder-in-hoehe-von-130000-euro","https://www.enforcementtracker.com/ETid-2444",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/011","ETid-2570","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2024","year",120000,null,"EUR","Company",null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.datenschutz.sachsen.de/download/taetigkeitsberichte/Taetigkeitsbericht_Datenschutz_2024.pdf","https://www.enforcementtracker.com/ETid-2570",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/010","ETid-2571","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2024","year",22080,null,"EUR","Company",null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.datenschutz.sachsen.de/download/taetigkeitsberichte/Taetigkeitsbericht_Datenschutz_2024.pdf","https://www.enforcementtracker.com/ETid-2571",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/009","ETid-2629","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2024","year",60000,null,"EUR","Company","Health Care",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datenschutz-berlin.de/jahresbericht-2024/#_idTextAnchor008","https://www.enforcementtracker.com/ETid-2629",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/008","ETid-2631","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2024","year",null,null,"EUR","Multiple Police Officers","Public Sector and Education",null,null,"Unknown","Fine issued","https://www.datenschutz-berlin.de/jahresbericht-2024/#_idTextAnchor009","https://www.enforcementtracker.com/ETid-2631",null,null,null,null,"DE: multiple police officers",null,null,null,null,null,null,null,null,null],["2024/DE/007","ETid-2632","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2024","year",3700,null,"EUR","Doctor´s Office","Health Care","Art. 5(1)(a), Art. 6(1), Art. 9(1)","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2025-05/53-tb-online.pdf","https://www.enforcementtracker.com/ETid-2632",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/006","ETid-2633","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2024","year",3300,null,"EUR","Doctor´s Office","Health Care","Art. 5(1)(a), Art. 6(1), Art. 9(1)","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2025-05/53-tb-online.pdf","https://www.enforcementtracker.com/ETid-2633",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/005","ETid-2634","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2024","year",2500,null,"EUR","Doctor´s Office","Health Care","Art. 32, Art. 5(1)(f), Art. 6(1), Art. 9(1)","Data principles, Data security, Special categories, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2025-05/53-tb-online.pdf","https://www.enforcementtracker.com/ETid-2634",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/004","ETid-2635","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2024","year",16000,null,"EUR","Freelancer",null,"Art. 13, Art. 31, Art. 58(2)(d)","Cooperation with the DPA, Transparency","Insufficient cooperation with supervisory authority","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2025-05/53-tb-online.pdf","https://www.enforcementtracker.com/ETid-2635",null,null,null,null,"DE: freelancer",null,null,null,null,null,null,null,null,null],["2024/DE/003","ETid-2636","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2024","year",496000,null,"EUR","Company","Finance, Insurance and Consulting","Art. 12(3), Art. 15, Art. 5, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2025-05/53-tb-online.pdf","https://www.enforcementtracker.com/ETid-2636",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/002","ETid-2637","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2024","year",10000,null,"EUR","Company","Industry and Commerce","Art. 6(1), Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2025-05/53-tb-online.pdf","https://www.enforcementtracker.com/ETid-2637",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/001","ETid-2638","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2024","year",4113486,null,"EUR",null,null,null,null,"Unknown","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/2025-05/53-tb-online.pdf","https://www.enforcementtracker.com/ETid-2638",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2024/DE/022","ETid-2646","cms_tracker","Germany","DE","The Federal Commissioner for Data Protection and Freedom of Information (BfDI)","2024","year",45000000,null,"EUR","Vodafone GmbH","Media, Telecoms and Broadcasting","Art. 28(1)","Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.bfdi.bund.de/SharedDocs/Pressemitteilungen/DE/2025/06_Geldbu%C3%9Fe-Vodafone.html","https://www.enforcementtracker.com/ETid-2646",null,null,null,null,"vodafone gmbh","Vodafone",null,null,null,null,null,null,null,null],["2023/FR/021","CNIL (France) - SAN-2023-023","gdprhub","France","FR","CNIL (France)","2023-12-29","day",105000,"105000","EUR","NS Cards France",null,"Art. 12, Art. 13, Art. 32, Art. 5(1)(e)","Data principles, Data security, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048907667?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-023",null,"gdprhub",null,null,"FR: ns cards france",null,null,null,null,null,null,null,null,null],["2023/FR/025","CNIL (France) - SAN-2023-024","gdprhub","France","FR","CNIL (France)","2023-12-29","day",10000000,"10,000,000","EUR","Yahoo EMEA Limited",null,"Art. 6(1), Art. 7(3), Art. 7(4)","Consent, Unlawful processing",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048967251?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-024",null,"gdprhub",null,null,"yahoo emea ltd",null,null,null,null,null,null,null,null,null],["2023/FR/024","CNIL (France) - SAN-2023-025","gdprhub","France","FR","CNIL (France)","2023-12-29","day",75000,"75,000","EUR","TAGADAMEDIA",null,"Art. 30, Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000049051422?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-025",null,"gdprhub",null,null,"FR: tagadamedia",null,null,null,null,null,null,null,null,null],["2023/ES/001","ETid-2532","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-12-27","day",6500000,null,"EUR","THE PHONE HOUSE SPAIN, S.L.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00084-2023.pdf","https://www.enforcementtracker.com/ETid-2532",null,null,null,null,"the phone house spain sl",null,null,null,null,null,null,null,null,null],["2023/ES/008","ETid-2251","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-12-23","day",3500,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00117-2023.pdf","https://www.enforcementtracker.com/ETid-2251",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/FR/004","ETid-2166","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-12-22","day",null,null,"EUR","Company","Employment","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-six-nouvelles-sanctions-dans-le-cadre-de-sa-procedure-simplifie","https://www.enforcementtracker.com/ETid-2166",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/FR/003","ETid-2167","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-12-22","day",null,null,"EUR","Candidate for parliamentary elections","Individuals and Private Associations","Art. 21(2)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-six-nouvelles-sanctions-dans-le-cadre-de-sa-procedure-simplifie","https://www.enforcementtracker.com/ETid-2167",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/FR/002","ETid-2168","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-12-22","day",null,null,"EUR","Municipality","Public Sector and Education",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-six-nouvelles-sanctions-dans-le-cadre-de-sa-procedure-simplifie","https://www.enforcementtracker.com/ETid-2168",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/FR/001","ETid-2169","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-12-22","day",null,null,"EUR",null,null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.cnil.fr/fr/la-cnil-prononce-six-nouvelles-sanctions-dans-le-cadre-de-sa-procedure-simplifie","https://www.enforcementtracker.com/ETid-2169",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/FI/015","Tietosuojavaltuutetun toimisto (Finland) - TSV/35/2022","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-12-22","day",null,null,null,null,null,"Art. 32(4), Art. 5(1)(a), Art. 5(1)(b), Art. 58(2)(b)","Data principles, Data security",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2023/20232063","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_TSV/35/2022",null,"gdprhub",null,"Municipality-run educational institution",null,null,null,null,null,null,null,null,null,null],["2023/DE/036","BayLDA (Bavaria) - LDA-1085.1-10821/21-F","gdprhub","Germany","DE","BayLDA (Bavaria)","2023-12-21","day",null,null,null,"CRIF Bürgel",null,"Art. 12, Art. 14, Art. 18, Art. 5(1)(b)","Data principles, Data subject rights, Transparency",null,"Violation found","https://gdprhub.eu/images/8/82/Beschwerdeergebnis_redacted.pdf","https://gdprhub.eu/index.php?title=BayLDA_%28Bavaria%29_-_LDA-1085.1-10821/21-F",null,"gdprhub",null,null,"DE: crif burgel",null,null,null,null,null,null,null,null,null],["2023/PL/004","ETid-2194","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-12-21","day",4300,null,"EUR",null,null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DOKE.561.14.2023","https://www.enforcementtracker.com/ETid-2194",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/004","ETid-2255","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-12-21","day",2000,null,"EUR","Company",null,"Art. 13, Art. 5","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9981308","https://www.enforcementtracker.com/ETid-2255",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IS/025","Persónuvernd (Island) - 2022050850","gdprhub","Iceland","IS","Persónuvernd (Island)","2023-12-21","day",null,null,null,null,null,"Art. 13(4), Art. 14(5), Art. 6(1)(c), Art. 9(2)(a), Art. 9(2)(e)","Special categories, Transparency, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-landskjorstjornar-og-yfirkjorstjornar-kopavogs-vegna-kosninga-2022","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2022050850",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2023/IS/026","Persónuvernd (Island) - 2023030483","gdprhub","Iceland","IS","Persónuvernd (Island)","2023-12-21","day",null,null,null,null,null,"Art. 15(3), Art. 32(1), Art. 32(2)","Data security, Data subject rights",null,"Violation found","https://www.personuvernd.is/urlausnir/afgreidsla-reykjavikurborgar-a-adgangsbeidni-einstaklings-og-vardveisla-personuupplysinga","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2023030483",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/050","APD/GBA (Belgium) - 170/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-12-20","day",null,null,null,null,null,"Art. 24, Art. 32, Art. 33","Accountability, Data breach, Data security",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-170-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_170/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/PL/007","ETid-2171","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-12-20","day",23000,null,"EUR","Polish Minister of Health","Health Care","Art. 25(1), Art. 34(2)","Accountability, Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.32.2023","https://www.enforcementtracker.com/ETid-2171",null,null,null,null,"PL: polish minister of health",null,null,null,null,null,null,null,null,null],["2023/HU/011","NAIH (Hungary) - NAIH-6752-10/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-12-20","day",null,null,null,null,null,"Art. 12(1), Art. 13(1), Art. 13(2), Art. 26(1), Art. 5(1)(a), Art. 6(1)(a), Art. 9(1)","Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://gdprhub.eu/index.php?title=File:Naih-6752-10-2023_felszolitas-4.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-6752-10/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/PL/003","ETid-2253","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-12-19","day",2300,null,"EUR","District Court Krakow","Public Sector and Education",null,"Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.42.2022","https://www.enforcementtracker.com/ETid-2253","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.42.2022","gdprhub",null,null,"PL: district court krakow",null,null,null,null,null,null,null,null,null],["2023/NL/002","AP (The Netherlands) - Boete ICS","gdprhub","Netherlands","NL","AP (The Netherlands)","2023-12-18","day",150000,"150000","EUR","ICS",null,"Art. 35(1)","DPIA",null,"Violation found","https://www.autoriteitpersoonsgegevens.nl/uploads/2024-01/Besluit%20boete%20ICS.pdf","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Boete_ICS","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Decision_of_18_December_2023","gdprhub",null,null,"NL: ics",null,null,null,null,null,null,null,null,null],["2023/AT/024","DSB (Austria) - 2023-0.594.826","gdprhub","Austria","AT","DSB (Austria)","2023-12-18","day",null,null,null,"OSCE",null,"Art. 2(1), Art. 3, Art. 4(7)",null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231218_2023_0_594_826_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.594.826",null,"gdprhub",null,null,"AT: osce",null,null,null,null,null,null,null,null,null],["2023/ES/021","ETid-2197","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-12-17","day",400,null,"EUR","TITAN STRONG, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00385-2023.pdf","https://www.enforcementtracker.com/ETid-2197",null,null,null,null,"titan strong sl",null,null,null,null,null,null,null,null,null],["2023/ES/015","ETid-2215","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-12-17","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00074-2023.pdf","https://www.enforcementtracker.com/ETid-2215",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/RO/001","ETid-2160","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-12-15","day",200,null,"EUR",null,"Individuals and Private Associations",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15_12_2023&lang=ro","https://www.enforcementtracker.com/ETid-2160",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IS/024","Persónuvernd (Island) - 2022081290","gdprhub","Iceland","IS","Persónuvernd (Island)","2023-12-15","day",null,null,null,null,null,"Art. 14, Art. 5(1), Art. 6(1)(e), Art. 6(3)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-rikislogreglustjora","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2022081290",null,"gdprhub",null,"National Police Commissioner",null,null,null,null,null,null,null,null,null,null],["2023/IS/023","Persónuvernd (Island) - 2021091877","gdprhub","Iceland","IS","Persónuvernd (Island)","2023-12-14","day",null,null,null,null,null,"Art. 58(2)(f), Art. 6, Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/birting-textafaerslu-asamt-myndum-ur-skram-logreglu-a-facebook-sidu-einstaklings","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2021091877",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/GB/001","ETid-2170","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2023-12-13","day",400000,null,"EUR","UK Ministry of Defense","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/12/ico-fines-ministry-of-defence-for-afghan-evacuation-data-breach/","https://www.enforcementtracker.com/ETid-2170",null,null,null,null,"GB: uk ministry of defense",null,null,null,null,null,null,null,null,null],["2023/PL/001","ETid-2258","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-12-13","day",5500,null,"EUR","Company",null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DOKE.561.18.2023","https://www.enforcementtracker.com/ETid-2258",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/HR/014","AZOP (Croatia) - Decision 12-12-2023","gdprhub","Croatia","HR","AZOP (Croatia)","2023-12-12","day",null,null,null,null,null,"Art. 5, Art. 6","Data principles, Unlawful processing",null,"Violation found","https://azop.hr/wp-content/uploads/2024/04/AZOP_objava-slike-djeteta-na-plakatu.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_12-12-2023",null,"gdprhub",null,"City Tourist Board",null,null,null,null,null,null,null,null,null,null],["2023/FR/005","ETid-2155","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-12-12","day",5000,null,"EUR","Kourou municipality","Public Sector and Education","Art. 31, Art. 37","Cooperation with the DPA, Data protection officer","Insufficient cooperation with supervisory authority","Fine issued","https://www.cnil.fr/fr/non-designation-dun-delegue-la-protection-des-donnees-la-cnil-sanctionne-la-commune-de-kourou","https://www.enforcementtracker.com/ETid-2155","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-018","gdprhub",null,null,"FR: kourou municipality",null,null,null,null,null,null,null,null,null],["2023/AT/002","ETid-2207","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2023-12-12","day",5900,null,"EUR",null,null,"Art. 31(1), Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231212_2023_0_603_142_00","https://www.enforcementtracker.com/ETid-2207","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.603.142","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/007","ETid-2252","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-12-12","day",10000,null,"EUR","VACACIONES EDREAMS, S.L.","Industry and Commerce","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00014-2023.pdf","https://www.enforcementtracker.com/ETid-2252",null,null,null,null,"vacaciones edreams sl",null,null,null,null,null,null,null,null,null],["2023/AT/015","DSB (Austria) - 2023-0.789.858","gdprhub","Austria","AT","DSB (Austria)","2023-12-11","day",9500,"9,500","EUR",null,null,"Art. 12(3), Art. 15, Art. 83, Art. 83(2)(b)","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231211_2023_0_789_858__00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.789.858",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/002","ETid-2159","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-12-11","day",3000,null,"EUR","Veranda Obor S.A.","Industry and Commerce","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_11.12.2023&lang=ro","https://www.enforcementtracker.com/ETid-2159",null,null,null,null,"veranda obor sa",null,null,null,null,null,null,null,null,null],["2023/NL/007","ETid-2199","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2023-12-11","day",10000000,null,"EUR","Uber Technologies Inc. Uber B.V.","Employment","Art. 13(1)(f)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/uber-krijgt-boete-van-10-miljoen-euro-voor-overtreden-privacyregels","https://www.enforcementtracker.com/ETid-2199","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Decision_of_11_December_2023_imposing_administrative_fine_on_Uber","gdprhub",null,null,"uber technologies inc uber bv","Uber",null,null,null,null,null,null,null,null],["2023/EE/001","AKI (Estonia) - 2.1-3/22/2542","gdprhub","Estonia","EE","AKI (Estonia)","2023-12-08","day",null,null,null,"Eesti Ehitusinseneride Liit MTÜ",null,null,null,null,null,"https://www.aki.ee/sites/default/files/vaideotsused/2022/tehver_ja_partnerid_vaideotsus_eesti_ehitu.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-3/22/2542",null,"gdprhub",null,null,"EE: eesti ehitusinseneride liit mtu",null,null,null,null,null,null,null,null,null],["2023/FR/023","CNIL (France) - SAN-2023-021","gdprhub","France","FR","CNIL (France)","2023-12-07","day",32000000,"32,000,000","EUR","Amazon France Logistique",null,"Art. 12, Art. 13, Art. 32, Art. 5(1)(c), Art. 6(1)(f)","Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048989272","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-021",null,"gdprhub",null,null,"FR: amazon france logistique","Amazon",null,null,null,null,null,null,null,null],["2023/AT/017","DSB (Austria) - 2023-0.583.644","gdprhub","Austria","AT","DSB (Austria)","2023-12-07","day",20000,"20,000","EUR",null,null,"Art. 30, Art. 5(1)(a), Art. 5(1)(c), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231207_2023_0_583_644_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.583.644",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/AT/016","DSB (Austria) - 2023-0.637.760","gdprhub","Austria","AT","DSB (Austria)","2023-12-07","day",10000,"10,000","EUR",null,null,"Art. 31, Art. 58(1)(a), Art. 58(1)(e), Art. 83",null,null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231207_2023_0_637_760_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.637.760",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/003","ETid-2148","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-12-07","day",24000,null,"EUR","Hora Credit IFN SA","Finance, Insurance and Consulting","Art. 12(3), Art. 15, Art. 32, Art. 33(1)","Data breach, Data security, Data subject rights, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07_12_2023&lang=ro","https://www.enforcementtracker.com/ETid-2148",null,null,null,null,"hora credit ifn sa",null,null,null,null,null,null,null,null,null],["2023/IT/007","ETid-2188","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-12-07","day",1000,null,"EUR","Sirio S.p.A.","Employment","Art. 13, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9972788","https://www.enforcementtracker.com/ETid-2188","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9972788","gdprhub",null,null,"sirio spa",null,null,null,null,null,null,null,null,null],["2023/IT/006","ETid-2191","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-12-07","day",40000,null,"EUR","Azienda socio sanitaria territoriale nord Milano, C.F.","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data principles, Data security, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9978342","https://www.enforcementtracker.com/ETid-2191",null,null,null,null,"IT: azienda socio sanitaria territoriale nord milano cf",null,null,null,null,null,null,null,null,null],["2023/PL/005","ETid-2193","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-12-07","day",2700,null,"EUR",null,null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DOKE.561.5.2023","https://www.enforcementtracker.com/ETid-2193",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/005","ETid-2196","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-12-07","day",2000,null,"EUR","Mushtaq Rubina Kebabish","Accommodation and Hospitality","Art. 13, Art. 5","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9976904","https://www.enforcementtracker.com/ETid-2196",null,null,null,null,"IT: mushtaq rubina kebabish",null,null,null,null,null,null,null,null,null],["2023/ES/020","ETid-2198","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-12-07","day",3200,null,"EUR","SOLAR PROGRESS, S.L.","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00549-2022.pdf","https://www.enforcementtracker.com/ETid-2198",null,null,null,null,"solar progress sl",null,null,null,null,null,null,null,null,null],["2023/CY/002","ETid-2247","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023-12-07","day",1500,null,"EUR","Physician","Health Care","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/F880C7270072D4E0C2258AAE0049CEAB/$file/%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20%CE%93%CE%B5%CE%A3%CE%A5%2077.pdf?openelement","https://www.enforcementtracker.com/ETid-2247","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.009.077","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/GB/006","ICO (UK) - Ministry of Defence","gdprhub","United Kingdom","GB","ICO (UK)","2023-12-07","day",null,"350,000","GBP","Secretary of State for Defence",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4028623/ministry-of-defence-monetary-penalty-notice.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Ministry_of_Defence",null,"gdprhub",null,null,"GB: secretary of state for defence",null,350000.0,408163,"day 2023-12-07|0.8575|GBP",null,null,null,null,null],["2023/IS/005","ETid-2139","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-12-06","day",16600,null,"EUR","Reykjanesbær municipality","Public Sector and Education","Art. 24(1), Art. 28, Art. 5(1)","Accountability, Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/uttekt-a-notkun-reykjanesbaejar-a-skyjalausn-google-i-grunnskolastarfi#","https://www.enforcementtracker.com/ETid-2139",null,null,null,null,"IS: reykjanesbr municipality",null,null,null,null,null,null,null,null,null],["2023/IS/004","ETid-2140","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-12-06","day",13300,null,"EUR","City of Reykjavik","Public Sector and Education","Art. 24(1), Art. 28, Art. 5(1)","Accountability, Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/uttekt-a-notkun-reykjavikurborgar-a-skyjalausn-google-i-grunnskolastarfi#","https://www.enforcementtracker.com/ETid-2140",null,null,null,null,"IS: city of reykjavik",null,null,null,null,null,null,null,null,null],["2023/IS/003","ETid-2141","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-12-06","day",16600,null,"EUR","Garðabær municipality","Public Sector and Education","Art. 24(1), Art. 28, Art. 5(1)","Accountability, Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/uttekt-a-notkun-gardabaejar-a-skyjalausn-google-i-grunnskolastarfi#","https://www.enforcementtracker.com/ETid-2141",null,null,null,null,"IS: garabr municipality",null,null,null,null,null,null,null,null,null],["2023/IS/002","ETid-2142","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-12-06","day",18600,null,"EUR","City of Hafnarfjörður","Public Sector and Education","Art. 24(1), Art. 28, Art. 5(1)","Accountability, Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/uttekt-a-notkun-hafnarfjardarbaejar-a-skyjalausn-google-i-grunnskolastarfi","https://www.enforcementtracker.com/ETid-2142",null,null,null,null,"IS: city of hafnarfjorur",null,null,null,null,null,null,null,null,null],["2023/IS/001","ETid-2153","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-12-06","day",20000,null,"EUR","City of Kópavogur","Public Sector and Education","Art. 24(1), Art. 28, Art. 5(1)","Accountability, Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/uttekt-a-notkun-kopavogsbaejar-a-skyjalausn-google-i-grunnskolastarfi","https://www.enforcementtracker.com/ETid-2153",null,null,null,null,"IS: city of kopavogur",null,null,null,null,null,null,null,null,null],["2023/SE/020","IMY (Sweden) - IMY-2023-4559","gdprhub","Sweden","SE","IMY (Sweden)","2023-12-06","day",null,null,null,"Nordea Bank",null,"Art. 15","Data subject rights",null,"Rejected","https://www.imy.se/contentassets/882af6d7f09b4412872ba754618fbaf1/beslut-tillsyn-nordea.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2023-4559",null,"gdprhub",null,null,"SE: nordea bank",null,null,null,null,null,null,null,null,null],["2023/CY/017","Commissioner (Cyprus) - 11.17.001.008.147","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2023-12-05","day",null,null,null,null,null,"Art. 28, Art. 36(4), Art. 4","DPIA, Processor obligations",null,"Violation found","https://www.dataprotection.gov.cy/DATAPROTECTION/DATAPROTECTION.NSF/F880C7270072D4E0C2258AAE0049CEAB/$file/%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%2520%CE%A5%CF%80%CE%B7%CF%81%CE%B5%CF%83%CE%AF%CE%B1%2520%CE%95%CE%BE%CE%B5%CF%84%CE%AC%CF%83%CE%B5%CF%89%CE%BD.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.008.147",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/FI/012","Tietosuojavaltuutetun toimisto (Finland) - 128/182/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-12-04","day",null,null,null,"Lääkärikeskus Gyneko Oy",null,"Art. 32(1)(b), Art. 32(2), Art. 58(2)(d), Art. 9(1)","Data security, Special categories",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2023/20232003","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_128/182/19",null,"gdprhub",null,null,"laakarikeskus gyneko oy",null,null,null,null,null,null,null,null,null],["2023/BE/051","APD/GBA (Belgium) - 161/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-12-01","day",null,null,null,"Les Editions de l'Avenir Presse",null,"Art. 4(11), Art. 6(1)(a), Art. 7","Consent, Unlawful processing",null,"Other Outcome","https://www.autoriteprotectiondonnees.be/publications/transaction-art95-n-161-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_161/2023",null,"gdprhub",null,null,"BE: les editions de l avenir presse",null,null,null,null,null,null,null,null,null],["2023/ES/024","ETid-2184","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-12-01","day",30000,null,"EUR","UNIPREX, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00436-2023.pdf","https://www.enforcementtracker.com/ETid-2184",null,null,null,null,"uniprex sa",null,null,null,null,null,null,null,null,null],["2023/BE/052","APD/GBA (Belgium) - 162/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-11-30","day",null,null,null,"RADIO TÉLÉVISION BELGE DE LA COMMUNAUTÉ FRANÇAISE",null,null,null,null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/art95-schikking-nr.-162-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_162/2023",null,"gdprhub",null,null,"BE: radio television belge de la communaute francaise",null,null,null,null,null,null,null,null,null],["2023/IT/014","ETid-2174","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-30","day",1000,null,"EUR","Techno Security s.r.l.",null,"Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9964995","https://www.enforcementtracker.com/ETid-2174",null,null,null,null,"techno security srl",null,null,null,null,null,null,null,null,null],["2023/IT/009","ETid-2180","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-30","day",3000,null,"EUR","A R.L Spartan Gym","Industry and Commerce","Art. 13, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9971417","https://www.enforcementtracker.com/ETid-2180",null,null,null,null,"IT: arl spartan gym",null,null,null,null,null,null,null,null,null],["2023/IT/008","ETid-2187","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-30","day",60000,null,"EUR","Limit Call S.r.l.s.","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 14, Art. 15, Art. 24, Art. 5(2), Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9971433","https://www.enforcementtracker.com/ETid-2187","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9971433","gdprhub",null,null,"limit call srls",null,null,null,null,null,null,null,null,null],["2023/ES/012","ETid-2218","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-30","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00252-2023.pdf","https://www.enforcementtracker.com/ETid-2218",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/HU/010","NAIH (Hungary) - NAIH-3734-15/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-11-30","day",null,null,null,null,null,"Art. 38(2), Art. 58(2)(d), Art. 6(1)(f), Art. 83","Data protection officer, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=844:kozterulet-kameras-megfigyelese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-3734-15/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/SI/009","IP (Slovenia) - 07100-15-2023-1","gdprhub","Slovenia","SI","IP (Slovenia)","2023-11-29","day",null,null,null,null,null,"Art. 15","Data subject rights",null,"Violation found","https://gdprhub.eu/index.php?title=File:07100-15-2023-1_odlo%25C4%258Dba_34._ZVOP-2_kr%25C5%25A1itev_brez_ukrepov_29112023.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07100-15-2023-1",null,"gdprhub",null,"Slovenian ministry",null,null,null,null,null,null,null,null,null,null],["2023/SE/001","ETid-2137","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-11-28","day",26500,null,"EUR","Östersund Municipality's Department for Children and Education","Public Sector and Education","Art. 35(1)","DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-gebyr-og-palegg-til-nav//","https://www.enforcementtracker.com/ETid-2137",null,null,null,null,"SE: ostersund municipality s department for children and education",null,null,null,null,null,null,null,null,null],["2023/BE/049","APD/GBA (Belgium) - 157/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-11-27","day",null,null,null,null,null,"Art. 21(2)","Data subject rights",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/ordonnance-n-157-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_157/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/DK/013","Datatilsynet (Denmark) - 2023-432-0016","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-11-27","day",null,null,null,"The Central Denmark Region",null,"Art. 4(11), Art. 5(1), Art. 6(1)(a), Art. 9(2)(a)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/nov/hospital-kan-ikke-bruge-samtykke-til-at-offentliggoere-billeder-af-patienter-paa-instagram","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-432-0016",null,"gdprhub",null,null,"DK: the central denmark region",null,null,null,null,null,null,null,null,null],["2023/ES/037","ETid-2131","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-27","day",50000,null,"EUR","SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00352-2023.pdf","https://www.enforcementtracker.com/ETid-2131",null,null,null,null,"suministrador iberico de energia sl",null,null,null,null,null,null,null,null,null],["2023/NO/001","ETid-2136","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2023-11-27","day",1700000,null,"EUR","Norwegian Labor and Welfare Administration","Public Sector and Education","Art. 24(1), Art. 25(1), Art. 32(1)(d), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-gebyr-og-palegg-til-nav/","https://www.enforcementtracker.com/ETid-2136","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_23/00708","gdprhub",null,null,"NO: norwegian labor and welfare administration",null,null,null,null,null,null,null,null,null],["2023/BE/048","APD/GBA (Belgium) - 159/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-11-24","day",null,null,null,"Mediafin",null,"Art. 4(11), Art. 6(1)(a), Art. 7(3)","Consent, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/art95-schikking-nr.-159-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_159/2023",null,"gdprhub",null,null,"BE: mediafin",null,null,null,null,null,null,null,null,null],["2023/ES/040","ETid-2127","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-24","day",10000,null,"EUR","Pharmacy owner","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00538-2022.pdf","https://www.enforcementtracker.com/ETid-2127",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/039","ETid-2128","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-24","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00215-2023.pdf","https://www.enforcementtracker.com/ETid-2128",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/HU/012","NAIH (Hungary) - NAIH-373-31/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-11-24","day",null,"500000","HUF","Pitagorasz Oktatási Stúdió Kft",null,"Art. 12(1), Art. 13(1), Art. 13(2), Art. 14(2), Art. 17(1)(b), Art. 5(1)(a), Art. 5(1)(b), Art. 5(2)","Data principles, Data subject rights, Transparency",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=850:kiskoruak-szemelyes-adatanak-piackutatasi-es-direkt-marketing-celu-kezelese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-373-31/2023",null,"gdprhub",null,null,"pitagorasz oktatasi studio kft",null,500000.0,1316,"day 2023-11-24|379.8800|HUF",null,null,null,null,null],["2023/BE/045","APD/GBA (Belgium) - 154/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-11-23","day",null,null,null,null,null,"Art. 5(1)(b), Art. 5(1)(c)","Data principles",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-154-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_154/2023",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/GR/001","ETid-2175","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-11-23","day",10000,null,"EUR","Alpha Bank","Finance, Insurance and Consulting","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-stin-alpha-bank-gia-mi-ikanopoiisi-dikaiomatos","https://www.enforcementtracker.com/ETid-2175",null,null,null,null,"GR: alpha bank",null,null,null,null,null,null,null,null,null],["2023/GR/028","HDPA (Greece) - 36/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-11-23","day",10000,"10000","EUR","Alpha Bank",null,"Art. 12(3), Art. 15(1), Art. 15(3), Art. 5(1)(a)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2023-12/36_2023%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_36/2023",null,"gdprhub",null,null,"GR: alpha bank",null,null,null,null,null,null,null,null,null],["2023/ES/041","ETid-2126","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-22","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00155-2023.pdf","https://www.enforcementtracker.com/ETid-2126",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/035","ETid-2134","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-22","day",56000,null,"EUR","VODAFONE ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00449-2022.pdf","https://www.enforcementtracker.com/ETid-2134",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/CY/003","ETid-2144","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023-11-22","day",45000,null,"EUR","Open University of Cyprus","Public Sector and Education","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0289C76C8BC40785C2258A74003395F8?OpenDocument","https://www.enforcementtracker.com/ETid-2144","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_Decision_of_27_November_2023","gdprhub",null,null,"CY: open university of cyprus",null,null,null,null,null,null,null,null,null],["2023/ES/026","ETid-2172","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-21","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00344-2023.pdf","https://www.enforcementtracker.com/ETid-2172",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/025","ETid-2173","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-21","day",8000,null,"EUR","EASYJET AIRLINE COMPANY LIMITED","Transportation and Energy","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00026-2023.pdf","https://www.enforcementtracker.com/ETid-2173",null,null,null,null,"easyjet airline company ltd",null,null,null,null,null,null,null,null,null],["2023/RO/005","ETid-2124","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-11-20","day",1500,null,"EUR","Libra Internet Bank SA","Finance, Insurance and Consulting",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20_11_2023&lang=ro","https://www.enforcementtracker.com/ETid-2124",null,null,null,null,"libra internet bank sa",null,null,null,null,null,null,null,null,null],["2023/ES/042","ETid-2125","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-20","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00523-2022.pdf","https://www.enforcementtracker.com/ETid-2125",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/038","ETid-2129","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-20","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00584-2022.pdf","https://www.enforcementtracker.com/ETid-2129",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/022","ETid-2190","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-20","day",200,null,"EUR",null,"Individuals and Private Associations","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00329-2023.pdf","https://www.enforcementtracker.com/ETid-2190",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/018","ETid-2204","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-20","day",200,null,"EUR",null,"Individuals and Private Associations","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00328-2023.pdf","https://www.enforcementtracker.com/ETid-2204",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DK/012","Datatilsynet (Denmark) - 2023-212-0015","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-11-17","day",null,null,null,"City of Copenhagen",null,"Art. 6(1)(e), Art. 6(3)","Unlawful processing",null,null,"https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/nov/udtalelse-om-behandlingsgrundlag-til-udvikling-og-drift-af-ai-loesning-inden-for-sundheds-og-omsorgsomraadet","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-212-0015",null,"gdprhub",null,null,"DK: city of copenhagen",null,null,null,null,null,null,null,null,null],["2023/ES/036","ETid-2133","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-17","day",72000,null,"EUR","Eurocollege Oxford English Institute S.L.","Public Sector and Education","Art. 5(1)(c), Art. 6(1), Art. 9(2)","Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00516-2022.pdf","https://www.enforcementtracker.com/ETid-2133",null,null,null,null,"eurocollege oxford english institute sl",null,null,null,null,null,null,null,null,null],["2023/ES/023","ETid-2189","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-17","day",4000,null,"EUR","LEADDESK, S.L","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00368-2023.pdf","https://www.enforcementtracker.com/ETid-2189",null,null,null,null,"leaddesk sl",null,null,null,null,null,null,null,null,null],["2023/ES/046","ETid-2119","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-16","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00601-2022.pdf","https://www.enforcementtracker.com/ETid-2119",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/045","ETid-2120","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-16","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00302-2023.pdf","https://www.enforcementtracker.com/ETid-2120",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/044","ETid-2121","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-16","day",20000,null,"EUR","FORO ASTURIAS","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00678-2022.pdf","https://www.enforcementtracker.com/ETid-2121",null,null,null,null,"ES: foro asturias",null,null,null,null,null,null,null,null,null],["2023/ES/043","ETid-2123","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-16","day",20000,null,"EUR","QUALITY-PROVIDER S.A.",null,"Art. 58(1), Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00030-2023.pdf","https://www.enforcementtracker.com/ETid-2123",null,null,null,null,"quality provider sa",null,null,null,null,null,null,null,null,null],["2023/PL/009","ETid-2151","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-11-16","day",3200,null,"EUR",null,null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DOKE.561.7.2023","https://www.enforcementtracker.com/ETid-2151",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/017","ETid-2154","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-16","day",100000,null,"EUR","Autostrade per l’Italia S.p.A.","Transportation and Energy","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9960854","https://www.enforcementtracker.com/ETid-2154",null,null,null,null,"autostrade per litalia spa",null,null,null,null,null,null,null,null,null],["2023/IT/016","ETid-2164","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-16","day",40000,null,"EUR","Amazon Italia Transport s.r.l.","Transportation and Energy","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9960875","https://www.enforcementtracker.com/ETid-2164","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9960875","gdprhub",null,null,"amazon italia transport srl","Amazon",null,null,null,null,null,null,null,null],["2023/IT/015","ETid-2165","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-16","day",18000,null,"EUR","Cluster S.r.l.","Health Care","Art. 32, Art. 5","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9960948","https://www.enforcementtracker.com/ETid-2165",null,null,null,null,"cluster srl",null,null,null,null,null,null,null,null,null],["2023/IT/012","ETid-2177","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-16","day",null,null,"EUR","Comune di Lonato del Garda","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9963453","https://www.enforcementtracker.com/ETid-2177",null,null,null,null,"IT: comune di lonato del garda",null,null,null,null,null,"annulled","The Garante removed this decision from its website after a final court judgment against it.","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9963453",20000],["2023/IT/011","ETid-2178","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-11-16","day",50000,null,"EUR","Comune di Castel Goffredo","Public Sector and Education","Art. 12, Art. 13, Art. 35, Art. 6","DPIA, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9963453","https://www.enforcementtracker.com/ETid-2178",null,null,null,null,"IT: comune di castel goffredo",null,null,null,null,null,null,null,null,null],["2023/IT/156","Garante per la protezione dei dati personali (Italy) - 9967845","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-11-16","day",null,null,null,"Editoriale Argo S.r.l.",null,"Art. 5(1)(a), Art. 5(1)(c)","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9967845","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9967845",null,"gdprhub",null,null,"editoriale argo srl",null,null,null,null,null,null,null,null,null],["2023/IT/155","Garante per la protezione dei dati personali (Italy) - 9968111","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-11-16","day",null,null,null,"Reti Televisive Italiane S.p.a.",null,"Art. 12, Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9968111","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9968111",null,"gdprhub",null,null,"reti televisive italiane spa",null,null,null,null,null,null,null,null,null],["2023/IT/159","Garante per la protezione dei dati personali (Italy) - 9973749","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-11-16","day",500,"500.00","EUR",null,null,"Art. 4(1), Art. 4(2), Art. 5(1)(c), Art. 58(2)(i), Art. 6(1)(c), Art. 6(1)(f), Art. 83","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9973749","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9973749",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IE/019","DPC (Ireland) - Microsoft Operations Ireland Limited","gdprhub","Ireland","IE","DPC (Ireland)","2023-11-15","day",null,null,null,"Microsoft Operations Ireland Limited",null,"Art. 12(4), Art. 17, Art. 58(2)(b)","Data subject rights, Transparency",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2023-12/13.12.2023%2520Microsoft%2520Ireland%2520Operations%2520Limited%2520Decision.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Microsoft_Operations_Ireland_Limited",null,"gdprhub",null,null,"microsoft operations ireland ltd","Microsoft",null,null,null,null,null,null,null,null],["2023/ES/047","ETid-2115","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-15","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00575-2022.pdf","https://www.enforcementtracker.com/ETid-2115",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DK/011","Datatilsynet (Denmark) - 2023-432-0022","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-11-14","day",null,null,null,"Rigsrevisionen",null,"Art. 5(1)(c), Art. 6(1)(e), Art. 9(2)(g)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/nov/rigsrevisionens-tilvejebringelse-af-oplysninger-sker-inden-for-rammerne-af-databeskyttelsesreglerne","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-432-0022",null,"gdprhub",null,null,"DK: rigsrevisionen",null,null,null,null,null,null,null,null,null],["2023/ES/050","ETid-2102","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-13","day",1000,null,"EUR","TRACTAMENT D'AIGUES TEIA, S.L.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00198-2023.pdf","https://www.enforcementtracker.com/ETid-2102",null,null,null,null,"tractament d aigues teia sl",null,null,null,null,null,null,null,null,null],["2023/RO/006","ETid-2112","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-11-13","day",110000,null,"EUR","Rompetrol Downstream SRL","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_13_11_2023&lang=ro","https://www.enforcementtracker.com/ETid-2112",null,null,null,null,"rompetrol downstream srl",null,null,null,null,null,null,null,null,null],["2023/ES/016","ETid-2214","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-13","day",200000,null,"EUR","CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00178-2023.pdf","https://www.enforcementtracker.com/ETid-2214",null,null,null,null,"caixabank payments and consumer efc ep sau","CaixaBank",null,null,null,null,null,null,null,null],["2023/GR/033","HDPA (Greece) - 52/2024","gdprhub","Greece","GR","HDPA (Greece)","2023-11-13","day",10000,"10,000","EUR","WEDOO Digital Agency",null,"Art. 58(1)(a), Art. 58(2)(b), Art. 83",null,null,"Violation found","https://www.dpa.gr/sites/default/files/2024-12/52_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_52/2024",null,"gdprhub",null,null,"GR: wedoo digital agency",null,null,null,null,null,null,null,null,null],["2023/SI/006","IP (Slovenia) - SI – 07101-5-2023-16","gdprhub","Slovenia","SI","IP (Slovenia)","2023-11-13","day",null,null,null,null,null,"Art. 15(1)","Data subject rights",null,"Violation found","https://gdprhub.eu/index.php?title=File:07101-5-2023-16_odlo%C4%8Dba_po_34._%C4%8Dlenu_ZVOP-2_in_27._%C4%8Dlenu_ZVOPOKD_delno_ugodeno_03112023.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_SI_%E2%80%93_07101-5-2023-16",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/046","APD/GBA (Belgium) - 149/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-11-10","day",null,null,null,null,null,"Art. 12, Art. 12(1), Art. 13(1)(a), Art. 13(1)(c), Art. 13(2), Art. 5(1)(a), Art. 6, Art. 7(3)","Consent, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-149-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_149/2023",null,"gdprhub","Madame X1 and Monsieur X2; Société Y1 and Société Y2 (or 'Platform Z')",null,null,null,null,null,null,null,null,null,null,null],["2023/GR/002","ETid-2147","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-11-10","day",20000,null,"EUR","Piraeus Leasing S.M.S.A.","Finance, Insurance and Consulting","Art. 15, Art. 5(1)","Data principles, Data subject rights","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelias-fysikoy-prosopoy-kata-etaireias-gia-epexergasia","https://www.enforcementtracker.com/ETid-2147","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_34/2023","gdprhub",null,null,"piraeus leasing smsa",null,null,null,null,null,null,null,null,null],["2023/FR/018","CNIL (France) - SAN-2023-016","gdprhub","France","FR","CNIL (France)","2023-11-09","day",null,null,null,"Ministry of Economy, Finance and Industrial and Digital Sovereignty",null,"Art. 5(1)(b)","Data principles",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048388493?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-016",null,"gdprhub",null,null,"FR: ministry of economy finance and industrial and digital sovereignty",null,null,null,null,null,null,null,null,null],["2023/DK/014","Datatilsynet (Denmark) - 2023-432-0025","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-11-09","day",null,null,null,"Digitaliseringsstyrelsens",null,"Art. 24(1), Art. 32(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/nov/digitaliseringsstyrelsen-faar-kritik-for-utilstraekkelig-risikovurdering","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2023-432-0025",null,"gdprhub",null,null,"DK: digitaliseringsstyrelsens",null,null,null,null,null,null,null,null,null],["2023/DK/010","Datatilsynet (Denmark) - 2022-432-0099","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-11-08","day",null,null,null,"Digitaliseringsstyrelsen",null,"Art. 5(1)(c), Art. 58(2)(b), Art. 58(2)(f)","Data principles",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/nov/digitaliseringsstyrelsen-behandler-for-mange-personoplysninger-i-sin-administration-af-det-digitale-koerekort-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2022-432-0099",null,"gdprhub",null,null,"DK: digitaliseringsstyrelsen",null,null,null,null,null,null,null,null,null],["2023/GR/027","HDPA (Greece) - 35/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-11-08","day",null,"60.0000","EUR",null,null,"Art. 24(1), Art. 33(1), Art. 34(1), Art. 4(12), Art. 5(1)","Accountability, Data breach, Data principles",null,"Violation found","https://www.dpa.gr/sites/default/files/2023-12/35_2023%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_35/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/054","ETid-2097","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-07","day",70000,null,"EUR","THE BEE LOGISTICS, S.L.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00272-2023.pdf","https://www.enforcementtracker.com/ETid-2097",null,null,null,null,"the bee logistics sl",null,null,null,null,null,null,null,null,null],["2023/SE/002","ETid-2103","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-11-07","day",43000,null,"EUR","Indcap AB","Finance, Insurance and Consulting","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/nyheter/sanktionsavgift-mot-bolag-som-skickat-kunduppgifter-fel/","https://www.enforcementtracker.com/ETid-2103",null,null,null,null,"indcap ab",null,null,null,null,null,null,null,null,null],["2023/GR/003","ETid-2146","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-11-07","day",5000,null,"EUR","Municipality","Public Sector and Education","Art. 17, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/kataggelia-kata-dimoy-gia-parabiasi-prosopikon-dedomenon-sti-diaygeia-kai","https://www.enforcementtracker.com/ETid-2146",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/029","ETid-2161","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-07","day",600,null,"EUR","Store owner",null,"Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00340-2023.pdf","https://www.enforcementtracker.com/ETid-2161",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/028","ETid-2162","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-07","day",1000,null,"EUR","Homeowners' association","Real Estate","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00277-2023.pdf","https://www.enforcementtracker.com/ETid-2162",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/AT/019","DSB (Austria) - DSB-D124.0701/23","gdprhub","Austria","AT","DSB (Austria)","2023-11-06","day",null,null,null,"Marktgemeinde N.",null,"Art. 26(1), Art. 4(7), Art. 5(1)(a), Art. 6(1)(a), Art. 6(1)(c)","Data principles, Unlawful processing",null,"Violation found","https://www.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231106_2023_0_772_005_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.0701/23",null,"gdprhub",null,null,"AT: marktgemeinde n",null,null,null,null,null,null,null,null,null],["2023/ES/055","ETid-2096","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-06","day",240,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00577-2022.pdf","https://www.enforcementtracker.com/ETid-2096",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/053","ETid-2098","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-06","day",200000,null,"EUR","DIGI SPAIN TELECOM, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00317-2023.pdf","https://www.enforcementtracker.com/ETid-2098",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/ES/052","ETid-2099","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-06","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00082-2023.pdf","https://www.enforcementtracker.com/ETid-2099",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/051","ETid-2100","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-06","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00013-2023.pdf","https://www.enforcementtracker.com/ETid-2100",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/056","ETid-2094","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-03","day",600,null,"EUR","Hotel","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00630-2022.pdf","https://www.enforcementtracker.com/ETid-2094",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/007","ETid-2101","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-11-03","day",3000,null,"EUR","OTP BANK ROMANIA SA","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_03_11_2023&lang=ro","https://www.enforcementtracker.com/ETid-2101",null,null,null,null,"otp bank romania sa",null,null,null,null,null,null,null,null,null],["2023/ES/027","ETid-2163","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-03","day",600,null,"EUR","Homeowners' association","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00225-2023.pdf","https://www.enforcementtracker.com/ETid-2163",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/005","ETid-2283","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-03","day",2000,null,"EUR","SINDICATO LIBRE DE TRANSPORTES","Individuals and Private Associations","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00270-2023.pdf","https://www.enforcementtracker.com/ETid-2283",null,null,null,null,"ES: sindicato libre de transportes",null,null,null,null,null,null,null,null,null],["2023/ES/048","ETid-2106","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-02","day",30000,null,"EUR","APOLLONIA TOPCO, S.L.",null,"Art. 38, Art. 5(1)(c)","Data principles, Data protection officer","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00253-2023.pdf","https://www.enforcementtracker.com/ETid-2106",null,null,null,null,"apollonia topco sl",null,null,null,null,null,null,null,null,null],["2023/NL/008","ETid-2132","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2023-11-02","day",30000,null,"EUR","Voorschoten municipality","Public Sector and Education","Art. 5(1)(a), Art. 6(1)(e)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://autoriteitpersoonsgegevens.nl/actueel/boete-van-30000-euro-voor-gemeente-voorschoten","https://www.enforcementtracker.com/ETid-2132",null,null,null,null,"NL: voorschoten municipality",null,null,null,null,null,null,null,null,null],["2023/ES/006","ETid-2279","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-11-02","day",48000,null,"EUR","INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P.","Health Care","Art. 32, Art. 34, Art. 5(1)(f)","Data breach, Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00529-2022.pdf","https://www.enforcementtracker.com/ETid-2279",null,null,null,null,"institut marques obstetricia i ginecologia slp",null,null,null,null,null,null,null,null,null],["2023/ES/060","ETid-2090","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-31","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00267-2023.pdf","https://www.enforcementtracker.com/ETid-2090",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/011","ETid-2219","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-31","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00262-2023.pdf","https://www.enforcementtracker.com/ETid-2219",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/062","ETid-2078","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-30","day",240,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00625-2022.pdf","https://www.enforcementtracker.com/ETid-2078",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/BE/042","APD/GBA (Belgium) - 137/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-10-29","day",null,null,null,null,null,"Art. 12(1), Art. 14, Art. 14(5)(c), Art. 28(1), Art. 28(3)","Processor obligations, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-137-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_137/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/033","ETid-2150","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-28","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00259-2023.pdf","https://www.enforcementtracker.com/ETid-2150",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/EU/002","EDPB - Urgent Binding Decision 01/2023","gdprhub","European Union","EU","EDPB","2023-10-27","day",null,null,null,"Meta Platfroms Ireland Ltd",null,"Art. 58(2)(f), Art. 6(1)(b), Art. 6(1)(f), Art. 60, Art. 61, Art. 66, Art. 66(2)","Unlawful processing",null,null,"https://edpb.europa.eu/system/files/2023-12/edpb_urgentbindingdecision_202301_no_metaplatformsireland_en_0.pdf","https://gdprhub.eu/index.php?title=EDPB_-_Urgent_Binding_Decision_01/2023",null,"gdprhub",null,null,"meta platfroms ireland ltd",null,null,null,null,null,null,null,null,null],["2023/RO/008","ETid-2089","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-10-27","day",500,null,"EUR","Homeowners Association","Individuals and Private Associations","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_27_10_2023&lang=ro","https://www.enforcementtracker.com/ETid-2089",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/044","APD/GBA (Belgium) - 145/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-10-26","day",null,null,null,null,null,"Art. 4(1), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-145-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_145/2023",null,"gdprhub",null,"College",null,null,null,null,null,null,null,null,null,null],["2023/IT/018","ETid-2149","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-10-26","day",20000,null,"EUR","Region of Lombardy","Public Sector and Education","Art. 5, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9955372","https://www.enforcementtracker.com/ETid-2149","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9955372","gdprhub",null,null,"IT: region of lombardy",null,null,null,null,null,null,null,null,null],["2023/ES/031","ETid-2157","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-26","day",500,null,"EUR","UPMOBILE SOLUTIONS, S.L.","Media, Telecoms and Broadcasting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00304-2023.pdf","https://www.enforcementtracker.com/ETid-2157",null,null,null,null,"upmobile solutions sl",null,null,null,null,null,null,null,null,null],["2023/IT/013","ETid-2176","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-10-26","day",1000,null,"EUR","Homeowner administrator","Real Estate","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9960920","https://www.enforcementtracker.com/ETid-2176","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9960920","gdprhub",null,null,"IT: homeowner administrator",null,null,null,null,null,null,null,null,null],["2023/ES/014","ETid-2216","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-26","day",5000000,null,"EUR","CAIXABANK, S.A.","Finance, Insurance and Consulting","Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00020-2023.pdf","https://www.enforcementtracker.com/ETid-2216",null,null,null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2023/ES/004","ETid-2291","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-26","day",7000,null,"EUR","Ophthalmologic institute","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00122-2023.pdf","https://www.enforcementtracker.com/ETid-2291","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202206316","gdprhub",null,null,"ES: ophthalmologic institute",null,null,null,null,null,null,null,null,null],["2023/IT/150","Garante per la protezione dei dati personali (Italy) - 9954241","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-10-26","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9954241","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9954241",null,"gdprhub",null,"Researcher",null,null,null,null,null,"person",null,null,null,null],["2023/IT/149","Garante per la protezione dei dati personali (Italy) - 9955735","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-10-26","day",20000,"20,000","EUR","Edizioni Proposta Sud S.r.l.",null,"Art. 12, Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(d)","Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9955735","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9955735",null,"gdprhub",null,null,"edizioni proposta sud srl",null,null,null,null,null,null,null,null,null],["2023/IT/151","Garante per la protezione dei dati personali (Italy) - 9963509","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-10-26","day",null,null,null,"Azienda Ospedaliero Universitaria Città della Salute e della Scienza di Torino",null,"Art. 14, Art. 35, Art. 36, Art. 5, Art. 6, Art. 89(1), Art. 9(1), Art. 9(2)(j), Art. 9(4)","DPIA, Data principles, Special categories, Transparency, Unlawful processing",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9963509","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9963509",null,"gdprhub",null,null,"IT: azienda ospedaliero universitaria citta della salute e della scienza di torino",null,null,null,null,null,null,null,null,null],["2023/IT/154","Garante per la protezione dei dati personali (Italy) - 9964761","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-10-26","day",10000,"10,000","EUR","A.C. Group S.r.l.s.",null,"Art. 12, Art. 13, Art. 14, Art. 24, Art. 5(1)(a), Art. 5(2), Art. 6(1)(a), Art. 7","Accountability, Consent, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9964761","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9964761",null,"gdprhub",null,null,"ac group srls",null,null,null,null,null,null,null,null,null],["2023/GR/032","HDPA (Greece) - 41/2024","gdprhub","Greece","GR","HDPA (Greece)","2023-10-26","day",3000,"3000","EUR","Private tutorial centre",null,"Art. 12(1), Art. 12(3), Art. 12(4), Art. 15(1), Art. 31","Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-12/41_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_41/2024",null,"gdprhub",null,null,"GR: private tutorial centre",null,null,null,null,null,null,null,null,null],["2023/SI/007","IP (Slovenia) - 0603-46/2023/13","gdprhub","Slovenia","SI","IP (Slovenia)","2023-10-26","day",null,null,null,null,null,"Art. 13","Transparency",null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2023/October/Oktober_2023-Odlocbe-ZP.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0603-46/2023/13",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/061","ETid-2079","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-25","day",500,null,"EUR","BILBAO AD INFINITUM, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00300-2023.pdf","https://www.enforcementtracker.com/ETid-2079",null,null,null,null,"bilbao ad infinitum sl",null,null,null,null,null,null,null,null,null],["2023/RO/009","ETid-2088","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-10-25","day",1000,null,"EUR","SC Spark Car Sharing SRL","Transportation and Energy","Art. 6(1), Art. 7","Consent, Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_25_10_2023&lang=ro","https://www.enforcementtracker.com/ETid-2088",null,null,null,null,"spark car sharing srl",null,null,null,null,null,null,null,null,null],["2023/ES/010","ETid-2220","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-25","day",6100000,null,"EUR","ENDESA ENERGÍA, S.A.U.","Transportation and Energy","Art. 32, Art. 33, Art. 34, Art. 44, Art. 5(1)(f)","Data breach, Data principles, Data security, International transfers","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00002-2023.pdf","https://www.enforcementtracker.com/ETid-2220",null,null,null,null,"endesa energia sau",null,null,null,null,null,null,null,null,null],["2023/SI/008","IP (Slovenia) - 07100-17-2023-7","gdprhub","Slovenia","SI","IP (Slovenia)","2023-10-25","day",null,null,null,null,null,null,null,null,"Violation found","https://gdprhub.eu/index.php?title=File:07100-17-2023-7_odlo%C4%8Dba_34._%C4%8Dlen_ZVOP-2_kr%C5%A1itev_brez_ukrepa_25102023.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07100-17-2023-7",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/010","ETid-2086","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-10-24","day",3000,null,"EUR","Mensajero SRL","Industry and Commerce","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_24_10_2023&lang=ro","https://www.enforcementtracker.com/ETid-2086",null,null,null,null,"mensajero srl",null,null,null,null,null,null,null,null,null],["2023/SI/010","IP (Slovenia) - 0603-47/2023/5","gdprhub","Slovenia","SI","IP (Slovenia)","2023-10-24","day",null,"n/a","EUR",null,null,null,null,null,"Violation found","https://gdprhub.eu/images/5/56/0603-47-2023-5_odlocba_po_ZP-1_globa_stek_76%2C_78_in_80_clen_ZVOP-2_24102023.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0603-47/2023/5",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/CY/015","Commissioner (Cyprus) - 11.17.001.010.172","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2023-10-23","day",null,null,null,null,null,"Art. 12(3), Art. 56","Transparency",null,"Violation found","https://www.dataprotection.gov.cy/DATAPROTECTION/DATAPROTECTION.NSF/F880C7270072D4E0C2258AAE0049CEAB/$file/%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20Brivio.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.010.172",null,"gdprhub",null,"Operator of a website",null,null,null,null,null,null,null,null,null,null],["2023/ES/032","ETid-2156","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-23","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00286-2023.pdf","https://www.enforcementtracker.com/ETid-2156",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/013","ETid-2217","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-23","day",50000,null,"EUR","Oney Servicios Financieros E.F.C.","Finance, Insurance and Consulting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00053-2023.pdf","https://www.enforcementtracker.com/ETid-2217",null,null,null,null,"oney servicios financieros efc",null,null,null,null,null,null,null,null,null],["2023/RO/012","ETid-2074","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-10-20","day",1000,null,"EUR","DANTE INTERNATIONAL SA","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20_10_2023&lang=ro","https://www.enforcementtracker.com/ETid-2074",null,null,null,null,"dante international sa",null,null,null,null,null,null,null,null,null],["2023/ES/059","ETid-2091","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-20","day",800000,null,"EUR","BANCO BILBAO VIZCAYA ARGENTARIA, S.A.","Finance, Insurance and Consulting","Art. 25, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00677-2022.pdf","https://www.enforcementtracker.com/ETid-2091",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2023/ES/030","ETid-2158","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-19","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00156-2023.pdf","https://www.enforcementtracker.com/ETid-2158",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/058","ETid-2092","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-18","day",2000,null,"EUR","UNIQUE HOTEL APARTMENT S.L.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00331-2023.pdf","https://www.enforcementtracker.com/ETid-2092",null,null,null,null,"unique hotel apartment sl",null,null,null,null,null,null,null,null,null],["2023/ES/057","ETid-2093","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-18","day",600,null,"EUR","FESTINA LOTUS S.A.","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/documento/ps-00185-2023.pdf","https://www.enforcementtracker.com/ETid-2093",null,null,null,null,"festina lotus sa",null,null,null,null,null,null,null,null,null],["2023/PL/002","ETid-2254","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-10-18","day",24000,null,"EUR","Insurance company","Finance, Insurance and Consulting","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.55.2022","https://www.enforcementtracker.com/ETid-2254",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/SE/003","ETid-2070","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-10-17","day",30000,null,"EUR","H&M Hennes & Mauritz GBC AB","Industry and Commerce","Art. 12(3), Art. 21(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-hm-klagomal.pdf","https://www.enforcementtracker.com/ETid-2070",null,null,null,null,"h and m hennes and mauritz gbc ab",null,null,null,null,null,null,null,null,null],["2023/GR/029","HDPA (Greece) - 13/2024","gdprhub","Greece","GR","HDPA (Greece)","2023-10-17","day",175000,"175,000","EUR","Ministry of Migration and Asylum",null,"Art. 12, Art. 13, Art. 14, Art. 22, Art. 24, Art. 25(1), Art. 28, Art. 30, Art. 31, Art. 35, Art. 37, Art. 38, Art. 39, Art. 5(1)(a), Art. 55, Art. 83","Accountability, DPIA, Data principles, Data protection officer, Data subject rights, Processor obligations, Transparency",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/aytepaggelti-ereyna-gia-tin-anaptyxi-kai-egkatastasi-ton-programmaton","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_13/2024",null,"gdprhub",null,null,"GR: ministry of migration and asylum",null,null,null,null,null,null,null,null,null],["2023/BE/047","APD/GBA (Belgium) - 141/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-10-16","day",null,null,null,null,null,"Art. 5(2)","Data principles",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-141-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_141/2023",null,"gdprhub",null,"Political party",null,null,null,null,null,null,null,null,null,null],["2023/ES/063","ETid-2069","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-15","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00209-2023.pdf","https://www.enforcementtracker.com/ETid-2069",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/EE/003","AKI (Estonia) - 12.10.2023","gdprhub","Estonia","EE","AKI (Estonia)","2023-10-12","day",null,null,null,null,null,"Art. 44, Art. 60","International transfers",null,"Violation found","https://wiki.noyb.eu/images/e/ea/FDA60_Allepal_-_redacted.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_12.10.2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/FR/006","ETid-2072","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-10-12","day",600000,null,"EUR","GROUPE CANAL +","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 14, Art. 15, Art. 28, Art. 32, Art. 33, Art. 7(1)","Consent, Data breach, Data security, Data subject rights, Processor obligations, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/prospection-commerciale-et-droits-des-personnes-sanction-de-600-000-euros-lencontre-du-groupe-canal","https://www.enforcementtracker.com/ETid-2072","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-015","gdprhub",null,null,"FR: groupe canal",null,null,null,null,null,null,null,null,null],["2023/IT/024","ETid-2110","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-10-12","day",70000,null,"EUR","Scionti Selezioni Superiori S.r.l.","Industry and Commerce","Art. 12, Art. 13, Art. 15, Art. 21, Art. 25, Art. 5(1)(a), Art. 5(2), Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9949032","https://www.enforcementtracker.com/ETid-2110","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9949453","gdprhub",null,null,"scionti selezioni superiori srl",null,null,null,null,null,null,null,null,null],["2023/IT/019","ETid-2145","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-10-12","day",40000,null,"EUR","Azienda socio sanitaria territoriale di Lodi CF","Health Care","Art. 32, Art. 9","Data principles, Data security, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9954220","https://www.enforcementtracker.com/ETid-2145",null,null,null,null,"IT: azienda socio sanitaria territoriale di lodi cf",null,null,null,null,null,null,null,null,null],["2023/IT/147","Garante per la protezione dei dati personali (Italy) - 9949494","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-10-12","day",null,null,null,null,null,"Art. 2(2)(c), Art. 5(1), Art. 58(2)(b), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9949494","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9949494",null,"gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/281","AEPD (Spain) - EXP202307481","gdprhub","Spain","ES","AEPD (Spain)","2023-10-11","day",null,null,null,"CaixaBank S.A.",null,"Art. 60",null,null,"Rejected","https://gdprhub.eu/images/2/20/AEPD_AI002892023_redacted.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202307481",null,"gdprhub",null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2023/ES/065","ETid-2064","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-11","day",5300,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00621-2022.pdf","https://www.enforcementtracker.com/ETid-2064",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/064","ETid-2065","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-11","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00112-2023.pdf","https://www.enforcementtracker.com/ETid-2065",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/GR/005","ETid-2116","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-10-11","day",1000,null,"EUR",null,null,"Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/prostimo-gia-parabiasi-tis-arhis-tis-elahistopoiisis","https://www.enforcementtracker.com/ETid-2116","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_31/2023","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/034","ETid-2143","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-11","day",500,null,"EUR","ALBEN AIRPORT FACILITIES S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/documento/ps-00245-2023.pdf","https://www.enforcementtracker.com/ETid-2143",null,null,null,null,"alben airport facilities sl",null,null,null,null,null,null,null,null,null],["2023/ES/069","ETid-2055","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-10","day",15000,null,"EUR","ILUNION SEGURIDAD, S.A.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00452-2022.pdf","https://www.enforcementtracker.com/ETid-2055",null,null,null,null,"ilunion seguridad sa",null,null,null,null,null,null,null,null,null],["2023/ES/068","ETid-2056","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-10","day",1500,null,"EUR","NORDETIA CLINICS MÓSTOLES S.L.","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00633-2022.pdf","https://www.enforcementtracker.com/ETid-2056",null,null,null,null,"nordetia clinics mostoles sl",null,null,null,null,null,null,null,null,null],["2023/ES/067","ETid-2057","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-09","day",4000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00519-2022.pdf","https://www.enforcementtracker.com/ETid-2057",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/066","ETid-2058","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-09","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00067-2023.pdf","https://www.enforcementtracker.com/ETid-2058",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/PL/010","ETid-2138","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-10-08","day",24000,null,"EUR","Link4 Towarzystwo Ubezpieczeń S. A.","Finance, Insurance and Consulting","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/pl/138/2916","https://www.enforcementtracker.com/ETid-2138",null,null,null,null,"link4 towarzystwo ubezpieczen sa",null,null,null,null,null,null,null,null,null],["2023/AT/027","DSB (Austria) - DSB-D124.5337","gdprhub","Austria","AT","DSB (Austria)","2023-10-06","day",null,null,null,"newspaper company (first controller) and broadcasting company (second controller)",null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(1)(g), Art. 15(3), Art. 17(1), Art. 17(3), Art. 17(3)(a), Art. 17(3)(e), Art. 5(1)(b), Art. 58(2)(c), Art. 6(1), Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231006_2023_0_273_912_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.5337",null,"gdprhub",null,null,"AT: newspaper company and broadcasting company",null,null,null,null,null,"confirmed","Confirmed in court: the Federal Administrative Court rejected all the appeals (6 June 2024).","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20231006_2023_0_273_912_00",null],["2023/ES/070","ETid-2049","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-10-05","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00685-2022.pdf","https://www.enforcementtracker.com/ETid-2049",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/HR/001","ETid-2063","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2023-10-05","day",5470000,null,"EUR","Debt collection company","Finance, Insurance and Consulting","Art. 12(1), Art. 13(1), Art. 32(1)(b), Art. 5(2), Art. 6(1)","Data principles, Data security, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/debt-collection-agency-eos-matrix-d-o-o-imposed-with-administrative-fine-in-the-amount-of-5-47-million-euros/","https://www.enforcementtracker.com/ETid-2063","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_05-10-2023","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/CY/012","Commissioner (Cyprus) - 11.17.001.010.007","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2023-10-04","day",null,null,null,null,null,"Art. 15(3), Art. 34(1), Art. 5(1)(c), Art. 56, Art. 58(2)(b), Art. 60","Data breach, Data principles, Data subject rights",null,"Violation found","https://www.dataprotection.gov.cy/DATAPROTECTION/DATAPROTECTION.NSF/F880C7270072D4E0C2258AAE0049CEAB/$file/%25CE%2591%25CE%25A0%25CE%259F%25CE%25A6%25CE%2591%25CE%25A3%25CE%2597%2520Technious.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.010.007",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/SE/004","ETid-2067","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2023-10-03","day",70000,null,"EUR","Schockholm School borard","Public Sector and Education","Art. 13, Art. 6(1)","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-aspuddens-skola.pdf","https://www.enforcementtracker.com/ETid-2067",null,null,null,null,"SE: schockholm school borard",null,null,null,null,null,null,null,null,null],["2023/RO/011","ETid-2081","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-10-02","day",1000,null,"EUR","Cez Vânzare S.A.","Transportation and Energy","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_02_10_2023&lang=ro","https://www.enforcementtracker.com/ETid-2081",null,null,null,null,"cez vanzare sa",null,null,null,null,null,null,null,null,null],["2023/BE/043","APD/GBA (Belgium) - 136/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-09-28","day",null,null,null,null,null,"Art. 12(1), Art. 12(2), Art. 12(6), Art. 13(1), Art. 13(2), Art. 14(1), Art. 14(2), Art. 24(1), Art. 25(1), Art. 25(2), Art. 30(1), Art. 38(3), Art. 5(1)(a), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data protection officer, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-136-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_136/2023",null,"gdprhub",null,"Flemish municipality",null,null,null,null,null,null,null,null,null,null],["2023/IE/018","DPC (Ireland) - Inquiry into Airbnb Ireland UC - 28 September 2023","gdprhub","Ireland","IE","DPC (Ireland)","2023-09-28","day",null,null,null,"AirBnb Ireland UC",null,"Art. 13(1)(c), Art. 13(1)(d), Art. 17(1), Art. 5(1)(c), Art. 5(1)(e), Art. 58(2)(d), Art. 6(1)(f), Art. 60","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/en/resources/law/decisions/inquiry-airbnb-ireland-uc-28-september-2023","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Inquiry_into_Airbnb_Ireland_UC_-_28_September_2023",null,"gdprhub",null,null,"airbnb ireland uc","Airbnb",null,null,null,null,null,null,null,null],["2023/DK/009","Datatilsynet (Denmark) - 2021-431-0163","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-09-28","day",null,null,null,"Mindworking A/S",null,"Art. 32(1), Art. 58(2)(b)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/sep/databehandler-faar-kritik-for-manglende-sikkerhed-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0163",null,"gdprhub",null,null,"mindworking as",null,null,null,null,null,null,null,null,null],["2023/IT/035","ETid-2077","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-28","day",10000000,null,"EUR","Axpo Italia Spa","Transportation and Energy","Art. 24(2), Art. 5(2)","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9943230","https://www.enforcementtracker.com/ETid-2077",null,null,null,null,"axpo italia spa",null,null,null,null,null,null,null,null,null],["2023/IT/034","ETid-2080","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-28","day",30000,null,"EUR","Asl Napoli 3 Sud","Health Care","Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9943230#2","https://www.enforcementtracker.com/ETid-2080",null,null,null,null,"IT: asl napoli 3 sud",null,null,null,null,null,null,null,null,null],["2023/IT/029","ETid-2095","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-28","day",5000,null,"EUR","Physician","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9946712","https://www.enforcementtracker.com/ETid-2095",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/028","ETid-2105","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-28","day",3000,null,"EUR","Palombaro s.r.l.","Accommodation and Hospitality","Art. 13, Art. 5","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9947496","https://www.enforcementtracker.com/ETid-2105",null,null,null,null,"palombaro srl",null,null,null,null,null,null,null,null,null],["2023/IT/027","ETid-2107","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-28","day",60000,null,"EUR","Salvator Mundi International Hospital s.r.l","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9946369","https://www.enforcementtracker.com/ETid-2107",null,null,null,null,"salvator mundi international hospital srl",null,null,null,null,null,null,null,null,null],["2023/IT/026","ETid-2108","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-28","day",50000,null,"EUR","Azienda Usl Toscana centro","Health Care","Art. 32","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9946386","https://www.enforcementtracker.com/ETid-2108",null,null,null,null,"IT: azienda usl toscana centro",null,null,null,null,null,null,null,null,null],["2023/IT/025","ETid-2109","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-28","day",5000,null,"EUR","Ministero dell'Ambiente e della Sicurezza Energetica","Public Sector and Education","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9944603","https://www.enforcementtracker.com/ETid-2109",null,null,null,null,"IT: ministero dell ambiente e della sicurezza energetica",null,null,null,null,null,null,null,null,null],["2023/ES/072","ETid-2043","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-27","day",420,null,"EUR","CHINA CENTER LLEIDA","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00693-2022.pdf","https://www.enforcementtracker.com/ETid-2043",null,null,null,null,"ES: china center lleida",null,null,null,null,null,null,null,null,null],["2023/FI/014","Tietosuojavaltuutetun toimisto (Finland) - 6629/163/21","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-09-27","day",null,null,null,null,null,"Art. 12(2), Art. 15, Art. 58(2)(b), Art. 58(2)(d)","Data subject rights, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2023/20232043","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6629/163/21",null,"gdprhub",null,"Healthcare provider",null,null,null,null,null,null,null,null,null,null],["2023/ES/074","ETid-2041","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-26","day",30000,null,"EUR","EUROPA PRESS DE CATALUNYA, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00249-2023.pdf","https://www.enforcementtracker.com/ETid-2041",null,null,null,null,"europa press de catalunya sa",null,null,null,null,null,null,null,null,null],["2023/ES/073","ETid-2042","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-26","day",70000,null,"EUR","DIGI SPAIN TELECOM, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00064-2023.pdf","https://www.enforcementtracker.com/ETid-2042",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/RO/014","ETid-2045","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-09-26","day",25000,null,"EUR","RESTART ENERGY ONE S.A.","Transportation and Energy","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_26_09_2023&lang=ro","https://www.enforcementtracker.com/ETid-2045",null,null,null,null,"restart energy one sa",null,null,null,null,null,null,null,null,null],["2023/HR/004","ETid-2060","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2023-09-26","day",15000,null,"EUR","Hotel","Accommodation and Hospitality","Art. 32(4), Art. 38(6), Art. 6(1)","Data protection officer, Data security, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/upravna-novcana-kazna-u-iznosu-od-15-000-eura-izrecena-hotelu/","https://www.enforcementtracker.com/ETid-2060","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_26-09-2023","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/AT/003","ETid-2130","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2023-09-26","day",10000,null,"EUR","Phyisician","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20230629_2023_0_420_407_00/DSBT_20230629_2023_0_420_407_00.html","https://www.enforcementtracker.com/ETid-2130",null,null,null,null,"AT: phyisician",null,null,null,null,null,null,null,null,null],["2023/CZ/005","ETid-2827","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2023-09-26","day",1040,null,"EUR","Self Employed Person","Individuals and Private Associations",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/125-cj-uoou-0066722-11-dokument-c-125.pdf","https://www.enforcementtracker.com/ETid-2827",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/075","ETid-2040","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-25","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00695-2022.pdf","https://www.enforcementtracker.com/ETid-2040","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202209001","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/RO/013","ETid-2046","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-09-25","day",2000,null,"EUR","UAT Comuna Albeni","Public Sector and Education",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_25.09.2023&lang=ro","https://www.enforcementtracker.com/ETid-2046",null,null,null,null,"RO: uat comuna albeni",null,null,null,null,null,null,null,null,null],["2023/ES/071","ETid-2048","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-25","day",17000,null,"EUR","FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA","Public Sector and Education","Art. 13, Art. 9","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00265-2022.pdf","https://www.enforcementtracker.com/ETid-2048","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202105680","gdprhub",null,null,"ES: federacion de balonmano de castilla la mancha",null,null,null,null,null,null,null,null,null],["2023/GR/004","ETid-2117","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-09-25","day",50000,null,"EUR","Athens Urban Transport Organization","Transportation and Energy","Art. 25(1), Art. 35(1), Art. 5(1)(e)","Accountability, DPIA, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/prostimo-ston-oasa-gia-epexergasia-dedomenon-sto-plaisio-toy-ilektronikoy","https://www.enforcementtracker.com/ETid-2117","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_30/2023","gdprhub",null,null,"GR: athens urban transport organization",null,null,null,null,null,null,null,null,null],["2023/RO/052","ANSPDCP (Romania) - 23.08.2023","gdprhub","Romania","RO","ANSPDCP (Romania)","2023-09-23","day",null,"10,000","RON","BODY LINE SRL",null,"Art. 17, Art. 32, Art. 5, Art. 6, Art. 9","Data principles, Data security, Data subject rights, Special categories, Unlawful processing",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_23.08.2023&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_23.08.2023",null,"gdprhub",null,null,"body line srl",null,10000.0,2013,"day 2023-09-22|4.9686|RON",null,null,null,null,null],["2023/ES/049","ETid-2104","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-23","day",12000,null,"EUR","CHATWITH.IO WORLDWIDE, S.L.","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00080-2023.pdf","https://www.enforcementtracker.com/ETid-2104",null,null,null,null,"chatwith io worldwide sl",null,null,null,null,null,null,null,null,null],["2023/BE/041","APD/GBA (Belgium) - 135/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-09-21","day",null,null,null,null,null,"Art. 13(1)(c), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-135-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_135/2023",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/ES/079","ETid-2034","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-21","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00543-2022.pdf","https://www.enforcementtracker.com/ETid-2034",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/078","ETid-2035","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-21","day",4000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00466-2022.pdf","https://www.enforcementtracker.com/ETid-2035",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/LU/001","ETid-2122","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2023-09-21","day",2500,null,"EUR",null,"Employment","Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2023/dcision-13fr-2023-sous-forme-anonymise.pdf","https://www.enforcementtracker.com/ETid-2122","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_13FR/2023","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/035","BlnBDI (Berlin) - 521.14877.15","gdprhub","Germany","DE","BlnBDI (Berlin)","2023-09-19","day",null,null,null,null,null,"Art. 7","Consent",null,"Violation found","https://wiki.noyb.eu/images/2/26/Abschlussnachricht_NOYB_mirapodo.pdf","https://gdprhub.eu/index.php?title=BlnBDI_%28Berlin%29_-_521.14877.15",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/AT/012","DSB (Austria) - D130.1170","gdprhub","Austria","AT","DSB (Austria)","2023-09-19","day",null,null,null,"Briggs & Stratton LLC",null,"Art. 17, Art. 19, Art. 7(3)","Consent, Data subject rights",null,"Violation found","https://wiki.noyb.eu/index.php?title=File:DSB_briggs_cookies_REDACTED.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D130.1170",null,"gdprhub",null,null,"briggs and stratton llc",null,null,null,null,null,null,null,null,null],["2023/AT/013","DSB (Austria) - D130.1178 2023-0.631.894","gdprhub","Austria","AT","DSB (Austria)","2023-09-19","day",null,null,null,"Hearst Magazine Media, Inc.",null,"Art. 17, Art. 19, Art. 7(3)","Consent, Data subject rights",null,"Violation found","https://wiki.noyb.eu/index.php?title=File:DSB_Hearst_cookies_REDACTED.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D130.1178_2023-0.631.894",null,"gdprhub",null,null,"hearst magazine media inc",null,null,null,null,null,null,null,null,null],["2023/AT/021","DSB (Austria) - DSB-D130.1174","gdprhub","Austria","AT","DSB (Austria)","2023-09-19","day",null,null,null,null,null,"Art. 17, Art. 19, Art. 3, Art. 4(11), Art. 5(1)(a), Art. 77(1)","Data principles, Data subject rights",null,"Rejected","https://www.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230919_2023_0_632_875_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D130.1174",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/084","ETid-2024","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-19","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00606-2022.pdf","https://www.enforcementtracker.com/ETid-2024",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/083","ETid-2025","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-19","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00562-2022.pdf","https://www.enforcementtracker.com/ETid-2025",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/RO/015","ETid-2030","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-09-18","day",1000,null,"EUR","NN Asigurări de Viață S.A.","Finance, Insurance and Consulting","Art. 21(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_18.09.2023&lang=ro","https://www.enforcementtracker.com/ETid-2030",null,null,null,null,"nn asigurari de viata sa",null,null,null,null,null,null,null,null,null],["2023/FR/007","ETid-2044","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-09-18","day",200000,null,"EUR","SAF LOGISTICS","Employment","Art. 10, Art. 31, Art. 5(1)(c), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/en/excessive-data-collection-and-lack-cooperation-cnil-imposed-sanction-company-saf-logistics","https://www.enforcementtracker.com/ETid-2044",null,null,null,null,"FR: saf logistics",null,null,null,null,null,null,null,null,null],["2023/FR/015","CNIL (France) - 2023-089","gdprhub","France","FR","CNIL (France)","2023-09-14","day",null,null,null,"National Institute of Demographic Studies (INED)",null,"Art. 13, Art. 14(5)(b), Art. 32, Art. 5(1)(f), Art. 89","Data principles, Data security, Transparency",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048085572?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_2023-089",null,"gdprhub",null,null,"FR: national institute of demographic studies",null,null,null,null,null,null,null,null,null],["2023/IE/017","DPC (Ireland) - Inquiry into Airbnb Ireland UC - 14 September 2023","gdprhub","Ireland","IE","DPC (Ireland)","2023-09-14","day",null,null,null,"Airbnb Ireland UC",null,"Art. 12(4), Art. 17(1), Art. 17(3)(e), Art. 5(1)(c), Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2023-10/20231012%2520Full%2520decision%2520Airbnb%2520September%25202023.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Inquiry_into_Airbnb_Ireland_UC_-_14_September_2023",null,"gdprhub",null,null,"airbnb ireland uc","Airbnb",null,null,null,null,null,null,null,null],["2023/HR/003","ETid-2061","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2023-09-14","day",20000,null,"EUR","Betting company","Industry and Commerce","Art. 6(1), Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/upravne-novcane-kazne-zbog-neovlastene-obrade-osobnih-podataka-putem-kolacica/","https://www.enforcementtracker.com/ETid-2061",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/HR/002","ETid-2062","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2023-09-14","day",30000,null,"EUR","Betting company","Industry and Commerce","Art. 6(1), Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/upravne-novcane-kazne-zbog-neovlastene-obrade-osobnih-podataka-putem-kolacica/","https://www.enforcementtracker.com/ETid-2062",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/039","ETid-2068","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-14","day",90000,null,"EUR","GFB One s.r.l.","Media, Telecoms and Broadcasting","Art. 13, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9937730","https://www.enforcementtracker.com/ETid-2068","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9936215","gdprhub",null,null,"gfb one srl",null,null,null,null,null,null,null,null,null],["2023/IT/038","ETid-2071","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-14","day",20000,null,"EUR","Shardana Working Soc. Coop. a r.l.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9936174","https://www.enforcementtracker.com/ETid-2071",null,null,null,null,"IT: shardana working soc coop arl",null,null,null,null,null,null,null,null,null],["2023/IT/037","ETid-2073","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-14","day",10000,null,"EUR","Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb","Employment","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9941795","https://www.enforcementtracker.com/ETid-2073",null,null,null,null,"IT: azienda sanitaria dell alto adige suedtiroler sanitaetsbetrieb",null,null,null,null,null,null,null,null,null],["2023/IT/036","ETid-2075","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-14","day",10000,null,"EUR","San Severo municipality","Employment","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9940457","https://www.enforcementtracker.com/ETid-2075",null,null,null,null,"IT: san severo municipality",null,null,null,null,null,null,null,null,null],["2023/IT/031","ETid-2085","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-14","day",42000,null,"EUR","Intesa Sanpaolo Spa","Finance, Insurance and Consulting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9941780","https://www.enforcementtracker.com/ETid-2085",null,null,null,null,"intesa sanpaolo spa","Intesa Sanpaolo",null,null,null,null,null,null,null,null],["2023/IT/023","ETid-2111","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-09-14","day",5000,null,"EUR","Nimbus s.r.l.","Employment","Art. 13, Art. 5(1)(a), Art. 9","Data principles, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9940565","https://www.enforcementtracker.com/ETid-2111",null,null,null,null,"nimbus srl",null,null,null,null,null,null,null,null,null],["2023/ES/283","AEPD (Spain) - EXP202104006","gdprhub","Spain","ES","AEPD (Spain)","2023-09-13","day",56000,"56,000","EUR","VODAFONE ESPAÑA, S.A.U.",null,"Art. 32, Art. 33, Art. 34, Art. 4(12), Art. 5(1)(f), Art. 83(4), Art. 83(5)","Data breach, Data principles, Data security",null,"Violation found","https://www.aepd.es/documento/ps-00164-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202104006",null,"gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/DK/008","Datatilsynet (Denmark) - Region Sjælland","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-09-13","day",null,null,null,null,null,"Art. 32","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/sep/region-sjaelland-faar-alvorlig-kritik-for-manglende-sikkerhedsforanstaltninger-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_Region_Sj%C3%A6lland",null,"gdprhub",null,"Regional administration",null,null,null,null,null,null,null,null,null,null],["2023/HR/005","ETid-2059","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2023-09-13","day",25000,null,"EUR","Zagreb Holding d.o.o.","Public Sector and Education","Art. 13(1)(c), Art. 25(2)","Accountability, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izrecena-upravna-novcana-kazna-zagrebackom-holdingu/","https://www.enforcementtracker.com/ETid-2059",null,null,null,null,"zagreb holding doo",null,null,null,null,null,null,null,null,null],["2023/ES/277","AEPD (Spain) - EXP202201721","gdprhub","Spain","ES","AEPD (Spain)","2023-09-12","day",70000,"70,000","EUR","Banco Bilbao Vizcaya Argentaria, S.A.",null,"Art. 32(1), Art. 6(1), Art. 83(4)(a), Art. 83(5)(a)","Data security, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00456-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202201721",null,"gdprhub",null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2023/FI/002","ETid-2031","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2023-09-11","day",23000,null,"EUR","Suomen Yritysrekisteri","Industry and Commerce","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://tietosuoja.fi/-/yrityshakemiston-yllapitajalle-seuraamusmaksu-puhelutallenteiden-antamista-koskevista-rikkomuksista","https://www.enforcementtracker.com/ETid-2031",null,null,null,null,"FI: suomen yritysrekisteri",null,null,null,null,null,null,null,null,null],["2023/ES/274","AEPD (Spain) - EXP202201746","gdprhub","Spain","ES","AEPD (Spain)","2023-09-08","day",null,null,null,"SERVICIO CANARIO DE LA SALUD",null,"Art. 32, Art. 5(1)(f), Art. 83(4), Art. 83(5)","Data principles, Data security",null,"Violation found","https://www.aepd.es/es/documento/ps-00097-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202201746",null,"gdprhub",null,null,"ES: servicio canario de la salud",null,null,null,null,null,null,null,null,null],["2023/SI/005","IP (Slovenia) - 07141-9/2023/10","gdprhub","Slovenia","SI","IP (Slovenia)","2023-09-08","day",null,null,null,"AJPES (Agency of the Republic of Slovenia for Public Legal Records and Related Services)",null,"Art. 17(1), Art. 17(3)(b), Art. 58(2)","Data subject rights",null,"Violation found","https://gdprhub.eu/index.php?title=File:07141-9-2023-10_(27-11).pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07141-9/2023/10",null,"gdprhub",null,null,"SI: ajpes",null,null,null,null,null,null,null,null,null],["2023/ES/280","AEPD (Spain) - EXP202102430","gdprhub","Spain","ES","AEPD (Spain)","2023-09-07","day",null,null,null,"SECRETARÍA GENERAL DE INSTITUCIONES PENITENCIARIAS",null,"Art. 32, Art. 58(2)(d), Art. 83(4)","Data security",null,"Violation found","https://www.aepd.es/documento/ps-00565-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202102430",null,"gdprhub",null,null,"ES: secretaria general de instituciones penitenciarias",null,null,null,null,null,null,null,null,null],["2023/FR/017","CNIL (France) - 2023-097","gdprhub","France","FR","CNIL (France)","2023-09-07","day",null,null,null,"University of Bordeaux",null,"Art. 14(5)(b), Art. 28, Art. 36, Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(e), Art. 6(1)(e), Art. 9(2)(j)","DPIA, Data principles, Processor obligations, Special categories, Transparency, Unlawful processing",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048225390?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_2023-097",null,"gdprhub",null,null,"FR: university of bordeaux",null,null,null,null,null,null,null,null,null],["2023/CY/013","Commissioner (Cyprus) - 11.17.001.009.232","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2023-09-07","day",null,null,null,"Freedom Finance Europe Ltd",null,"Art. 12(3), Art. 17, Art. 24(1), Art. 58(2)","Accountability, Data subject rights, Transparency",null,"Violation found","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/F880C7270072D4E0C2258AAE0049CEAB/$file/%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20Freedom%20finance.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.009.232",null,"gdprhub",null,null,"freedom finance europe ltd",null,null,null,null,null,null,null,null,null],["2023/NO/014","Datatilsynet (Norway) - 23/02028","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-09-07","day",null,null,null,"Fast Candy AS",null,"Art. 12, Art. 13, Art. 24, Art. 58(2), Art. 6(1)(f)","Accountability, Transparency, Unlawful processing",null,null,"https://www.datatilsynet.no/contentassets/3635a1d69810440aa7790d02f177acbe/endelig-kontrollrapport---fast-candy-as.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_23/02028",null,"gdprhub",null,null,"fast candy as",null,null,null,null,null,null,null,null,null],["2023/ES/077","ETid-2036","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-07","day",70000,null,"EUR","SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00218-2023.pdf","https://www.enforcementtracker.com/ETid-2036",null,null,null,null,"suministrador iberico de energia sl",null,null,null,null,null,null,null,null,null],["2023/BE/040","APD/GBA (Belgium) - 129/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-09-06","day",null,null,null,null,null,"Art. 14, Art. 5(1)(f)","Data principles, Transparency",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-129-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_129/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/AT/025","DSB (Austria) - 2022-0.858.901","gdprhub","Austria","AT","DSB (Austria)","2023-09-06","day",null,null,null,null,null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230906_2022_0_858_901_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.858.901",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2023/NO/013","Datatilsynet (Norway) - 23-114365TVI-TOSL/08 and 23-114359TVI-TOSL/08","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-09-06","day",null,null,null,"Meta",null,"Art. 6(1)(b), Art. 6(1)(f), Art. 61(8), Art. 66(1)","Unlawful processing",null,null,"https://www.datatilsynet.no/contentassets/4096b3bd53094eb5bf2c184bd6ae4aef/avgjorelse-i-oslo-tingrett-060923.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_23-114365TVI-TOSL/08_and_23-114359TVI-TOSL/08",null,"gdprhub",null,null,"NO: meta",null,null,null,null,null,null,null,null,null],["2023/IS/006","ETid-2029","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-09-06","day",10300,null,"EUR","University of Iceland","Public Sector and Education","Art. 12, Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.personuvernd.is/urlausnir/rafraen-voktun-af-halfu-haskola-islands","https://www.enforcementtracker.com/ETid-2029",null,null,null,null,"IS: university of iceland",null,null,null,null,null,null,null,null,null],["2023/HU/009","NAIH (Hungary) - NAIH-5377-12/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-09-06","day",null,null,null,null,null,"Art. 5(1)(c), Art. 6(1)(b), Art. 6(1)(c), Art. 77(1)","Data principles, Unlawful processing",null,"Rejected","https://naih.hu/hatarozatok-vegzesek?download=772:babavaro-kolcsonnel-osszefuggesben-kiskoru-erintett-adatainak-kezelese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-5377-12/2023",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2023/BE/039","APD/GBA (Belgium) - 128/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-09-05","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15, Art. 15(1), Art. 17, Art. 17(1), Art. 58(2)(c)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-128-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_128/2023",null,"gdprhub",null,"Real estate agent",null,null,null,null,null,null,null,null,null,null],["2023/ES/082","ETid-2026","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-05","day",80000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00266-2023.pdf","https://www.enforcementtracker.com/ETid-2026",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/FI/001","ETid-2052","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2023-09-04","day",1600,null,"EUR","Company","Health Care","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://tietosuoja.fi/-/psykoterapiatoimijalle-hallinnollinen-seuraamusmaksu-asiakkaan-tarkastusoikeuden-puutteellisesta-toteutuksesta","https://www.enforcementtracker.com/ETid-2052","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_9707/152/19","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/GR/020","HDPA (Greece) - 22/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-09-04","day",null,null,null,"VOLTON Hellenic Energy Joint Stock Company",null,"Art. 12(2), Art. 12(3), Art. 15, Art. 58(2)(b)","Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/parabiaseis-gkpd-os-pros-dikaioma-prosbasis-apo-paroho-ilektrikis","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_22/2023",null,"gdprhub",null,null,"GR: volton hellenic energy joint stock company",null,null,null,null,null,null,null,null,null],["2023/IS/022","Persónuvernd (Island) - 2021020374","gdprhub","Iceland","IS","Persónuvernd (Island)","2023-09-04","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)(c)","Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-fiskistofu","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2021020374",null,"gdprhub",null,"Directorate of Fisheries",null,null,null,null,null,null,null,null,null,null],["2023/HR/009","AZOP (Croatia) - Decision 14-09-2023","gdprhub","Croatia","HR","AZOP (Croatia)","2023-09-01","day",50000,"20,000 and 30,000","EUR",null,null,"Art. 13(1), Art. 13(2), Art. 6(1), Art. 7","Consent, Transparency, Unlawful processing",null,"Violation found","https://azop.hr/upravne-novcane-kazne-zbog-neovlastene-obrade-osobnih-podataka-putem-kolacica/","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_14-09-2023",null,"gdprhub",null,"Gambling and betting companies",null,null,null,null,null,null,null,null,null,null],["2023/ES/081","ETid-2027","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-09-01","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00624-2022.pdf","https://www.enforcementtracker.com/ETid-2027","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202209175","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IE/001","ETid-2032","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2023-09-01","day",345000000,null,"EUR","TikTok Limited","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13(1)(e), Art. 24(1)","Accountability, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://edpb.europa.eu/system/files/2023-09/final_decision_tiktok_in-21-9-1_-_redacted_8_september_2023.pdf","https://www.enforcementtracker.com/ETid-2032","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-21-9-1","gdprhub",null,null,"tiktok ltd","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2023/FI/018","Tietosuojavaltuutetun toimisto (Finland) - 3379/182/23","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-09-01","day",null,null,null,"City of Helsinki",null,"Art. 25(2), Art. 32(1), Art. 58(2)(b)","Accountability, Data security",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2023/20232203","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3379/182/23",null,"gdprhub",null,null,"FI: city of helsinki",null,null,null,null,null,null,null,null,null],["2023/IT/042","ETid-2047","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-08-31","day",10000,null,"EUR","RCS Mediagroup Spa","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9932496","https://www.enforcementtracker.com/ETid-2047",null,null,null,null,"rcs mediagroup spa",null,null,null,null,null,null,null,null,null],["2023/IT/033","ETid-2083","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-08-31","day",20000,null,"EUR","Bar association","Public Sector and Education","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9938413","https://www.enforcementtracker.com/ETid-2083","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9938413","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/032","ETid-2084","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-08-31","day",10000,null,"EUR","Mednow Medical Center di Giugni Marco","Health Care","Art. 12, Art. 15, Art. 16, Art. 17, Art. 18, Art. 32, Art. 9","Data principles, Data security, Data subject rights, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9938463","https://www.enforcementtracker.com/ETid-2084","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9938463","gdprhub",null,null,"IT: mednow medical center di giugni marco",null,null,null,null,null,null,null,null,null],["2023/IT/020","ETid-2118","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-08-31","day",25000,null,"EUR","Robin Srl","Media, Telecoms and Broadcasting","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9944538","https://www.enforcementtracker.com/ETid-2118",null,null,null,null,"robin srl",null,null,null,null,null,null,null,null,null],["2023/CZ/006","ETid-2801","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2023-08-31","day",1600,null,"EUR","Legal Person",null,"Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/127-cj-uoou-0084922-21-dokumemt-c-127.pdf","https://www.enforcementtracker.com/ETid-2801",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/138","Garante per la protezione dei dati personali (Italy) - 9932951","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-08-31","day",10000,"10,000","EUR","RCS Mediagroup S.p.a",null,"Art. 22, Art. 5, Art. 5(1)(a), Art. 58(2)(i), Art. 83","Data principles, Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9932951","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9932951",null,"gdprhub",null,null,"rcs mediagroup spa",null,null,null,null,null,null,null,null,null],["2023/IT/144","Garante per la protezione dei dati personali (Italy) - 9936247","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-08-31","day",null,null,null,"Associazione ContiamoCI! ETS",null,"Art. 17(1), Art. 58(2)(b)","Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9936247","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9936247",null,"gdprhub",null,null,"IT: associazione contiamoci ets",null,null,null,null,null,null,null,null,null],["2023/ES/089","ETid-2016","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-30","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00618-2022.pdf","https://www.enforcementtracker.com/ETid-2016","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202209511","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/088","ETid-2017","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-30","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00427-2022.pdf","https://www.enforcementtracker.com/ETid-2017","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202206626","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/087","ETid-2018","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-30","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00666-2022.pdf","https://www.enforcementtracker.com/ETid-2018",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/080","ETid-2028","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-30","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00060-2023.pdf","https://www.enforcementtracker.com/ETid-2028",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/076","ETid-2038","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-30","day",140000,null,"EUR","GENERAL LOGISTICS SYSTEMS SPAIN, S.A.","Transportation and Energy","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/documento/ps-00075-2023.pdf","https://www.enforcementtracker.com/ETid-2038",null,null,null,null,"general logistics systems spain sa",null,null,null,null,null,null,null,null,null],["2023/PL/008","ETid-2152","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-08-30","day",13000,null,"EUR",null,null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DOKE.561.8.2023","https://www.enforcementtracker.com/ETid-2152",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/086","ETid-2019","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-29","day",1500,null,"EUR","ALBEN AIRPORT FACILITIES S.L.","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00227-2023.pdf","https://www.enforcementtracker.com/ETid-2019",null,null,null,null,"alben airport facilities sl",null,null,null,null,null,null,null,null,null],["2023/ES/091","ETid-2011","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-28","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00558-2022.pdf","https://www.enforcementtracker.com/ETid-2011","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202204530","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/090","ETid-2012","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-28","day",500,null,"EUR","MULTIGAS ASESORES S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00136-2023.pdf","https://www.enforcementtracker.com/ETid-2012",null,null,null,null,"multigas asesores sl",null,null,null,null,null,null,null,null,null],["2023/ES/085","ETid-2020","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-28","day",4800,null,"EUR","WALL BOX CHARGERS S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00196-2023.pdf","https://www.enforcementtracker.com/ETid-2020",null,null,null,null,"wall box chargers sl",null,null,null,null,null,null,null,null,null],["2023/SE/005","ETid-2021","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-08-28","day",3000000,null,"EUR","Trygg-Hansa","Finance, Insurance and Consulting","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.imy.se/nyheter/sanktionsavgift-pa-35-miljoner-mot-trygg-hansa/","https://www.enforcementtracker.com/ETid-2021",null,null,null,null,"SE: trygg hansa",null,null,null,null,null,null,null,null,null],["2023/SE/019","IMY (Sweden) - DI-2021-1905","gdprhub","Sweden","SE","IMY (Sweden)","2023-08-28","day",null,"35,000,000","SEK","Trygg-Hansa",null,"Art. 32(1), Art. 5(1)(f), Art. 58(2), Art. 83","Data principles, Data security",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-efter-tillsyn-enligt-dataskyddsforordningen---trygg-hansa-forsakring-filial.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-1905",null,"gdprhub",null,null,"SE: trygg hansa",null,35000000.0,2941176,"day 2023-08-28|11.9000|SEK",null,null,null,null,null],["2023/ES/092","ETid-2010","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-25","day",1500,null,"EUR","Homeowners' association","Real Estate","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00428-2022.pdf","https://www.enforcementtracker.com/ETid-2010","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202100764","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/093","ETid-2009","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-23","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00085-2023.pdf","https://www.enforcementtracker.com/ETid-2009",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/017","ETid-2206","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-23","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00521-2022.pdf","https://www.enforcementtracker.com/ETid-2206",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IE/016","DPC (Ireland) - 06/SIU/2018","gdprhub","Ireland","IE","DPC (Ireland)","2023-08-22","day",null,null,null,"Galway County Council",null,"Art. 24, Art. 35(1), Art. 5(1)(a)","Accountability, DPIA, Data principles",null,"Violation found","https://www.dataprotection.ie/en/dpc-guidance/law/decisions-made-under-data-protection-act-2018/inquiry-into-galway-county-council-august-2023","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_06/SIU/2018",null,"gdprhub",null,null,"IE: galway county council",null,null,null,null,null,null,null,null,null],["2023/RO/016","ETid-2013","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-08-21","day",70000,null,"EUR","Uipath SRL","Industry and Commerce","Art. 25, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_21_08_2023&lang=ro","https://www.enforcementtracker.com/ETid-2013",null,null,null,null,"uipath srl",null,null,null,null,null,null,null,null,null],["2023/ES/271","AEPD (Spain) - EXP202301529","gdprhub","Spain","ES","AEPD (Spain)","2023-08-18","day",null,null,null,"GLOBAL KAPITAL GROUP SPAIN, S.L",null,"Art. 17, Art. 21","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/pd-00076-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202301529",null,"gdprhub",null,null,"global kapital group spain sl",null,null,null,null,null,null,null,null,null],["2023/ES/095","ETid-2007","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-18","day",20000,null,"EUR","JOLY DIGITAL, S.L.U.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00489-2022.pdf","https://www.enforcementtracker.com/ETid-2007",null,null,null,null,"joly digital slu",null,null,null,null,null,null,null,null,null],["2023/BE/038","APD/GBA (Belgium) - 115/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-08-16","day",null,null,null,null,null,"Art. 35","DPIA",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-115-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_115/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/098","ETid-2003","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-16","day",600,null,"EUR","MÁRMOLES Y GRANITOS MEJIAS, S. L.","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00457-2022.pdf","https://www.enforcementtracker.com/ETid-2003",null,null,null,null,"marmoles y granitos mejias sl",null,null,null,null,null,null,null,null,null],["2023/ES/097","ETid-2004","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-16","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00004-2023.pdf","https://www.enforcementtracker.com/ETid-2004",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/094","ETid-2008","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-16","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00450-2022.pdf","https://www.enforcementtracker.com/ETid-2008",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/100","ETid-2001","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-11","day",6000,null,"EUR","ADENET SYSTEMS, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00180-2023.pdf","https://www.enforcementtracker.com/ETid-2001",null,null,null,null,"adenet systems sl",null,null,null,null,null,null,null,null,null],["2023/ES/099","ETid-2002","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-11","day",500,null,"EUR","RING RING CLIN S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00087-2023.pdf","https://www.enforcementtracker.com/ETid-2002",null,null,null,null,"ring ring clin sl",null,null,null,null,null,null,null,null,null],["2023/ES/096","ETid-2005","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-11","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00061-2023.pdf","https://www.enforcementtracker.com/ETid-2005",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/GB/005","ICO (UK) - Nottinghamshire County Council","gdprhub","United Kingdom","GB","ICO (UK)","2023-08-11","day",null,null,null,"Nottinghamshire County Council",null,"Art. 32(1), Art. 58(2)(b)","Data security",null,null,"https://ico.org.uk/media/action-weve-taken/reprimands/4026605/nottinghamshire-county-council.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Nottinghamshire_County_Council",null,"gdprhub",null,null,"GB: nottinghamshire county council",null,null,null,null,null,null,null,null,null],["2023/FI/016","Tietosuojavaltuutetun toimisto (Finland) - 1011/161/22","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-08-11","day",null,null,null,null,null,"Art. 5(1)(c), Art. 58(2)(b), Art. 58(2)(d)","Data principles",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2023/20232083","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_1011/161/22",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2023/HR/013","AZOP (Croatia) - Decision 10-08-2023","gdprhub","Croatia","HR","AZOP (Croatia)","2023-08-10","day",null,null,null,null,null,"Art. 5, Art. 6","Data principles, Unlawful processing",null,"Violation found","https://azop.hr/wp-content/uploads/2023/11/Objava-fotografije-s-privatnog-Facebook-profila-u-medijima.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_10-08-2023",null,"gdprhub",null,"Media outlet",null,null,null,null,null,null,null,null,null,null],["2023/BE/036","APD/GBA (Belgium) - 109/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-08-09","day",null,null,null,null,null,"Art. 12(3), Art. 21(2)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-109-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_109/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/037","APD/GBA (Belgium) - 110/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-08-09","day",null,null,null,null,null,"Art. 13, Art. 37(1)(a), Art. 37(7), Art. 39(1), Art. 5(2)","Data principles, Data protection officer, Transparency",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-110-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_110/2023",null,"gdprhub",null,"Municipal school",null,null,null,null,null,null,null,null,null,null],["2023/ES/103","ETid-1996","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-08","day",6000,null,"EUR","ELECTRAWORKS - CEUTA, S.A.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00212-2023.pdf","https://www.enforcementtracker.com/ETid-1996",null,null,null,null,"electraworks ceuta sa",null,null,null,null,null,null,null,null,null],["2023/ES/102","ETid-1998","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-08","day",6000,null,"EUR","ODRIA COSTAS INTERNACIONAL, S.L.","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00526-2022.pdf","https://www.enforcementtracker.com/ETid-1998",null,null,null,null,"odria costas internacional sl",null,null,null,null,null,null,null,null,null],["2023/AT/023","DSB (Austria) - DSB-D213.1759","gdprhub","Austria","AT","DSB (Austria)","2023-08-04","day",null,null,null,null,null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230804_2023_0_159_938__00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D213.1759",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/017","ETid-1988","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-08-03","day",2000,null,"EUR","Med Life SA","Health Care","Art. 12(4), Art. 15(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_03_08_2023&lang=ro","https://www.enforcementtracker.com/ETid-1988",null,null,null,null,"med life sa",null,null,null,null,null,null,null,null,null],["2023/ES/101","ETid-1999","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-02","day",10000,null,"EUR","GYMOOGIMNASIOS S.L.","Industry and Commerce","Art. 5(1)(c), Art. 7","Consent, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00457-2021.pdf","https://www.enforcementtracker.com/ETid-1999",null,null,null,null,"gymoogimnasios sl",null,null,null,null,null,null,null,null,null],["2023/CZ/007","ETid-2592","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2023-08-02","day",178000,null,"EUR","Multiple website operators",null,null,null,"Unknown","Fine issued","https://uoou.gov.cz/media-publikace/tiskove-zpravy/urad-udelil-pokuty-za-45-mil-kc","https://www.enforcementtracker.com/ETid-2592",null,null,null,null,"CZ: multiple website operators",null,null,null,null,null,null,null,null,null],["2023/HU/013","NAIH (Hungary) - 7286-1/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-08-02","day",null,null,null,null,null,"Art. 15, Art. 15(1), Art. 4(7)","Data subject rights",null,"Violation found","https://gdprhub.eu/images/5/56/NAIH-7286-2023-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_7286-1/2023",null,"gdprhub",null,"Job application platform",null,null,null,null,null,null,null,null,null,null],["2023/FI/017","Tietosuojavaltuutetun toimisto (Finland) - 1803/161/23","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-08-02","day",null,null,null,"City of Helsinki",null,"Art. 28(3), Art. 58(2)(b)","Processor obligations",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2023/20232204","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_1803/161/23",null,"gdprhub",null,null,"FI: city of helsinki",null,null,null,null,null,null,null,null,null],["2023/BE/035","APD/GBA (Belgium) - 105/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-08-01","day",null,null,null,"City Of Kortrijk",null,"Art. 12(1), Art. 14(1)(a), Art. 5(1)(a), Art. 5(2), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-105-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_105/2023",null,"gdprhub",null,null,"BE: city of kortrijk",null,null,null,null,null,null,null,null,null],["2023/ES/111","ETid-1983","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-01","day",20000,null,"EUR","QUALITY-PROVIDER S.A.",null,"Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00204-2023.pdf","https://www.enforcementtracker.com/ETid-1983",null,null,null,null,"quality provider sa",null,null,null,null,null,null,null,null,null],["2023/ES/110","ETid-1984","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-01","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00152-2023.pdf","https://www.enforcementtracker.com/ETid-1984",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/ES/109","ETid-1985","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-01","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00167-2023.pdf","https://www.enforcementtracker.com/ETid-1985",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/ES/108","ETid-1986","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-08-01","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00407-2022.pdf","https://www.enforcementtracker.com/ETid-1986",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/CZ/003","ETid-2831","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2023-08-01","day",3570,null,"EUR","Legal Person",null,"Art. 13(1)(f), Art. 44, Art. 6(1)","International transfers, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/147-cj-uoou-0249823-5-dokument-c-147.pdf","https://www.enforcementtracker.com/ETid-2831",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/107","ETid-1987","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-31","day",70000,null,"EUR","TELEFÓNICA MÓVILES ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00613-2022.pdf","https://www.enforcementtracker.com/ETid-1987",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2023/ES/019","ETid-2201","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-28","day",2500000,null,"EUR","Open Bank, S.A.","Finance, Insurance and Consulting","Art. 25, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/documento/ps-00331-2022.pdf","https://www.enforcementtracker.com/ETid-2201",null,null,null,null,"open bank sa",null,null,null,null,null,null,null,null,null],["2023/ES/106","ETid-1989","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-27","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00010-2023.pdf","https://www.enforcementtracker.com/ETid-1989",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/105","ETid-1991","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-27","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00694-2022.pdf","https://www.enforcementtracker.com/ETid-1991",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/104","ETid-1992","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-27","day",1200,null,"EUR","FONTANORTE, S.L.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00627-2022.pdf","https://www.enforcementtracker.com/ETid-1992",null,null,null,null,"fontanorte sl",null,null,null,null,null,null,null,null,null],["2023/BE/034","APD/GBA (Belgium) - 103/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-07-26","day",null,null,null,null,null,"Art. 24, Art. 32, Art. 5(2), Art. 9(1)","Accountability, Data principles, Data security, Special categories",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-103-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_103/2023",null,"gdprhub",null,"Hospital group",null,null,null,null,null,null,null,null,null,null],["2023/NO/012","Datatilsynet (Norway) - 20/03771-17","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-07-26","day",null,null,null,"Telenor ASA",null,"Art. 44, Art. 45, Art. 46, Art. 47, Art. 48, Art. 49, Art. 50","International transfers",null,"Violation found","https://www.datatilsynet.no/contentassets/a3e5338a8fac4012ad9c18f17276ea5a/vedtak-google-analytics.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/03771-17",null,"gdprhub",null,null,"telenor asa",null,null,null,null,null,null,null,null,null],["2023/ES/113","ETid-1971","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-26","day",1200,null,"EUR","SERVICIOS E INTERVENCIONES EN EDIFICACION DEL MEDITERRÁNEO, S.L.","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00200-2023.pdf","https://www.enforcementtracker.com/ETid-1971",null,null,null,null,"servicios e intervenciones en edificacion del mediterraneo sl",null,null,null,null,null,null,null,null,null],["2023/ES/112","ETid-1972","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-26","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00034-2023.pdf","https://www.enforcementtracker.com/ETid-1972",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/114","ETid-1970","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-25","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00609-2022.pdf","https://www.enforcementtracker.com/ETid-1970",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/MT/005","IDPC (Malta) - CDP/COMP/429/2023","gdprhub","Malta","MT","IDPC (Malta)","2023-07-25","day",null,null,null,null,null,"Art. 2(2)(c), Art. 6(1)","Unlawful processing",null,"Violation found","https://idpc.org.mt/wp-content/uploads/2023/10/CDP_COMP_429_2023.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_CDP/COMP/429/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/LU/003","CNPD (Luxembourg) - 10FR/2023","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2023-07-24","day",null,null,null,"Administration communale de Leudelange",null,"Art. 37(1)(a), Art. 37(7)","Data protection officer",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2023/dlibration-n-10fr-2023-du-24-juillet-2023.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_10FR/2023",null,"gdprhub",null,null,"LU: administration communale de leudelange",null,null,null,null,null,null,null,null,null],["2023/ES/115","ETid-1969","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-24","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00493-2022.pdf","https://www.enforcementtracker.com/ETid-1969",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/GR/022","HDPA (Greece) - 28/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-07-24","day",null,null,null,"Municipality X (To ensure the confidentiality of the specific municipality, the term \"X\" is employed as a placeholder.)",null,"Art. 58(2)",null,null,null,"https://www.dpa.gr/el/enimerwtiko/prakseisArxis/prosorini-diatagi-shetika-me-peristatiko-parabiasis-prosopikon-dedomenon","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_28/2023",null,"gdprhub",null,null,"GR: municipality x",null,null,null,null,null,null,null,null,null],["2023/MT/004","IDPC (Malta) - CPD/COMP/280/2023","gdprhub","Malta","MT","IDPC (Malta)","2023-07-24","day",null,null,null,null,null,"Art. 32(1)(b), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://idpc.org.mt/wp-content/uploads/2023/10/CDP_COMP_280_2023.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_CPD/COMP/280/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/119","ETid-1963","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-21","day",720,null,"EUR","MADRID TOURISTIC CAPITAL, S.L.","Industry and Commerce",null,"Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00110-2023.pdf","https://www.enforcementtracker.com/ETid-1963",null,null,null,null,"madrid touristic capital sl",null,null,null,null,null,null,null,null,null],["2023/FR/020","CNIL (France) - CNIL2326891X","gdprhub","France","FR","CNIL (France)","2023-07-20","day",null,null,null,null,null,"Art. 5(2), Art. 9(4)","Data principles, Special categories",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048196339?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_CNIL2326891X",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2023/FR/019","CNIL (France) - SAN-2023-082","gdprhub","France","FR","CNIL (France)","2023-07-20","day",null,null,null,null,null,"Art. 14, Art. 5(2), Art. 9(4)","Data principles, Special categories, Transparency",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048197556?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-082",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2023/IE/014","DPC (Ireland) - 20.07.2023 (case number redacted)","gdprhub","Ireland","IE","DPC (Ireland)","2023-07-20","day",null,null,null,"Airbnb",null,"Art. 12, Art. 15, Art. 17, Art. 5(1)(c), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2023-09/Final%2520Decision%2520Airbnb%2520Ireland%2520UC%2520-%2520July%25202023_Redacted.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_20.07.2023_%28case_number_redacted%29",null,"gdprhub",null,null,"IE: airbnb","Airbnb",null,null,null,null,null,null,null,null],["2023/ES/122","ETid-1959","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-20","day",1000,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00643-2022.pdf","https://www.enforcementtracker.com/ETid-1959",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/121","ETid-1960","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-20","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00610-2022.pdf","https://www.enforcementtracker.com/ETid-1960",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/SI/003","IP (Slovenia) - IP - 07141-10-2023","gdprhub","Slovenia","SI","IP (Slovenia)","2023-07-20","day",null,null,null,"National Police",null,"Art. 17(1), Art. 17(2)","Data subject rights",null,"Violation found","https://www.ip-rs.si/","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_IP_-_07141-10-2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/267","AEPD (Spain) - EXP202203969","gdprhub","Spain","ES","AEPD (Spain)","2023-07-19","day",70000,"70,000","EUR","HOLALUZ-CLIDOM S.A.",null,"Art. 6(1), Art. 83(5)(a)","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00139-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202203969",null,"gdprhub",null,null,"holaluz clidom sa",null,null,null,null,null,null,null,null,null],["2023/ES/120","ETid-1962","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-18","day",70000,null,"EUR","DIGI SPAIN TELECOM, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00636-2022.pdf","https://www.enforcementtracker.com/ETid-1962",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/RO/018","ETid-1968","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-07-18","day",3000,null,"EUR","ING Bank NV Amsterdam Sucursala București","Finance, Insurance and Consulting","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_18_07_2023&lang=ro","https://www.enforcementtracker.com/ETid-1968",null,null,null,null,"ing bank nv amsterdam sucursala bucuresti","ING",null,null,null,null,null,null,null,null],["2023/IT/048","ETid-2014","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",10000,null,"EUR","Cat s.r.l.","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9920664","https://www.enforcementtracker.com/ETid-2014","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9920664","gdprhub",null,null,"cat srl",null,null,null,null,null,null,null,null,null],["2023/IT/047","ETid-2015","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",5000,null,"EUR","Ermeslink di Giovanni Di Stefano","Industry and Commerce","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9920645","https://www.enforcementtracker.com/ETid-2015",null,null,null,null,"IT: ermeslink di giovanni di stefano",null,null,null,null,null,null,null,null,null],["2023/IT/043","ETid-2037","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",1000,null,"EUR","Prodav srl","Industry and Commerce","Art. 13, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9931319","https://www.enforcementtracker.com/ETid-2037",null,null,null,null,"prodav srl",null,null,null,null,null,null,null,null,null],["2023/IT/041","ETid-2051","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9935503","https://www.enforcementtracker.com/ETid-2051",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IT/040","ETid-2054","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",12000,null,"EUR","Azienda Socio Sanitaria Territoriale Ovest Milanese","Health Care","Art. 32, Art. 5(1)(f), Art. 9","Data principles, Data security, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9935484","https://www.enforcementtracker.com/ETid-2054",null,null,null,null,"IT: azienda socio sanitaria territoriale ovest milanese",null,null,null,null,null,null,null,null,null],["2023/PL/011","ETid-2082","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-07-18","day",3400,null,"EUR","Company",null,"Art. 24(1), Art. 25(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.47.2022","https://www.enforcementtracker.com/ETid-2082",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/030","ETid-2087","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",75000,null,"EUR","Università Telematica E-Campus","Public Sector and Education","Art. 12, Art. 13, Art. 17, Art. 21, Art. 24, Art. 5(2), Art. 6(1)(a), Art. 7(1)","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9943230","https://www.enforcementtracker.com/ETid-2087",null,null,null,null,"IT: universita telematica e campus",null,null,null,null,null,null,null,null,null],["2023/IT/022","ETid-2113","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",40000,null,"EUR","Compara Facile S.r.l.","Industry and Commerce","Art. 12, Art. 13, Art. 15, Art. 17, Art. 21(2), Art. 25(1), Art. 5(1)(a), Art. 5(2), Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9927212","https://www.enforcementtracker.com/ETid-2113","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9921112","gdprhub",null,null,"compara facile srl",null,null,null,null,null,null,null,null,null],["2023/IT/021","ETid-2114","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",100000,null,"EUR","Tiscali Italia SpA","Industry and Commerce","Art. 12(1), Art. 13(1)(a), Art. 24, Art. 5(2)","Accountability, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9927212","https://www.enforcementtracker.com/ETid-2114","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9920942","gdprhub",null,null,"tiscali italia spa",null,null,null,null,null,null,null,null,null],["2023/IT/003","ETid-2270","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-18","day",45000,null,"EUR","Municipality of Modica","Public Sector and Education","Art. 12(1), Art. 13, Art. 25, Art. 28, Art. 5(2)","Accountability, Data principles, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9920578","https://www.enforcementtracker.com/ETid-2270","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9920578","gdprhub",null,null,"IT: municipality of modica",null,null,null,null,null,null,null,null,null],["2023/IT/136","Garante per la protezione dei dati personali (Italy) - 9920977","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-07-18","day",null,null,null,"Azienda Ospedaliera Universitaria Careggi",null,"Art. 13, Art. 14, Art. 35, Art. 36, Art. 89","DPIA, Transparency",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9920977","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9920977",null,"gdprhub",null,null,"IT: azienda ospedaliera universitaria careggi",null,null,null,null,null,null,null,null,null],["2023/IT/139","Garante per la protezione dei dati personali (Italy) - 9925674","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-07-18","day",5000,"5,000","EUR","Maximum International Corp. S.r.l.",null,"Art. 12(2), Art. 12(3), Art. 15, Art. 17, Art. 21(2), Art. 24, Art. 25, Art. 5(1)(a), Art. 5(2), Art. 58, Art. 6(1)(a), Art. 7, Art. 83","Accountability, Consent, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9925674","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9925674",null,"gdprhub",null,null,"maximum international corp srl",null,null,null,null,null,null,null,null,null],["2023/ES/118","ETid-1964","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-17","day",10000,null,"EUR","NANDIVALE, S.L","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00008-2023.pdf","https://www.enforcementtracker.com/ETid-1964","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202211618","gdprhub",null,null,"nandivale sl",null,null,null,null,null,null,null,null,null],["2023/ES/117","ETid-1966","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-16","day",300,null,"EUR",null,"Individuals and Private Associations",null,"Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00041-2023.pdf","https://www.enforcementtracker.com/ETid-1966",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/BE/033","APD/GBA (Belgium) - 99/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-07-13","day",null,null,null,null,null,"Art. 17(1)(d), Art. 17(3), Art. 5(1)(c), Art. 6(1), Art. 6(1)(c)","Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-99-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_99/2023",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2023/EU/001","EDPS - 2023-0367","gdprhub","European Union","EU","EDPS","2023-07-13","day",null,null,null,"Court of Justice of the European Union (CJEU)",null,null,null,null,null,"https://edps.europa.eu/system/files/2023-07/2023-07-13-edps-cjeu-cisco-decision_en.pdf","https://gdprhub.eu/index.php?title=EDPS_-_2023-0367",null,"gdprhub",null,null,"EU: court of justice of the european union",null,null,null,null,null,null,null,null,null],["2023/GR/024","HDPA (Greece) - 27/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-07-13","day",null,null,null,"Athens Medical Association (AMA)",null,"Art. 5(1)(a), Art. 5(1)(e)","Data principles",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/kataggelia-anaforika-me-ti-syllogi-apo-ton-isa-pistopoiitikon-emboliasmoy?fbclid=IwAR2xJeVHukaddAALC8hBFNzOeHI_3nSeoZStDApcwL4MTj92K0OmGaYtljk","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_27/2023",null,"gdprhub",null,null,"GR: athens medical association",null,null,null,null,null,null,null,null,null],["2023/ES/123","ETid-1958","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-12","day",48000,null,"EUR","Birou Gas, S.L.","Transportation and Energy","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00135-2023.pdf","https://www.enforcementtracker.com/ETid-1958",null,null,null,null,"birou gas sl",null,null,null,null,null,null,null,null,null],["2023/ES/116","ETid-1967","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-12","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00559-2022.pdf","https://www.enforcementtracker.com/ETid-1967","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202210525","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/PL/012","ETid-2053","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-07-12","day",2500,null,"EUR","Company",null,"Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.43.2022","https://www.enforcementtracker.com/ETid-2053",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/PL/026","UODO (Poland) - DKN.5131.43.2022","gdprhub","Poland","PL","UODO (Poland)","2023-07-12","day",null,"11,790","PLN",null,null,"Art. 33, Art. 34, Art. 5(2)","Data breach, Data principles",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5131.43.2022#","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.43.2022",null,"gdprhub",null,null,null,null,11790.0,2651,"day 2023-07-12|4.4473|PLN",null,null,null,null,null],["2023/ES/129","ETid-1949","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-10","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00690-2022.pdf","https://www.enforcementtracker.com/ETid-1949",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IS/020","Persónuvernd (Island) - 2021061295","gdprhub","Iceland","IS","Persónuvernd (Island)","2023-07-10","day",null,null,null,"Landsbankinn hf.",null,"Art. 5, Art. 5(1)(c), Art. 6, Art. 6(1)(c)","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-landsbankans-hf.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2021061295",null,"gdprhub",null,null,"landsbankinn hf",null,null,null,null,null,null,null,null,null],["2023/FI/011","Tietosuojavaltuutetun toimisto (Finland) - 9885/157/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-07-10","day",null,null,null,null,null,"Art. 12(1), Art. 12(2), Art. 21, Art. 58(2)(d)","Data subject rights, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2023/20231903","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_9885/157/19",null,"gdprhub",null,"Telecommunications company",null,null,null,null,null,null,null,null,null,null],["2023/ES/134","ETid-1942","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-07","day",15000,null,"EUR","RCL CRUISES LTD","Accommodation and Hospitality","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00207-2022.pdf","https://www.enforcementtracker.com/ETid-1942",null,null,null,null,"rcl cruises ltd",null,null,null,null,null,null,null,null,null],["2023/ES/133","ETid-1943","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-07","day",2000,null,"EUR","KUGELCHEN PROPIERTIES, S.L.","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00073-2023.pdf","https://www.enforcementtracker.com/ETid-1943",null,null,null,null,"kugelchen propierties sl",null,null,null,null,null,null,null,null,null],["2023/ES/132","ETid-1944","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-07","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00592-2022.pdf","https://www.enforcementtracker.com/ETid-1944",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/BE/032","APD/GBA (Belgium) - 95/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-07-06","day",null,null,null,null,null,"Art. 13, Art. 14, Art. 4(1), Art. 6, Art. 9(1), Art. 9(2)","Special categories, Transparency, Unlawful processing",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-95-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_95/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/049","ETid-2006","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-06","day",5000,null,"EUR","Ristorante Francesco srl","Accommodation and Hospitality","Art. 13, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9920881","https://www.enforcementtracker.com/ETid-2006",null,null,null,null,"ristorante francesco srl",null,null,null,null,null,null,null,null,null],["2023/IT/044","ETid-2033","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-07-06","day",10000,null,"EUR","AcegasApsAmga SpA","Employment","Art. 12, Art. 15, Art. 5(1)(a)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9927300","https://www.enforcementtracker.com/ETid-2033",null,null,null,null,"acegasapsamga spa",null,null,null,null,null,null,null,null,null],["2023/IT/130","Garante per la protezione dei dati personali (Italy) - 9920292","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-07-06","day",null,null,null,null,null,"Art. 13, Art. 5(1)(a), Art. 5(1)(f)","Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9920292%20","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9920292",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/131","ETid-1945","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-05","day",1200,null,"EUR","LISMARTSA, S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00472-2022.pdf","https://www.enforcementtracker.com/ETid-1945",null,null,null,null,"lismartsa sl",null,null,null,null,null,null,null,null,null],["2023/ES/136","ETid-1939","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-04","day",500,null,"EUR","EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00536-2022.pdf","https://www.enforcementtracker.com/ETid-1939",null,null,null,null,"explotaciones hosteleras y de ocio albacetenas sl",null,null,null,null,null,null,null,null,null],["2023/ES/128","ETid-1953","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-04","day",25000,null,"EUR","CaixaBank, S.A.","Finance, Insurance and Consulting","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00388-2022.pdf","https://www.enforcementtracker.com/ETid-1953",null,null,null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2023/IS/010","ETid-1940","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-07-03","day",81000,null,"EUR","Heilsuveru","Health Care","Art. 25, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.personuvernd.is/urlausnir/sekt-vegna-oryggisveikleika-i-heilsuveru","https://www.enforcementtracker.com/ETid-1940","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2020061844","gdprhub",null,null,"IS: heilsuveru",null,null,null,null,null,null,null,null,null],["2023/ES/135","ETid-1941","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-07-03","day",56000,null,"EUR","ODAFONE SERVICIOS, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00065-2023.pdf","https://www.enforcementtracker.com/ETid-1941",null,null,null,null,"odafone servicios slu",null,null,null,null,null,null,null,null,null],["2023/ES/137","ETid-1936","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-30","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00664-2022.pdf","https://www.enforcementtracker.com/ETid-1936",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/SE/007","ETid-1937","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-06-30","day",1000000,null,"EUR","Tele2 Sverige Aktiebolag","Media, Telecoms and Broadcasting","Art. 44","Data security, International transfers","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/nyheter/fyra-bolag-maste-sluta-anvanda-google-analytics/","https://www.enforcementtracker.com/ETid-1937",null,null,null,null,"SE: tele2 sverige aktiebolag",null,null,null,null,null,null,null,null,null],["2023/SE/006","ETid-1938","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-06-30","day",25000,null,"EUR","CDON AB","Industry and Commerce","Art. 44","Data security, International transfers","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/nyheter/fyra-bolag-maste-sluta-anvanda-google-analytics/","https://www.enforcementtracker.com/ETid-1938",null,null,null,null,"cdon ab",null,null,null,null,null,null,null,null,null],["2023/SE/015","IMY (Sweden) - DI-2020-11368","gdprhub","Sweden","SE","IMY (Sweden)","2023-06-30","day",null,null,null,"Coop Sverige AB",null,"Art. 44, Art. 46, Art. 60","International transfers",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-coop.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-11368",null,"gdprhub",null,null,"coop sverige ab",null,null,null,null,null,null,null,null,null],["2023/SE/016","IMY (Sweden) - DI-2020-11370","gdprhub","Sweden","SE","IMY (Sweden)","2023-06-30","day",null,null,null,"Dagens Industri Aktiebolag",null,"Art. 44, Art. 46, Art. 60","International transfers",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-dagens-industri.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-11370",null,"gdprhub",null,null,"SE: dagens industri aktiebolag",null,null,null,null,null,null,null,null,null],["2023/SE/017","IMY (Sweden) - DI-2020-11373","gdprhub","Sweden","SE","IMY (Sweden)","2023-06-30","day",null,"12,000,000","SEK","Tele2 Sverige",null,"Art. 44, Art. 46, Art. 60","International transfers",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-ga-tele2.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-11373",null,"gdprhub",null,null,"SE: tele2 sverige",null,12000000.0,1016475,"day 2023-06-30|11.8055|SEK",null,null,null,null,null],["2023/AT/020","DSB (Austria) - 2023-0.420.407","gdprhub","Austria","AT","DSB (Austria)","2023-06-29","day",10000,"10,000","EUR","gynaecologist",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 9(1)","Data principles, Special categories",null,"Violation found","https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=07ee55d2-a0a6-4e00-8111-c779c3c97ceb&Position=1&SkipToDocumentPage=True&Abfrage=Dsk&Entscheidungsart=Undefined&Organ=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.1990&BisDatum=&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=EinerWoche&ImRisSeitForRemotion=EinerWoche&ResultPageSize=100&Suchworte=DSGVO&Dokumentnummer=DSBT_20230629_2023_0_420_407_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.420.407",null,"gdprhub",null,null,"AT: gynaecologist",null,null,null,null,null,null,null,null,null],["2023/ES/138","ETid-1934","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-29","day",1000,null,"EUR","PUNTO ROJO LIBROS, S.L.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00006-2023.pdf","https://www.enforcementtracker.com/ETid-1934",null,null,null,null,"punto rojo libros sl",null,null,null,null,null,null,null,null,null],["2023/GR/035","HDPA (Greece) - 24/2024","gdprhub","Greece","GR","HDPA (Greece)","2023-06-29","day",null,null,null,"Google LLC",null,"Art. 17(1), Art. 2(1), Art. 21(1), Art. 3(2), Art. 55(1), Art. 58(2)(c)","Data subject rights",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-09/24_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_24/2024",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2023/GR/034","HDPA (Greece) - 54/2024","gdprhub","Greece","GR","HDPA (Greece)","2023-06-29","day",null,null,null,"Google LLC",null,"Art. 12(2), Art. 12(3), Art. 17, Art. 37(7)","Data protection officer, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2025-01/54_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_54/2024",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2023/SE/025","IMY (Sweden) - IMY-2022-9442","gdprhub","Sweden","SE","IMY (Sweden)","2023-06-29","day",null,null,null,null,null,"Art. 12(3), Art. 15, Art. 15(1)(a), Art. 15(1)(h), Art. 15(2), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://www.imy.se/tillsyner/sj-ab/","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2022-9442",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/282","AEPD (Spain) - PS-00563-2022","gdprhub","Spain","ES","AEPD (Spain)","2023-06-28","day",2000,"2,000","EUR","GAVANOVA DE IMMOBLES, S.L.",null,"Art. 13, Art. 5(2), Art. 58(2)(d), Art. 83(2), Art. 83(5), Art. 83(5)(b)","Data principles, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00563-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00563-2022",null,"gdprhub",null,null,"gavanova de immobles sl",null,null,null,null,null,null,null,null,null],["2023/IS/011","ETid-1933","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-06-28","day",13400,null,"EUR","Sjúkratyringur Íslands","Health Care","Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.personuvernd.is/urlausnir/lok-mals-i-framhaldi-af-uttekt-hja-sjukratryggingum-islands","https://www.enforcementtracker.com/ETid-1933",null,null,null,null,"IS: sjukratyringur islands",null,null,null,null,null,null,null,null,null],["2023/BE/031","APD/GBA (Belgium) - 87/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-06-27","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 13, Art. 14, Art. 17(1), Art. 27(3)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-87-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_87/2023",null,"gdprhub",null,"Conference organiser",null,null,null,null,null,null,null,null,null,null],["2023/RO/019","ETid-1919","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-06-27","day",2500,null,"EUR","Farmacia Ardealul SRL","Industry and Commerce","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_27_06_2023&lang=ro","https://www.enforcementtracker.com/ETid-1919",null,null,null,null,"farmacia ardealul srl",null,null,null,null,null,null,null,null,null],["2023/ES/139","ETid-1923","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-27","day",1000,null,"EUR","TRC TRUCKS 2020, S.L.","Transportation and Energy","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00035-2023.pdf","https://www.enforcementtracker.com/ETid-1923",null,null,null,null,"trc trucks 2020 sl",null,null,null,null,null,null,null,null,null],["2023/IS/009","ETid-1946","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-06-27","day",24000,null,"EUR","Almennri innheimtu ehf","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.personuvernd.is/urlausnir/sektir-vegna-sendingar-upplysinga-fra-almennri-innheimtu-ehf.-nu-a.i.c.-ehf.-til-skraningar-hja-creditinfo-lanstrausti","https://www.enforcementtracker.com/ETid-1946",null,null,null,null,"almennri innheimtu ehf",null,null,null,null,null,null,null,null,null],["2023/IS/008","ETid-1948","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-06-27","day",51000,null,"EUR","eCommerce 2020 ApS","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.personuvernd.is/urlausnir/sektir-vegna-skraningar-upplysinga-fra-ecommerce-2020-hja-creditinfo-lanstrausti","https://www.enforcementtracker.com/ETid-1948","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2022111927","gdprhub",null,null,"ecommerce 2020 aps",null,null,null,null,null,null,null,null,null],["2023/IS/007","ETid-1952","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2023-06-27","day",257000,null,"EUR","Creditinfo Lánstraust hf.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.personuvernd.is/urlausnir/sekt-vegna-skraningar-upplysinga-hja-creditinfo-lanstrausti-um-vanskil-lana-sem-veitt-voru-af-ecommerce-2020-aps","https://www.enforcementtracker.com/ETid-1952","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2020061901","gdprhub",null,null,"IS: creditinfo lanstraust",null,null,null,null,null,null,null,null,null],["2023/SE/008","ETid-1928","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-06-26","day",1100000,null,"EUR","Bonnier News AB","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.imy.se/nyheter/fel-anvanda-kunders-personuppgifter-for-profilering-utan-samtycke/","https://www.enforcementtracker.com/ETid-1928",null,null,null,null,"bonnier news ab",null,null,null,null,null,null,null,null,null],["2023/SE/018","IMY (Sweden) - DI-2019-11737","gdprhub","Sweden","SE","IMY (Sweden)","2023-06-26","day",null,"13000000","SEK","Bonnier News AB",null,"Art. 4(1), Art. 4(2), Art. 4(4), Art. 4(7), Art. 6, Art. 6(1), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-bonnier-news.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2019-11737",null,"gdprhub",null,null,"bonnier news ab",null,13000000.0,1112776,"day 2023-06-26|11.6825|SEK",null,null,null,null,null],["2023/SE/024","IMY (Sweden) - DI-2019-6523","gdprhub","Sweden","SE","IMY (Sweden)","2023-06-26","day",null,null,null,"Expressen Lifestyle AB",null,"Art. 13(1)(c)","Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-expressen-lifestyle.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2019-6523",null,"gdprhub",null,null,"expressen lifestyle ab",null,null,null,null,null,null,null,null,null],["2023/DK/007","Datatilsynet (Denmark) - 2022-432-0079","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-06-23","day",null,null,null,"Digitaliseringsstyrelsen (Agency for Digital Government)",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/jun/alvorlig-kritik-af-digitaliseringsstyrelsen-for-utilstraekkelig-sikkerhed-ved-mitid","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2022-432-0079",null,"gdprhub",null,null,"DK: digitaliseringsstyrelsen",null,null,null,null,null,null,null,null,null],["2023/ES/142","ETid-1916","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-23","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00623-2022.pdf","https://www.enforcementtracker.com/ETid-1916",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/BE/029","APD/GBA (Belgium) - 81/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-06-22","day",null,null,null,null,null,"Art. 30(2)(a), Art. 38(6), Art. 6(1)(e)","Data protection officer, Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-81-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_81/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/141","ETid-1917","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-22","day",90000,null,"EUR","Corporación de Medios de Extremadura","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00650-2022.pdf","https://www.enforcementtracker.com/ETid-1917",null,null,null,null,"ES: corporacion de medios de extremadura",null,null,null,null,null,null,null,null,null],["2023/ES/140","ETid-1918","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-22","day",90000,null,"EUR","Sociedad Vascongada de Publicaciones, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00650-2022.pdf","https://www.enforcementtracker.com/ETid-1918",null,null,null,null,"sociedad vascongada de publicaciones sa",null,null,null,null,null,null,null,null,null],["2023/IT/045","ETid-2023","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-22","day",1000000,null,"EUR","Autostrade per l'Italia spa","Transportation and Energy","Art. 13, Art. 28, Art. 5(1)(a)","Data principles, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9910120","https://www.enforcementtracker.com/ETid-2023","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9909702","gdprhub",null,null,"autostrade per l italia spa",null,null,null,null,null,null,null,null,null],["2023/HU/001","ETid-2039","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2023-06-22","day",205000,null,"EUR","Digi Telecommunications and Services Ltd.","Media, Telecoms and Broadcasting","Art. 5(1)(a)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=738:digi-tavkozlesi-es-szolgaltato-kft-nel-bekovetkezett-adatvedelmi-incidensben-erintett-adatbazisok-adatbiztonsagi-es-alapelvi-hianyossagai-megismetelt-eljaras","https://www.enforcementtracker.com/ETid-2039",null,null,null,null,"digi telecommunications and services ltd","Digi",null,null,null,null,null,null,null,null],["2023/HU/008","NAIH (Hungary) - NAIH – 6427-1/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-06-22","day",null,"80,000,000","HUF",null,null,"Art. 32, Art. 5(1)(b), Art. 5(1)(e)","Data principles, Data security",null,null,"https://naih.hu/hatarozatok-vegzesek","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH_%E2%80%93_6427-1/2023",null,"gdprhub",null,null,null,null,80000000.0,216550,"day 2023-06-22|369.4300|HUF",null,null,null,null,null],["2023/AT/011","DSB (Austria) - 2022-0.930.971","gdprhub","Austria","AT","DSB (Austria)","2023-06-21","day",null,null,null,null,null,"Art. 89",null,null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230621_2022_0_930_971_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.930.971",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/143","ETid-1903","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-21","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00153-2023.pdf","https://www.enforcementtracker.com/ETid-1903",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/RO/020","ETid-1904","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-06-21","day",1000,null,"EUR","Vodafone Romania SA","Media, Telecoms and Broadcasting","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_21_06_2023&lang=ro","https://www.enforcementtracker.com/ETid-1904",null,null,null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2023/PL/016","ETid-1978","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-06-21","day",7500,null,"EUR","Company",null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DOKE.561.1.2023","https://www.enforcementtracker.com/ETid-1978","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DOKE.561.1.2023","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/GR/031","HDPA (Greece) - 27/2024","gdprhub","Greece","GR","HDPA (Greece)","2023-06-21","day",null,null,null,null,null,"Art. 15(1), Art. 15(3), Art. 5(1)(a), Art. 5(1)(c)","Data principles, Data subject rights",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-10/27_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_27/2024",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/ES/145","ETid-1899","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-20","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00622-2022.pdf","https://www.enforcementtracker.com/ETid-1899",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/144","ETid-1900","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-20","day",50000,null,"EUR","GRUPO TRANSAHER, SL.","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00445-2022.pdf","https://www.enforcementtracker.com/ETid-1900","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202206735","gdprhub",null,null,"grupo transaher sl",null,null,null,null,null,null,null,null,null],["2023/RO/004","ETid-2135","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-06-20","day",40000,null,"EUR","Dante International SA","Industry and Commerce","Art. 12(2), Art. 17(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20.06.2023&lang=ro","https://www.enforcementtracker.com/ETid-2135",null,null,null,null,"dante international sa",null,null,null,null,null,null,null,null,null],["2023/CZ/002","ETid-2833","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2023-06-20","day",1560,null,"EUR","Legal Person",null,"Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/135-cj-uoou-0145722-23-dokument-c-135.pdf","https://www.enforcementtracker.com/ETid-2833",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/030","APD/GBA (Belgium) - 79/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-06-19","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15, Art. 16, Art. 5(1)(d)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-79-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_79/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/155","ETid-1877","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-16","day",2000,null,"EUR",null,"Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00572-2022.pdf","https://www.enforcementtracker.com/ETid-1877",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/001","ETid-1905","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2023-06-16","day",30000,null,"EUR","Belgian Order of Pharmacists","Public Sector and Education",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-77-2023.pdf","https://www.enforcementtracker.com/ETid-1905",null,null,null,null,"BE: belgian order of pharmacists",null,null,null,null,null,null,null,null,null],["2023/IE/002","ETid-1965","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2023-06-16","day",22500,null,"EUR","Irish Departement of Health","Health Care","Art. 5(1)(c), Art. 9(1)","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ie/en/resources/law/decisions/Inquiry-concerning-the-Department-of-Health","https://www.enforcementtracker.com/ETid-1965","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_DPC_Case_Reference%3A_IN-21-3-2","gdprhub",null,null,"IE: irish departement of health",null,null,null,null,null,null,null,null,null],["2023/AT/004","ETid-2076","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2023-06-16","day",1000,null,"EUR",null,"Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20230616_2023_0_404_421_00/DSBT_20230616_2023_0_404_421_00.html","https://www.enforcementtracker.com/ETid-2076","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB_2023-0.404.421","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/FR/014","CNIL (France) - SAN-2023-076","gdprhub","France","FR","CNIL (France)","2023-06-15","day",null,null,null,"Ministry of Interior",null,"Art. 14, Art. 22, Art. 35, Art. 36","DPIA, Data subject rights, Transparency",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000048010337?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-076",null,"gdprhub",null,null,"FR: ministry of interior",null,null,null,null,null,null,null,null,null],["2023/RO/022","ETid-1894","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-06-15","day",2000,null,"EUR","BRD-Groupe Société Générale S.A.","Finance, Insurance and Consulting","Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa2_15.06.2023&lang=ro","https://www.enforcementtracker.com/ETid-1894",null,null,null,null,"brd groupe societe generale sa",null,null,null,null,null,null,null,null,null],["2023/RO/021","ETid-1895","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-06-15","day",8000,null,"EUR","Artima S.A.","Industry and Commerce","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15.06.2023&lang=ro","https://www.enforcementtracker.com/ETid-1895",null,null,null,null,"artima sa",null,null,null,null,null,null,null,null,null],["2023/FR/008","ETid-1912","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-06-15","day",40000000,null,"EUR","CRITEO","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 15(1), Art. 17(1), Art. 26","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/publicite-personnalisee-criteo-sanctionne-dune-amende-de-40-millions-deuros","https://www.enforcementtracker.com/ETid-1912",null,null,null,null,"FR: criteo",null,null,null,null,null,null,null,null,null],["2023/ES/149","ETid-1883","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-14","day",400,null,"EUR",null,null,"Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00018-2023.pdf","https://www.enforcementtracker.com/ETid-1883",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/148","ETid-1884","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-14","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00545-2022.pdf","https://www.enforcementtracker.com/ETid-1884",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/147","ETid-1897","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-14","day",70000,null,"EUR","Digi Spain Telecom, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00502-2022.pdf","https://www.enforcementtracker.com/ETid-1897",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/ES/146","ETid-1898","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-14","day",70000,null,"EUR","Digi Spain Telecom, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00501-2022.pdf","https://www.enforcementtracker.com/ETid-1898",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/GR/019","HDPA (Greece) - 26/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-06-14","day",null,null,null,null,null,"Art. 15","Data subject rights",null,"Rejected","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/aporripsi-aitisis-therapeias-kata-praxis-arheiothetisis-0","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_26/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IS/017","Persónuvernd (Iceland) - 2022030544","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2023-06-14","day",null,null,null,null,null,"Art. 2(2)(c)",null,null,"Rejected","https://www.personuvernd.is/urlausnir/hljodritun-einkasamtala-og-midlun-theirra","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2022030544",null,"gdprhub",null,"Neighbour",null,null,null,null,null,"person",null,null,null,null],["2023/ES/151","ETid-1881","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-13","day",70000,null,"EUR","DIGI SPAIN TELECOM, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00506-2022.pdf","https://www.enforcementtracker.com/ETid-1881",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/ES/150","ETid-1882","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-13","day",70000,null,"EUR","DIGI SPAIN TELECOM, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00507-2022.pdf","https://www.enforcementtracker.com/ETid-1882",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/GR/030","HDPA (Greece) - 38/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-06-13","day",null,null,null,"Google",null,"Art. 17, Art. 2(1), Art. 3(2), Art. 55(1)","Data subject rights",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-04/41_2023%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_38/2023",null,"gdprhub",null,null,"GR: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2023/BE/027","APD/GBA (Belgium) - 72/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-06-12","day",null,null,null,null,null,"Art. 15","Data subject rights",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-72-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_72/2023",null,"gdprhub",null,"Lawyer",null,null,null,null,null,"person",null,null,null,null],["2023/BE/028","APD/GBA (Belgium) - 73/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-06-12","day",null,null,null,"Commissariat Général aux Réfugiés et Apatrides (CGRA)",null,"Art. 4(1), Art. 4(2), Art. 4(7)",null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-73-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_73/2023",null,"gdprhub",null,null,"BE: commissariat general aux refugies et apatrides",null,null,null,null,null,null,null,null,null],["2023/AT/026","DSB (Austria) - DSB-D124.4462","gdprhub","Austria","AT","DSB (Austria)","2023-06-12","day",null,null,null,"Regional Court of Wiener Neustadt (Landesgericht Wiener Neustadt)",null,"Art. 55(3), Art. 77(1)",null,null,"Rejected","https://www.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230612_2021_0_909_100_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.4462",null,"gdprhub",null,null,"AT: regional court of wiener neustadt",null,null,null,null,null,null,null,null,null],["2023/SE/009","ETid-1876","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-06-12","day",4900000,null,"EUR","Spotify","Media, Telecoms and Broadcasting","Art. 12(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.imy.se/nyheter/sanktionsavgift-mot-spotify/","https://www.enforcementtracker.com/ETid-1876",null,null,null,null,"SE: spotify",null,null,null,null,null,null,null,null,null],["2023/GR/007","ETid-1921","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-06-12","day",210000,null,"EUR","Piraeus Bank","Finance, Insurance and Consulting","Art. 15(1), Art. 25(1), Art. 5(1)(a), Art. 6","Accountability, Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-trapeza-gia-paranomi-epexergasia-prosopikon","https://www.enforcementtracker.com/ETid-1921","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_25/2023","gdprhub",null,null,"GR: piraeus bank",null,null,null,null,null,null,null,null,null],["2023/ES/152","ETid-1880","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-09","day",70000,null,"EUR","DIGI SPAIN TELECOM, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00504-2022.pdf","https://www.enforcementtracker.com/ETid-1880",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/ES/153","ETid-1879","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-08","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00684-2022.pdf","https://www.enforcementtracker.com/ETid-1879",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/FR/009","ETid-1891","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-06-08","day",150000,null,"EUR","KG COM","Finance, Insurance and Consulting","Art. 12, Art. 13, Art. 28, Art. 32, Art. 33, Art. 6, Art. 9","Data breach, Data principles, Data security, Processor obligations, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/voyance-en-ligne-la-societe-kg-com-sanctionnee-par-une-amende-de-150-000-euros","https://www.enforcementtracker.com/ETid-1891",null,null,null,null,"kg com",null,null,null,null,null,null,null,null,null],["2023/IT/046","ETid-2022","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-08","day",300000,null,"EUR","Rinascente S.p.A.","Industry and Commerce","Art. 12(1), Art. 35","DPIA, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9910120","https://www.enforcementtracker.com/ETid-2022","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9909907","gdprhub",null,null,"rinascente spa",null,null,null,null,null,null,null,null,null],["2023/IT/010","ETid-2179","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-08","day",40000,null,"EUR","RCS Mediagroup S.p.a.","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9907956","https://www.enforcementtracker.com/ETid-2179","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9907956","gdprhub",null,null,"rcs mediagroup spa",null,null,null,null,null,null,null,null,null],["2023/IT/129","Garante per la protezione dei dati personali (Italy) - 9917900","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-06-08","day",30000,"30,000","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(d), Art. 83, Art. 85, Art. 9","Data principles, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9909715%20","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9917900",null,"gdprhub",null,"Newspaper company",null,null,null,null,null,null,null,null,null,null],["2023/IT/132","Garante per la protezione dei dati personali (Italy) - 9921184","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-06-08","day",null,null,null,"Istituto Nazionale di Statistica",null,"Art. 24, Art. 25, Art. 32, Art. 5(2)","Accountability, Data principles, Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9921184","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9921184",null,"gdprhub",null,null,"IT: istituto nazionale di statistica",null,null,null,null,null,null,null,null,null],["2023/ES/278","AEPD (Spain) - EXP202210346","gdprhub","Spain","ES","AEPD (Spain)","2023-06-07","day",2000,"2000","EUR",null,null,null,null,null,"Violation found","https://www.aepd.es/documento/ps-00079-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202210346",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2023/ES/162","ETid-1863","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-07","day",20000,null,"EUR","RCI BANQUE, S.A. SUCURSAL EN ESPAÑA","Finance, Insurance and Consulting","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00369-2022.pdf","https://www.enforcementtracker.com/ETid-1863",null,null,null,null,"rci banque sa sucursal en espana",null,null,null,null,null,null,null,null,null],["2023/ES/159","ETid-1872","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-07","day",84000,null,"EUR","UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00637-2022.pdf","https://www.enforcementtracker.com/ETid-1872",null,null,null,null,"united parcel service espana ltd y cia src",null,null,null,null,null,null,null,null,null],["2023/ES/154","ETid-1878","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-07","day",400,null,"EUR","LEADDESK, S.L","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00088-2023.pdf","https://www.enforcementtracker.com/ETid-1878",null,null,null,null,"leaddesk sl",null,null,null,null,null,null,null,null,null],["2023/ES/124","ETid-1957","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-07","day",1200,null,"EUR","CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L.","Transportation and Energy","Art. 21(4)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00338-2022.pdf","https://www.enforcementtracker.com/ETid-1957",null,null,null,null,"concentra central de compras y servicios sl",null,null,null,null,null,null,null,null,null],["2023/IT/054","ETid-1990","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-07","day",5000,null,"EUR","Azienda Tutela della Salute della Sardegna","Health Care","Art. 5, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9917883","https://www.enforcementtracker.com/ETid-1990",null,null,null,null,"IT: azienda tutela della salute della sardegna",null,null,null,null,null,null,null,null,null],["2023/RO/023","ETid-1857","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-06-06","day",3000,null,"EUR","S.C. Apollo Salon S.R.L.","Industry and Commerce","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_06_06_2023&lang=ro","https://www.enforcementtracker.com/ETid-1857",null,null,null,null,"apollo salon srl",null,null,null,null,null,null,null,null,null],["2023/ES/165","ETid-1860","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-06","day",56000,null,"EUR","VODAFONE ONO, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00697-2022.pdf","https://www.enforcementtracker.com/ETid-1860",null,null,null,null,"vodafone ono sau","Vodafone",null,null,null,null,null,null,null,null],["2023/ES/158","ETid-1873","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-06","day",70000,null,"EUR","Digi Spain Telecom, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00503-2022.pdf","https://www.enforcementtracker.com/ETid-1873",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/ES/125","ETid-1956","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-06","day",3000,null,"EUR",null,"Individuals and Private Associations","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00475-2022.pdf","https://www.enforcementtracker.com/ETid-1956",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/SI/004","IP (Slovenia) - 06111-1/2023/8","gdprhub","Slovenia","SI","IP (Slovenia)","2023-06-06","day",null,null,null,null,null,"Art. 2(1), Art. 32, Art. 4(1)","Data security",null,"Rejected","https://www.ip-rs.si/","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_06111-1/2023/8",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2023/ES/161","ETid-1864","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-05","day",10000,null,"EUR","ALPA 57 PRODUCCIONES","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00437-2022.pdf","https://www.enforcementtracker.com/ETid-1864",null,null,null,null,"ES: alpa 57 producciones",null,null,null,null,null,null,null,null,null],["2023/ES/166","ETid-1858","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-02","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00487-2022.pdf","https://www.enforcementtracker.com/ETid-1858",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/164","ETid-1861","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-02","day",20000,null,"EUR","QUALITY-PROVIDER S.A.",null,"Art. 17, Art. 6","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00524-2022.pdf","https://www.enforcementtracker.com/ETid-1861",null,null,null,null,"quality provider sa",null,null,null,null,null,null,null,null,null],["2023/PL/015","ETid-1980","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-06-02","day",4300,null,"EUR","Company",null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.38.2022","https://www.enforcementtracker.com/ETid-1980",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/025","APD/GBA (Belgium) - 62/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-06-01","day",null,null,null,null,null,"Art. 6(1)(a)","Unlawful processing",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-62-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_62/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/026","APD/GBA (Belgium) - 63/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-06-01","day",null,null,null,null,null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-nr.-63-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_63/2023",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/ES/163","ETid-1862","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-06-01","day",42000,null,"EUR","PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00025-2023.pdf","https://www.enforcementtracker.com/ETid-1862",null,null,null,null,"ES: pelayo mutua de seguros y reaseguros a prima fija",null,null,null,null,null,null,null,null,null],["2023/IT/055","ETid-1979","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-01","day",3000,null,"EUR","Comune di Napoli","Employment","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9916798","https://www.enforcementtracker.com/ETid-1979",null,null,null,null,"IT: comune di napoli",null,null,null,null,null,null,null,null,null],["2023/IT/053","ETid-1993","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-01","day",15000,null,"EUR","Thin Srl","Health Care","Art. 13, Art. 5(1)(a), Art. 9","Data principles, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9913636","https://www.enforcementtracker.com/ETid-1993",null,null,null,null,"thin srl",null,null,null,null,null,null,null,null,null],["2023/IT/052","ETid-1994","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-01","day",20000,null,"EUR","Ew Business Machines S.p.A.","Employment","Art. 13, Art. 9","Data principles, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9913636","https://www.enforcementtracker.com/ETid-1994",null,null,null,null,"ew business machines spa",null,null,null,null,null,null,null,null,null],["2023/IT/051","ETid-1997","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-01","day",10000,null,"EUR","Camedi s.r.l.","Health Care","Art. 32, Art. 5, Art. 9","Data principles, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9910862","https://www.enforcementtracker.com/ETid-1997",null,null,null,null,"camedi srl",null,null,null,null,null,null,null,null,null],["2023/IT/050","ETid-2000","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-06-01","day",20000,null,"EUR","Azienda Usl Toscana Sud Est.","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9918905","https://www.enforcementtracker.com/ETid-2000",null,null,null,null,"IT: azienda usl toscana sud est",null,null,null,null,null,null,null,null,null],["2023/IT/131","Garante per la protezione dei dati personali (Italy) - 9917820","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-06-01","day",20000,"20,000","EUR","Cooperjob S.p.A",null,"Art. 12(3), Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9917820","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9917820",null,"gdprhub",null,null,"cooperjob spa",null,null,null,null,null,null,null,null,null],["2023/DE/032","ETid-1856","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2023-05-31","day",300000,null,"EUR","Deutsche Kreditbank","Finance, Insurance and Consulting","Art. 15(1)(h), Art. 22(3), Art. 5(1)(a)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.datenschutz-berlin.de/pressemitteilung/computer-sagt-nein","https://www.enforcementtracker.com/ETid-1856",null,null,null,null,"DE: deutsche kreditbank",null,null,null,null,null,null,null,null,null],["2023/ES/160","ETid-1865","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-31","day",500,null,"EUR","Website operator",null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00528-2022.pdf","https://www.enforcementtracker.com/ETid-1865",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/PL/017","ETid-1961","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-05-31","day",10600,null,"EUR","Company",null,"Art. 25(1), Art. 33(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.8.2021","https://www.enforcementtracker.com/ETid-1961",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/PL/014","ETid-1981","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-05-31","day",2300,null,"EUR","Company",null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.37.2022","https://www.enforcementtracker.com/ETid-1981",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/GB/004","ICO (UK) - Thames Valley Police","gdprhub","United Kingdom","GB","ICO (UK)","2023-05-30","day",null,null,null,"Thames Valley Police",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/reprimands/4025394/tvp-reprimand-20230530.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Thames_Valley_Police",null,"gdprhub",null,null,"GB: thames valley police",null,null,null,null,null,null,null,null,null],["2023/FI/013","Tietosuojavaltuutetun toimisto (Finland) - 3831/161/21","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-05-30","day",null,null,null,"Kesko Oyj",null,"Art. 13(2)(a), Art. 25(1), Art. 25(2), Art. 5(1)(e), Art. 58(2)(b), Art. 58(2)(d), Art. 83, Art. 9","Accountability, Data principles, Special categories, Transparency",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2023/20232023","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3831/161/21",null,"gdprhub",null,null,"kesko oyj",null,null,null,null,null,null,null,null,null],["2023/GR/006","ETid-1922","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-05-29","day",150000,null,"EUR","NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε.,","Media, Telecoms and Broadcasting","Art. 15(1), Art. 21(3), Art. 25(1)","Accountability, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/entoli-symmorfosis-kai-epiboli-prostimoy-se-tilepikoinoniako-paroho-gia","https://www.enforcementtracker.com/ETid-1922","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_20/2023","gdprhub",null,null,"GR: nova telecommunications and media",null,null,null,null,null,null,null,null,null],["2023/ES/130","ETid-1947","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-29","day",180,null,"EUR","CARROZADOS TECAI, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00641-2022.pdf","https://www.enforcementtracker.com/ETid-1947",null,null,null,null,"carrozados tecai sl",null,null,null,null,null,null,null,null,null],["2023/ES/126","ETid-1955","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-29","day",300,null,"EUR","CBHNOS S.L.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00669-2022.pdf","https://www.enforcementtracker.com/ETid-1955",null,null,null,null,"cbhnos sl",null,null,null,null,null,null,null,null,null],["2023/ES/171","ETid-1851","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-25","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00576-2022.pdf","https://www.enforcementtracker.com/ETid-1851",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/170","ETid-1852","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-25","day",480,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00249-2022.pdf","https://www.enforcementtracker.com/ETid-1852",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/BE/024","APD/GBA (Belgium) - 60/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-05-24","day",null,null,null,null,null,"Art. 12, Art. 12(1), Art. 12(2), Art. 13, Art. 13(1), Art. 13(2), Art. 14, Art. 24(1), Art. 24(2), Art. 25(1), Art. 25(2), Art. 5(1)(a), Art. 5(2), Art. 6(1), Art. 6(1)(a), Art. 6(1)(f)","Accountability, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-60-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_60/2023",null,"gdprhub",null,"Supermarket",null,null,null,null,null,null,null,null,null,null],["2023/BE/023","APD/GBA (Belgium) - 61/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-05-24","day",null,null,null,"SPF Finances",null,"Art. 12, Art. 13, Art. 14, Art. 17(1)(d), Art. 18(1)(b), Art. 24, Art. 35, Art. 46, Art. 5, Art. 58(2)(f), Art. 6, Art. 96","Accountability, DPIA, Data principles, Data subject rights, International transfers, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-61-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_61/2023",null,"gdprhub",null,null,"BE: spf finances",null,null,null,null,null,null,null,null,null],["2023/ES/169","ETid-1853","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-24","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00421-2022.pdf","https://www.enforcementtracker.com/ETid-1853",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/168","ETid-1854","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-24","day",3000,null,"EUR","NORDETIA CLINICS IBERIA, S.L.","Health Care","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00639-2022.pdf","https://www.enforcementtracker.com/ETid-1854",null,null,null,null,"nordetia clinics iberia sl",null,null,null,null,null,null,null,null,null],["2023/SI/002","IP (Slovenia) - 0611-182/2021/23","gdprhub","Slovenia","SI","IP (Slovenia)","2023-05-24","day",null,null,null,null,null,"Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing",null,null,"https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2023/Avgust/Avgust_2023%2520-%2520Odlocbe_ZIN.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0611-182/2021/23",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2023/NL/004","AP (The Netherlands) - z2021-13185 / z2022-07180","gdprhub","Netherlands","NL","AP (The Netherlands)","2023-05-23","day",null,null,null,"Jigler Payroll B.V.",null,"Art. 28, Art. 46, Art. 6","International transfers, Processor obligations, Unlawful processing",null,"Rejected","https://drive.google.com/file/d/1_sfb0MwyAk8us-GOKF7iwM-bqjGD2qjA/view?usp=share_link","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_z2021-13185_/_z2022-07180",null,"gdprhub",null,null,"jigler payroll bv",null,null,null,null,null,null,null,null,null],["2023/RO/024","ETid-1850","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-05-23","day",1000,null,"EUR","Global Baby Brand SRL","Industry and Commerce","Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23.05.2023&lang=ro","https://www.enforcementtracker.com/ETid-1850",null,null,null,null,"global baby brand srl",null,null,null,null,null,null,null,null,null],["2023/ES/157","ETid-1874","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-23","day",70000,null,"EUR","Digi Spain Telecom, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00500-2022.pdf","https://www.enforcementtracker.com/ETid-1874","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202205932","gdprhub",null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/LV/001","DVI (Latvia) - Nacionālajam veselības dienestam","gdprhub","Latvia","LV","DVI (Latvia)","2023-05-22","day",null,null,null,null,null,"Art. 24(1), Art. 32(1)(b)","Accountability, Data security",null,"Violation found","https://www.dvi.gov.lv/lv/media/2343/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_Nacion%C4%81lajam_vesel%C4%ABbas_dienestam",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/SE/023","IMY (Sweden) - IMY-2022-9109","gdprhub","Sweden","SE","IMY (Sweden)","2023-05-22","day",null,null,null,"MAG Interactive AB",null,"Art. 12(2), Art. 12(6)","Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-mag-interactive-ab.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2022-9109",null,"gdprhub",null,null,"mag interactive ab",null,null,null,null,null,null,null,null,null],["2023/ES/288","CTPDA (Spain) - RPS-2023/007","gdprhub","Spain","ES","CTPDA (Andalusia)","2023-05-18","day",null,null,null,null,null,"Art. 13, Art. 6(1)(c), Art. 6(1)(f)","Transparency, Unlawful processing",null,"Violation found","https://www.ctpdandalucia.es/sites/default/files/resoluciones-pd/rps-2023-007.pdf","https://gdprhub.eu/index.php?title=CTPDA_%28Spain%29_-_RPS-2023/007",null,"gdprhub",null,"Education department",null,null,null,null,null,null,null,null,null,null],["2023/RO/025","ETid-1849","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-05-18","day",18000,null,"EUR","AUTOMOBILE BAVARIA SRL","Industry and Commerce","Art. 25(1), Art. 32(2)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_18_05_2023&lang=ro","https://www.enforcementtracker.com/ETid-1849",null,null,null,null,"automobile bavaria srl",null,null,null,null,null,null,null,null,null],["2023/HR/006","ETid-1859","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2023-05-18","day",380000,null,"EUR","Sports betting operator","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/an-administrative-fine-of-380000-eur-imposed-to-the-sports-betting-company/","https://www.enforcementtracker.com/ETid-1859",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/285","AEPD (Spain) - EXP202303792","gdprhub","Spain","ES","AEPD (Spain)","2023-05-17","day",48000,"48000","EUR","Birou Gas, S.L",null,"Art. 58(1), Art. 83(2)(b), Art. 83(2)(k)",null,null,"Violation found","https://www.aepd.es/documento/ps-00135-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202303792",null,"gdprhub",null,null,"birou gas sl",null,null,null,null,null,null,null,null,null],["2023/BE/022","APD/GBA (Belgium) - 57/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-05-17","day",40000,"40,000","EUR",null,null,"Art. 12(1), Art. 12(2), Art. 13(1)(c), Art. 13(2)(a), Art. 15, Art. 5(1)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-57-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_57/2023",null,"gdprhub",null,"Content creator",null,null,null,null,null,"person",null,null,null,null],["2023/ES/167","ETid-1855","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-17","day",900,null,"EUR","WILLOUGHBY COLLEGE, S.A","Public Sector and Education","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00083-2023.pdf","https://www.enforcementtracker.com/ETid-1855",null,null,null,null,"willoughby college sa",null,null,null,null,null,null,null,null,null],["2023/ES/156","ETid-1875","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-17","day",50000,null,"EUR","FUSIONA SOLUCIONES ENERGÉTICAS, S.A.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00586-2022.pdf","https://www.enforcementtracker.com/ETid-1875","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202205104","gdprhub",null,null,"fusiona soluciones energeticas sa",null,null,null,null,null,null,null,null,null],["2023/IT/071","ETid-1913","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-05-17","day",40000,null,"EUR","Volkswagen Leasing GmbH","Industry and Commerce","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9899914","https://www.enforcementtracker.com/ETid-1913","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9899914","gdprhub",null,null,"volkswagen leasing gmbh",null,null,null,null,null,null,null,null,null],["2023/IT/068","ETid-1920","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-05-17","day",10000,null,"EUR","Azienda ULSS 6 Euganea","Health Care","Art. 32, Art. 5, Art. 6","Data principles, Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9899946","https://www.enforcementtracker.com/ETid-1920",null,null,null,null,"IT: azienda ulss 6 euganea",null,null,null,null,null,null,null,null,null],["2023/IT/061","ETid-1932","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-05-17","day",10000,null,"EUR","Grizzaffi Management Srl","Industry and Commerce","Art. 17, Art. 21, Art. 5(1)(a)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9899880","https://www.enforcementtracker.com/ETid-1932",null,null,null,null,"grizzaffi management srl",null,null,null,null,null,null,null,null,null],["2023/IT/060","ETid-1935","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-05-17","day",60000,null,"EUR","Website operator",null,"Art. 13, Art. 15, Art. 16, Art. 24, Art. 25, Art. 5(2), Art. 6","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9903067","https://www.enforcementtracker.com/ETid-1935",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/059","ETid-1950","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-05-17","day",10000,null,"EUR","Santander Consumer Bank S.p.a.","Finance, Insurance and Consulting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9902499","https://www.enforcementtracker.com/ETid-1950",null,null,null,null,"santander consumer bank spa","Santander",null,null,null,null,null,null,null,null],["2023/IT/057","ETid-1976","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-05-17","day",10000,null,"EUR","La Gazzetta di Parma S.r.l.","Media, Telecoms and Broadcasting","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9908394","https://www.enforcementtracker.com/ETid-1976",null,null,null,null,"la gazzetta di parma srl",null,null,null,null,null,null,null,null,null],["2023/DE/037","LfD (Lower Saxony) - 4.2 05475-02-0301/21","gdprhub","Germany","DE","LfD (Lower Saxony)","2023-05-17","day",null,null,null,"www.heise.de",null,"Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://noyb.eu/sites/default/files/2023-07/11VerwarnungPurAboModellfinalgeschwrztp_Redacted.pdf","https://gdprhub.eu/index.php?title=LfD_%28Lower_Saxony%29_-_4.2_05475-02-0301/21",null,"gdprhub",null,null,"DE: www heise de",null,null,null,null,null,null,null,null,null],["2023/RO/026","ETid-1848","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-05-16","day",5000,null,"EUR","Compania Națională Poșta Română S.A.","Transportation and Energy","Art. 5(1)(a), Art. 5(2), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16.05.2023&lang=ro","https://www.enforcementtracker.com/ETid-1848",null,null,null,null,"RO: compania nationala posta romana",null,null,null,null,null,null,null,null,null],["2023/PL/018","ETid-1929","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-05-16","day",6700,null,"EUR","Municipality","Public Sector and Education","Art. 24(1), Art. 25(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/2764","https://www.enforcementtracker.com/ETid-1929",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/MT/003","IDPC (Malta) - COMP/138/2022","gdprhub","Malta","MT","IDPC (Malta)","2023-05-16","day",null,null,null,"C-Planet",null,"Art. 15(1), Art. 15(3)","Data subject rights",null,"Violation found","https://gdprhub.eu/images/1/16/CDP_COMP_138_2022.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_COMP/138/2022",null,"gdprhub",null,null,"MT: c planet",null,null,null,null,null,null,null,null,null],["2023/IE/003","ETid-1844","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2023-05-12","day",1200000000,null,"EUR","Meta Platforms Ireland Limited","Media, Telecoms and Broadcasting","Art. 46(1)","International transfers, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://dataprotection.ie/en/news-media/press-releases/Data-Protection-Commission-announces-conclusion-of-inquiry-into-Meta-Ireland","https://www.enforcementtracker.com/ETid-1844","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-20-8-1","gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2023/RO/028","ETid-1846","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-05-12","day",1500,null,"EUR","NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A.","Finance, Insurance and Consulting","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_12_05_2023&lang=ro","https://www.enforcementtracker.com/ETid-1846",null,null,null,null,"nn pensii societate de administrare a unui fond de pensii administrat privat sa",null,null,null,null,null,null,null,null,null],["2023/RO/027","ETid-1847","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-05-12","day",1000,null,"EUR","NN Asigurări de Viață S.A.","Finance, Insurance and Consulting","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_12_05_2023&lang=ro","https://www.enforcementtracker.com/ETid-1847",null,null,null,null,"nn asigurari de viata sa",null,null,null,null,null,null,null,null,null],["2023/FR/013","CNIL (France) - SAN-2023-006","gdprhub","France","FR","CNIL (France)","2023-05-11","day",380000,"380,000","EUR","Doctissimo",null,"Art. 26, Art. 32, Art. 5(1)(e), Art. 9(2)","Data principles, Data security, Special categories",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047552103?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-006",null,"gdprhub",null,null,"FR: doctissimo",null,null,null,null,null,null,null,null,null],["2023/RO/029","ETid-1845","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-05-11","day",11000,null,"EUR","Libra Internet Bank SA","Finance, Insurance and Consulting","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_11_05_2023&lang=ro","https://www.enforcementtracker.com/ETid-1845",null,null,null,null,"libra internet bank sa",null,null,null,null,null,null,null,null,null],["2023/FR/010","ETid-1839","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-05-10","day",5200000,null,"EUR","Clearview AI","Industry and Commerce",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.cnil.fr/en/facial-recognition-cnil-imposes-penalty-payment-clearview-ai","https://www.enforcementtracker.com/ETid-1839",null,null,null,null,"FR: clearview ai","Clearview AI",null,null,null,null,null,null,null,null],["2023/AT/008","DSB (Austria) - 2022-0.277.156","gdprhub","Austria","AT","DSB (Austria)","2023-05-09","day",null,null,null,"Clearview AI",null,"Art. 3(2)(b)",null,null,"Violation found","https://noyb.eu/sites/default/files/2023-05/Clearview%20Decision%20Redacted.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.277.156",null,"gdprhub",null,null,"AT: clearview ai","Clearview AI",null,null,null,null,null,null,null,null],["2023/ES/173","ETid-1826","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-09","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00642-2022.pdf","https://www.enforcementtracker.com/ETid-1826",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/172","ETid-1827","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-09","day",5000,null,"EUR","ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U.","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00509-2022.pdf","https://www.enforcementtracker.com/ETid-1827",null,null,null,null,"estudio inmobiliario san isidro slu",null,null,null,null,null,null,null,null,null],["2023/ES/176","ETid-1809","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-05","day",1200,null,"EUR","FUNDACIÓ PRIVADA UNIVERSITARIA EADA","Public Sector and Education","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00009-2023.pdf","https://www.enforcementtracker.com/ETid-1809",null,null,null,null,"ES: fundacio privada universitaria eada",null,null,null,null,null,null,null,null,null],["2023/ES/175","ETid-1810","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-05","day",2000,null,"EUR","Homeowners' association","Individuals and Private Associations","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00379-2022.pdf","https://www.enforcementtracker.com/ETid-1810","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202204461","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/PL/019","ETid-1908","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-05-05","day",2200,null,"EUR","Municipality","Public Sector and Education","Art. 25(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/2746","https://www.enforcementtracker.com/ETid-1908",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/CY/010","Commissioner (Cyprus) - 11.17.001.010.199","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2023-05-04","day",null,null,null,null,null,"Art. 2(2)(c), Art. 31, Art. 4(1), Art. 4(11), Art. 4(2), Art. 4(7), Art. 58, Art. 6, Art. 9","Special categories, Unlawful processing",null,"Violation found","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/AB0419759D932D4BC22589A300345448/$file/%25CE%259A%25CE%25B1%25CF%2584%25CE%25B1%25CE%25B3%25CE%25B3%25CE%25B5%25CE%25BB%25CE%25AF%25CE%25B1%2520%25CE%25B3%25CE%25B9%25CE%25B1%2520%25CE%25B1%25CF%2580%25CE%25BF%25CE%25BA%25CE%25AC%25CE%25BB%25CF%2585%25CF%2588%25CE%25B7%2520%25CF%2580%25CF%2581%25CE%25BF%25CF%2583%25CF%2589%25CF%2580%25CE%25B9%25CE%25BA%25CF%258E%25CE%25BD%2520%25CE%25B4%25CE%25B5%25CE%25B4%25CE%25BF%25CE%25BC%25CE%25AD%25CE%25BD%25CF%2589%25CE%25BD%2520%25CE%25B4%25CE%25B9%25CE%25B1%25CE%25B4%25CE%25B9%25CE%25BA%25CF%2584%25CF%2585%25CE%25B1%25CE%25BA%25CE%25AC.pdf?openelement","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.010.199",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/HR/007","ETid-1816","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2023-05-04","day",2265000,null,"EUR","Debt collection agency","Finance, Insurance and Consulting","Art. 13(1), Art. 28(3), Art. 32(2), Art. 6(1)","Data security, Processor obligations, Transparency, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/an-administrative-fine-in-the-amount-of-2-26-million-eur-imposed-to-the-debt-collection-agency/","https://www.enforcementtracker.com/ETid-1816","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_04-05-2023","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/CZ/004","ETid-2829","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2023-05-04","day",3810,null,"EUR","Legal Person",null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/160-cj-uoou-0352321-14-dokument-c-160.pdf","https://www.enforcementtracker.com/ETid-2829",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/178","ETid-1803","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-03","day",5000,null,"EUR","BANQUETES SANTA ANA, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00298-2022.pdf","https://www.enforcementtracker.com/ETid-1803",null,null,null,null,"banquetes santa ana sl",null,null,null,null,null,null,null,null,null],["2023/ES/177","ETid-1806","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-05-03","day",200000,null,"EUR","GSMA LTD.",null,"Art. 35","DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00553-2021.pdf","https://www.enforcementtracker.com/ETid-1806",null,null,null,null,"gsma ltd",null,null,null,null,null,null,null,null,null],["2023/CY/006","ETid-1819","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023-05-02","day",9000,null,"EUR","NAGA Markets Europe Ltd","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/763475FDB8DB72E8C22589A300322768?OpenDocument","https://www.enforcementtracker.com/ETid-1819",null,null,null,null,"naga markets europe ltd",null,null,null,null,null,null,null,null,null],["2023/BE/019","APD/GBA (Belgium) - 49/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-04-28","day",null,null,null,null,null,"Art. 6(1)(e), Art. 9(1)","Special categories, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-49-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_49/2023",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2023/ES/181","ETid-1798","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-28","day",12000,null,"EUR","ALBERO FORTE COMPOSITE, S.L.","Employment","Art. 35","DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00597-2022.pdf","https://www.enforcementtracker.com/ETid-1798",null,null,null,null,"albero forte composite sl",null,null,null,null,null,null,null,null,null],["2023/ES/180","ETid-1799","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-28","day",5000,null,"EUR","INFINITY ECOM S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00393-2022.pdf","https://www.enforcementtracker.com/ETid-1799",null,null,null,null,"infinity ecom sl",null,null,null,null,null,null,null,null,null],["2023/ES/174","ETid-1820","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-28","day",2000,null,"EUR","ASSOCIACIO DE CAÇADORS D'ALZIRA","Individuals and Private Associations","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00353-2022.pdf","https://www.enforcementtracker.com/ETid-1820","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202205353","gdprhub",null,null,"ES: associacio de cacadors d alzira",null,null,null,null,null,null,null,null,null],["2023/HU/007","NAIH (Hungary) - NAIH/4410-1/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-04-28","day",null,"50000","HUF",null,null,"Art. 13(1), Art. 13(2), Art. 6(1)(f)","Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=692:kameras-adatkezeles-szolariumban","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/4410-1/2023",null,"gdprhub",null,"Solarium studio",null,null,50000.0,134,"day 2023-04-28|373.7800|HUF",null,null,null,null,null],["2023/BE/021","APD/GBA (Belgium) - 45/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-04-27","day",null,null,null,"la mutualité Y",null,"Art. 20(3), Art. 6(1)(a), Art. 6(1)(b), Art. 9(2)(a)","Data subject rights, Special categories, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-45-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_45/2023",null,"gdprhub",null,null,"BE: la mutualite y",null,null,null,null,null,null,null,null,null],["2023/BE/020","APD/GBA (Belgium) - 47/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-04-27","day",null,null,null,null,null,null,null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-47-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_47/2023",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/IT/072","ETid-1896","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-27","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9896468","https://www.enforcementtracker.com/ETid-1896",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IT/070","ETid-1914","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-27","day",176000,null,"EUR","Roma Capitale","Public Sector and Education","Art. 28, Art. 29, Art. 32, Art. 9","Data principles, Data security, Processor obligations, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9899946","https://www.enforcementtracker.com/ETid-1914",null,null,null,null,"IT: roma capitale",null,null,null,null,null,null,null,null,null],["2023/IT/069","ETid-1915","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-27","day",239000,null,"EUR","Ama S.p.a.","Public Sector and Education","Art. 28, Art. 29, Art. 32","Data security, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9899946","https://www.enforcementtracker.com/ETid-1915","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9900808","gdprhub",null,null,"ama spa",null,null,null,null,null,null,null,null,null],["2023/IT/066","ETid-1925","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-27","day",15000,null,"EUR","Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9896845","https://www.enforcementtracker.com/ETid-1925",null,null,null,null,"IT: ufficio scolastico regionale per la puglia ufficio vi ambito territoriale di lecce",null,null,null,null,null,null,null,null,null],["2023/IT/063","ETid-1930","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-27","day",2000,null,"EUR","Store owner","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9903911","https://www.enforcementtracker.com/ETid-1930",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/062","ETid-1931","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-27","day",240000,null,"EUR","Benetton Group S.r.l.","Industry and Commerce","Art. 32(2)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9903191","https://www.enforcementtracker.com/ETid-1931","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9902472","gdprhub",null,null,"benetton group srl",null,null,null,null,null,null,null,null,null],["2023/IT/058","ETid-1951","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-27","day",4000,null,"EUR","Università degli studi di Cassino e del Lazio Meridionale","Public Sector and Education","Art. 10, Art. 5(1)(a), Art. 6","Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9897931","https://www.enforcementtracker.com/ETid-1951",null,null,null,null,"IT: universita degli studi di cassino e del lazio meridionale",null,null,null,null,null,null,null,null,null],["2023/IT/140","Garante per la protezione dei dati personali (Italy) - 9909235","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-04-27","day",40000,"40000","EUR",null,null,"Art. 13, Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(e), Art. 5(1)(f)","Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9909235","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9909235",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/GB/003","ICO (UK) - Ministry of Justice (1)","gdprhub","United Kingdom","GB","ICO (UK)","2023-04-27","day",null,null,null,"Ministry of Justice",null,"Art. 32(1), Art. 32(2), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://ico.org.uk/media/action-weve-taken/reprimands/4025227/20230524-reprimand-moj_redacted.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Ministry_of_Justice_%281%29",null,"gdprhub",null,null,"GB: ministry of justice",null,null,null,null,null,null,null,null,null],["2023/FI/007","Tietosuojavaltuutetun toimisto (Finland) - 7684/171/22","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-04-27","day",null,null,null,"Ilmatieteenlaitos",null,"Art. 35, Art. 35(1), Art. 44, Art. 46","DPIA, International transfers",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2023/20231823","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_7684/171/22",null,"gdprhub",null,null,"FI: ilmatieteenlaitos",null,null,null,null,null,null,null,null,null],["2023/NO/004","Datatilsynet (Norway) - 22/03622","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-04-26","day",null,null,null,"Statistics Norway",null,"Art. 5(1)(c), Art. 58(2)(f), Art. 6(3)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/forbud-mot-behandling-av-personopplysninger-for-ssb/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_22/03622",null,"gdprhub",null,null,"NO: statistics norway",null,null,null,null,null,null,null,null,null],["2023/SE/010","ETid-1787","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2023-04-26","day",17600,null,"EUR","Skåne region","Public Sector and Education","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-region-skane.pdf","https://www.enforcementtracker.com/ETid-1787",null,null,null,null,"SE: skane region",null,null,null,null,null,null,null,null,null],["2023/ES/183","ETid-1792","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-26","day",1000,null,"EUR","Website operator",null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00649-2022.pdf","https://www.enforcementtracker.com/ETid-1792",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/NO/011","Datatilsynet (Norway) - PVN-2023-01","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-04-25","day",null,null,null,"Getaround Norway AS (formerly Nabobil.no AS)",null,"Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://pvn.no/pvn-2023-01","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_PVN-2023-01",null,"gdprhub",null,null,"getaround norway as",null,null,null,null,null,null,null,null,null],["2023/ES/185","ETid-1790","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-25","day",70000,null,"EUR","DIGI SPAIN TELECOM, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00505-2022.pdf","https://www.enforcementtracker.com/ETid-1790",null,null,null,null,"digi spain telecom sl","Digi",null,null,null,null,null,null,null,null],["2023/ES/182","ETid-1793","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-25","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00226-2022.pdf","https://www.enforcementtracker.com/ETid-1793",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/RO/030","ETid-1784","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-04-24","day",1000,null,"EUR","Tensa Art Design SA","Industry and Commerce","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_24_04_2023&lang=ro","https://www.enforcementtracker.com/ETid-1784",null,null,null,null,"tensa art design sa",null,null,null,null,null,null,null,null,null],["2023/ES/184","ETid-1791","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-24","day",70000,null,"EUR","Telefónica Móviles España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00443-2022.pdf","https://www.enforcementtracker.com/ETid-1791",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2023/ES/186","ETid-1789","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-21","day",25000,null,"EUR","SECURITAS DIREC ESPAÑA, S.A.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00281-2022.pdf","https://www.enforcementtracker.com/ETid-1789","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00281/2022","gdprhub",null,null,"securitas direc espana sa",null,null,null,null,null,null,null,null,null],["2023/DK/005","Datatilsynet (Denmark) - 2021-7329-0052","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-04-20","day",null,null,null,null,null,"Art. 26, Art. 44","International transfers",null,"Violation found","https://noyb.eu/sites/default/files/2023-05/DK_SA_final_decision_Redacted.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-7329-0052",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/187","ETid-1785","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-20","day",25000,null,"EUR","KFC RESTAURANTS SPAIN, S.L.","Industry and Commerce","Art. 13, Art. 37","Data protection officer, Transparency","Insufficient involvement of data protection officer","Fine issued","https://www.aepd.es/es/documento/ps-00140-2022.pdf","https://www.enforcementtracker.com/ETid-1785",null,null,null,null,"kfc restaurants spain sl",null,null,null,null,null,null,null,null,null],["2023/LT/002","ETid-1973","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2023-04-20","day",20000,null,"EUR","Company",null,null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/Apibendrinimas%20d%C4%97l%20saugumo%20priemoniu%20neuztikrinimo%20ir%20terminu%202023-04-20.pdf","https://www.enforcementtracker.com/ETid-1973",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/PL/006","ETid-2181","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-04-20","day",5400,null,"EUR","Disciplinary officer","Public Sector and Education","Art. 25(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.31.2022","https://www.enforcementtracker.com/ETid-2181",null,null,null,null,"PL: disciplinary officer",null,null,null,null,null,null,null,null,null],["2023/RO/031","ETid-1777","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-04-19","day",3000,null,"EUR","Partidul Uniunea Salvați România","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_19.04.2023&lang=ro","https://www.enforcementtracker.com/ETid-1777",null,null,null,null,"RO: partidul uniunea salvati romania",null,null,null,null,null,null,null,null,null],["2023/BE/018","APD/GBA (Belgium) - 42/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-04-17","day",null,null,null,null,null,"Art. 17, Art. 17(1), Art. 17(3), Art. 9(2)(h)","Data subject rights, Special categories",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-42-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_42/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/CZ/001","ETid-2836","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2023-04-17","day",600,null,"EUR","Legal Person","Transportation and Energy","Art. 12(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/128-cj-uoou-0087223-4-dokument-c-128.pdf","https://www.enforcementtracker.com/ETid-2836",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/017","APD/GBA (Belgium) - 41/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-04-14","day",null,null,null,null,null,"Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-41-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_41/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/074","ETid-1892","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-14","day",237800,null,"EUR","Green Network S.p.A.","Transportation and Energy","Art. 25, Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9894631","https://www.enforcementtracker.com/ETid-1892",null,null,null,null,"green network spa",null,null,null,null,null,null,null,null,null],["2023/IT/073","ETid-1893","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-14","day",676956,null,"EUR","Sorgenia S.p.a.","Transportation and Energy","Art. 12(3), Art. 25, Art. 5(2)","Accountability, Data principles, Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9893693","https://www.enforcementtracker.com/ETid-1893",null,null,null,null,"sorgenia spa",null,null,null,null,null,null,null,null,null],["2023/IT/056","ETid-1977","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-14","day",15000,null,"EUR","Citynews S.p.A.","Media, Telecoms and Broadcasting","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9897055","https://www.enforcementtracker.com/ETid-1977","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9897055","gdprhub",null,null,"citynews spa",null,null,null,null,null,null,null,null,null],["2023/DK/006","Datatilsynet (Denmark) - 2021-431-0149","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-04-13","day",null,null,null,"Gyldendal A/S",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/apr/kritik-af-gyldendal-as-for-ikke-at-leve-op-til-kravet-om-passende-sikkerhed","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0149",null,"gdprhub",null,null,"gyldendal as",null,null,null,null,null,null,null,null,null],["2023/ES/191","ETid-1772","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-13","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00415-2022.pdf","https://www.enforcementtracker.com/ETid-1772",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/190","ETid-1773","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-13","day",112000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00665-2022.pdf","https://www.enforcementtracker.com/ETid-1773",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/IT/075","ETid-1871","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-13","day",7631175,null,"EUR","TIM S.p.A.","Media, Telecoms and Broadcasting","Art. 13, Art. 14, Art. 15(1), Art. 32(1)(b), Art. 5(2), Art. 6","Data principles, Data security, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9895080","https://www.enforcementtracker.com/ETid-1871",null,null,null,null,"tim spa",null,null,null,null,null,null,null,null,null],["2023/IT/065","ETid-1926","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-13","day",3000,null,"EUR","Comune di Cogollo del Cengio","Employment","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9890273","https://www.enforcementtracker.com/ETid-1926",null,null,null,null,"IT: comune di cogollo del cengio",null,null,null,null,null,null,null,null,null],["2023/IT/064","ETid-1927","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-13","day",13000,null,"EUR","Azienda socio sanitaria locale n. 3 di Nuoro","Health Care","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9891029","https://www.enforcementtracker.com/ETid-1927",null,null,null,null,"IT: azienda socio sanitaria locale n3 di nuoro",null,null,null,null,null,null,null,null,null],["2023/IT/002","ETid-2307","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-13","day",500000,null,"EUR","Mas s.r.l.","Industry and Commerce","Art. 13, Art. 28, Art. 29, Art. 30, Art. 5(1)(a), Art. 6, Art. 7","Consent, Data principles, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9894024","https://www.enforcementtracker.com/ETid-2307",null,null,null,null,"mas srl",null,null,null,null,null,null,null,null,null],["2023/IT/001","ETid-2308","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-04-13","day",200000,null,"EUR","Mas s.r.l.s.","Industry and Commerce","Art. 13, Art. 28, Art. 29, Art. 30, Art. 5(1)(a), Art. 5(2), Art. 6, Art. 7","Consent, Data principles, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9894024","https://www.enforcementtracker.com/ETid-2308",null,null,null,null,"mas srl",null,null,null,null,null,null,null,null,null],["2023/IT/120","Garante per la protezione dei dati personali (Italy) - 9889644","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-04-13","day",20000,"20,000","EUR","Ordine degli avvocati di Ancona",null,"Art. 13, Art. 25, Art. 5(1)(f), Art. 6(1)","Accountability, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9889644","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9889644",null,"gdprhub",null,null,"IT: ordine degli avvocati di ancona",null,null,null,null,null,null,null,null,null],["2023/IT/118","Garante per la protezione dei dati personali (Italy) - 9891673","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-04-13","day",15000,"15,000","EUR",null,null,"Art. 13, Art. 5(1)(a)","Data principles, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9891673","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9891673",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2023/IT/119","Garante per la protezione dei dati personali (Italy) - 9893718","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-04-13","day",1800000,"1.800.000","EUR","Arnia SocCoop",null,"Art. 13, Art. 28, Art. 29, Art. 30, Art. 32, Art. 5(1), Art. 5(1)(a), Art. 5(2), Art. 6, Art. 7","Consent, Data principles, Data security, Processor obligations, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9893718","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9893718",null,"gdprhub",null,null,"IT: arnia soccoop",null,null,null,null,null,null,null,null,null],["2023/IT/123","Garante per la protezione dei dati personali (Italy) - 9896808;","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-04-13","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 26, Art. 5(1)(a), Art. 6","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9896808","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9896808%3B",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2023/HU/003","ETid-1804","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2023-04-12","day",253000,null,"EUR","Aldi","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://hvg.hu/kkv/20230411_aldi_buntetes_alkoholvasarlas_szemelyi_igazolvny_elkerese_adatrogzites_NAIH_birsag","https://www.enforcementtracker.com/ETid-1804",null,null,null,null,"HU: aldi",null,null,null,null,null,null,null,null,null],["2023/IT/112","Garante per la protezione dei dati personali (Italy) - 9874702","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-04-11","day",null,null,null,"OpenAI L.L.C.",null,"Art. 12, Art. 58","Transparency",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9874702","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9874702",null,"gdprhub",null,null,"IT: openai","OpenAI",null,null,null,null,null,null,null,null],["2023/GR/026","HDPA (Greece) - 33/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-04-11","day",5000,"5000","EUR",null,null,"Art. 17(1), Art. 5(1)(a), Art. 5(1)(c), Art. 57(1)(c), Art. 58(2), Art. 6(1)(c)","Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2023-11/33_2023%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_33/2023",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2023/RO/032","ETid-1749","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-04-07","day",3000,null,"EUR","REGENCY COMPANY SRL","Employment","Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07.04.2023&lang=ro","https://www.enforcementtracker.com/ETid-1749",null,null,null,null,"regency company srl",null,null,null,null,null,null,null,null,null],["2023/BG/004","ETid-2868","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2023-04-06","day",770,null,"EUR","Secretary of the Central Election Commission Konstantin Ninov","Public Sector and Education","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://cpdp.bg/%d1%80%d0%b5%d1%88%d0%b5%d0%bd%d0%b8%d0%b5-%d0%bf%d0%be-%d0%b6%d0%b0%d0%bb%d0%b1%d0%b0-%d1%81-%d1%80%d0%b5%d0%b3-%e2%84%96-%d0%bf%d0%bf%d0%bd-02-214-06-04-2023-%d0%b3/","https://www.enforcementtracker.com/ETid-2868",null,null,null,null,"BG: secretary of the central election commission konstantin ninov",null,null,null,null,null,null,null,null,null],["2023/HU/014","NAIH (Hungary) - NAIH-1790-1/2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-04-06","day",null,null,null,null,null,"Art. 12(3), Art. 13(4), Art. 15(1)","Data subject rights, Transparency",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=934:hozzaferesi-kerelem-nem-teljesitese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-1790-1/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/NL/003","AP (The Netherlands) - z2020-19687","gdprhub","Netherlands","NL","AP (The Netherlands)","2023-04-05","day",null,null,null,"Nuts Topholding BV",null,"Art. 12(3), Art. 15(1), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://drive.google.com/file/d/1_oPIiqdJ4TbXKsugT9EWJr8nCco3eUbs/view?usp=sharing","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_z2020-19687",null,"gdprhub",null,null,"nuts topholding bv",null,null,null,null,null,null,null,null,null],["2023/ES/204","ETid-1735","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-05","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00492-2022.pdf","https://www.enforcementtracker.com/ETid-1735",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IS/016","Persónuvernd (Island) - 2020010726","gdprhub","Iceland","IS","Persónuvernd (Island)","2023-04-05","day",null,null,null,"City of Kópavogur",null,null,null,null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-kopavogsbaejar","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2020010726",null,"gdprhub",null,null,"IS: city of kopavogur",null,null,null,null,null,null,null,null,null],["2023/GB/002","ETid-1730","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2023-04-04","day",14500000,null,"EUR","TikTok","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 5(1)(a)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/04/ico-fines-tiktok-127-million-for-misusing-children-s-data/","https://www.enforcementtracker.com/ETid-1730",null,null,null,null,"GB: tiktok","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2023/RO/033","ETid-1731","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-04-04","day",3000,null,"EUR","Tensa Art Design SRL","Industry and Commerce","Art. 21(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_04_04_2023&lang=ro","https://www.enforcementtracker.com/ETid-1731",null,null,null,null,"tensa art design srl",null,null,null,null,null,null,null,null,null],["2023/ES/205","ETid-1734","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-04","day",18000,null,"EUR","ENFOKA SISTEMAS GLOBALES, S.L.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00533-2022.pdf","https://www.enforcementtracker.com/ETid-1734",null,null,null,null,"enfoka sistemas globales sl",null,null,null,null,null,null,null,null,null],["2023/ES/198","ETid-1751","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-04","day",84000,null,"EUR","BANCO BILBAO VIZCAYA ARGENTARIA, S.A.","Finance, Insurance and Consulting","Art. 15, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00679-2022.pdf","https://www.enforcementtracker.com/ETid-1751",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2023/ES/193","ETid-1764","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-04","day",10000,null,"EUR","Real Federación Española de Tenis de Mesa","Individuals and Private Associations","Art. 9(2)","Special categories, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00051-2022.pdf","https://www.enforcementtracker.com/ETid-1764",null,null,null,null,"ES: real federacion espanola de tenis de mesa",null,null,null,null,null,null,null,null,null],["2023/HU/004","ETid-1769","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2023-04-04","day",13300,null,"EUR","Company",null,"Art. 12, Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=650:tajekoztatas-ugyfelszolgalati-telefonhivasok-rogziteserol","https://www.enforcementtracker.com/ETid-1769",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/016","APD/GBA (Belgium) - 40/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-04-03","day",null,null,null,null,null,"Art. 12, Art. 12(2), Art. 12(3), Art. 12(5)(b), Art. 15(1), Art. 15(3), Art. 4(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-40-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_40/2023",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2023/ES/206","ETid-1733","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-03","day",50000,null,"EUR","ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00190-2022.pdf","https://www.enforcementtracker.com/ETid-1733",null,null,null,null,"atresmedia corporacion de medios de comunicacion sa",null,null,null,null,null,null,null,null,null],["2023/ES/203","ETid-1736","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-03","day",50000,null,"EUR","20 MINUTOS EDITORA, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00158-2022.pdf","https://www.enforcementtracker.com/ETid-1736",null,null,null,null,"20 minutos editora sl",null,null,null,null,null,null,null,null,null],["2023/ES/202","ETid-1737","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-04-03","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00231-2022.pdf","https://www.enforcementtracker.com/ETid-1737",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/CZ/008","UOOU (Czech Republic) - N/A","gdprhub","Czech Republic","CZ","UOOU (Czech Republic)","2023-04","month",null,"975,000","CZK","Ministry of the Interior",null,"Art. 13, Art. 35, Art. 6","DPIA, Transparency, Unlawful processing",null,"Violation found","https://www.uoou.cz/potvrzena%252Dmilionova%252Dpokuta%252Dpro%252Dministerstvo%252Dvnitra/d-56866","https://gdprhub.eu/index.php?title=UOOU_%28Czech_Republic%29_-_N/A",null,"gdprhub",null,null,"CZ: ministry of the interior",null,975000.0,41601,"month 2023-04|23.4369|CZK",null,null,null,null,null],["2023/SE/022","IMY (Sweden) - DI-2020-10549","gdprhub","Sweden","SE","IMY (Sweden)","2023-03-31","day",null,null,null,"CDON AB",null,"Art. 12(2), Art. 12(6), Art. 5(1)(c)","Data principles, Transparency",null,"Violation found","https://www.imy.se/contentassets/f39369db91244bf9a5ed651749d27fc7/beslut-tillsyn-cdon.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-10549",null,"gdprhub",null,null,"cdon ab",null,null,null,null,null,null,null,null,null],["2023/ES/127","ETid-1954","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-30","day",1800,null,"EUR","LISMARTSA, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00478-2022.pdf","https://www.enforcementtracker.com/ETid-1954",null,null,null,null,"lismartsa sl",null,null,null,null,null,null,null,null,null],["2023/IT/106","Garante per la protezione dei dati personali (Italy) - 9870832","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-03-30","day",null,null,null,"OpenAI",null,"Art. 13, Art. 5, Art. 6, Art. 8","Consent, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9870832","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9870832",null,"gdprhub",null,null,"IT: openai","OpenAI",null,null,null,null,null,null,null,null],["2023/AT/007","DSB (Austria) - 2023-0.174.027","gdprhub","Austria","AT","DSB (Austria)","2023-03-29","day",null,null,null,"Der Standard",null,"Art. 4(11)",null,null,"Violation found","https://noyb.eu/sites/default/files/2023-04/Standard_Bescheid_geschw%C3%A4rzt.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.174.027",null,"gdprhub",null,null,"AT: der standard",null,null,null,null,null,null,null,null,null],["2023/DK/004","Datatilsynet (Denmark) - 2022-32-2939","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-03-28","day",null,null,null,"Rigspolitiet",null,"Art. 10, Art. 5(1)(b), Art. 5(1)(c)","Data principles, Special categories",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/mar/alvorlig-kritik-af-rigspolitiet","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2022-32-2939",null,"gdprhub",null,null,"DK: rigspolitiet",null,null,null,null,null,null,null,null,null],["2023/NO/010","Datatilsynet (Norway) - PVN-2022-21","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-03-28","day",null,null,null,"Norwegian Labour and Welfare Administration at municipality X (NAV)",null,"Art. 17, Art. 17(1), Art. 17(3)(b), Art. 17(3)(d), Art. 6(1)(e), Art. 6(3)","Data subject rights, Unlawful processing",null,"Rejected","https://pvn.no/pvn-2022-21","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_PVN-2022-21",null,"gdprhub",null,null,"NO: norwegian labour and welfare administration at municipality x",null,null,null,null,null,null,null,null,null],["2023/IS/014","Persónuvernd (Iceland) - 2021091678","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2023-03-28","day",null,null,null,null,null,"Art. 6","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/rafraen-voktun-af-halfu-nagranna","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2021091678",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2023/IS/015","Persónuvernd (Iceland) - 2022050940","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2023-03-28","day",null,null,null,"Icelandair",null,"Art. 15, Art. 35, Art. 5(1), Art. 6","DPIA, Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-icelandair-ehf.-a-personuupplysingum","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2022050940",null,"gdprhub",null,null,"IS: icelandair",null,null,null,null,null,null,null,null,null],["2023/RO/034","ETid-1700","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-27","day",450,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_27_03_2023&lang=ro","https://www.enforcementtracker.com/ETid-1700",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/201","ETid-1738","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-24","day",1000,null,"EUR","INMARAN ASESORES S.L.","Finance, Insurance and Consulting","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00616-2022.pdf","https://www.enforcementtracker.com/ETid-1738",null,null,null,null,"inmaran asesores sl",null,null,null,null,null,null,null,null,null],["2023/ES/199","ETid-1748","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-24","day",360,null,"EUR","ALI MARKET","Industry and Commerce","Art. 13, Art. 30","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00340-2022.pdf","https://www.enforcementtracker.com/ETid-1748",null,null,null,null,"ES: ali market",null,null,null,null,null,null,null,null,null],["2023/FI/006","Tietosuojavaltuutetun toimisto (Finland) - 8086/182/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-03-24","day",null,null,null,null,null,"Art. 4(11), Art. 7(3), Art. 7(4), Art. 95","Consent",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2023/20231805","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8086/182/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/HR/012","AZOP (Croatia) - Decision 23-03-2023","gdprhub","Croatia","HR","AZOP (Croatia)","2023-03-23","day",null,null,null,null,null,"Art. 11, Art. 12(2), Art. 15, Art. 17, Art. 17(3)(e)","Data subject rights, Transparency",null,"Rejected","https://azop.hr/wp-content/uploads/2023/11/Rjesenje_pristup-osobnim-podacima_nemogucnost-utvrdivanja-identiteta.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_23-03-2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/AT/010","DSB (Austria) - 2023-0.227.168","gdprhub","Austria","AT","DSB (Austria)","2023-03-23","day",null,null,null,null,null,"Art. 15, Art. 4(7)","Data subject rights",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230323_2023_0_227_168_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.227.168",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/035","ETid-1699","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-23","day",5000,null,"EUR","Tehnoplus Industry SRL","Employment","Art. 5(2), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23.03.2023&lang=ro","https://www.enforcementtracker.com/ETid-1699",null,null,null,null,"tehnoplus industry srl",null,null,null,null,null,null,null,null,null],["2023/ES/217","ETid-1701","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-23","day",70000,null,"EUR","Orange Espagne S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00297-2022.pdf","https://www.enforcementtracker.com/ETid-1701",null,null,null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2023/IT/090","ETid-1740","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-23","day",4000,null,"EUR","Azienda socio-sanitaria locale n. 1 di Sassari","Health Care","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9872621","https://www.enforcementtracker.com/ETid-1740","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9885151","gdprhub",null,null,"IT: azienda socio sanitaria locale n1 di sassari",null,null,null,null,null,null,null,null,null],["2023/ES/200","ETid-1746","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-23","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00537-2022.pdf","https://www.enforcementtracker.com/ETid-1746",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IT/079","ETid-1828","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-23","day",30000,null,"EUR","Bolzano municipality","Health Care","Art. 25, Art. 32, Art. 33, Art. 5(1)(f)","Accountability, Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9883749","https://www.enforcementtracker.com/ETid-1828",null,null,null,null,"IT: bolzano municipality",null,null,null,null,null,null,null,null,null],["2023/IT/078","ETid-1829","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-23","day",null,null,"EUR","Informatica Alto Adige Spa","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9883797","https://www.enforcementtracker.com/ETid-1829",null,null,null,null,"informatica alto adige spa",null,null,null,null,null,"annulled","The Garante removed this decision from its website after a final court judgment against it.","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9883797",10000],["2023/IT/067","ETid-1924","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-23","day",40000,null,"EUR","La Risorsa Umana.it s.r.l.","Employment","Art. 13, Art. 28","Data principles, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9888206","https://www.enforcementtracker.com/ETid-1924","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9888206","gdprhub",null,null,"la risorsa umana it srl",null,null,null,null,null,null,null,null,null],["2023/IT/117","Garante per la protezione dei dati personali (Italy) - 9885177","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-03-23","day",null,null,null,null,null,"Art. 60",null,null,"Rejected","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9885177","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9885177",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/FI/008","Tietosuojavaltuutetun toimisto (Finland) - 10048/182/20","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-03-22","day",null,null,null,null,null,"Art. 12(5), Art. 20(1)","Data subject rights, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2023/20231883","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_10048/182/20",null,"gdprhub",null,"Email service provider",null,null,null,null,null,null,null,null,null,null],["2023/ES/216","ETid-1702","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",70000,null,"EUR","CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00482-2022.pdf","https://www.enforcementtracker.com/ETid-1702",null,null,null,null,"caixabank payments and consumer efc ep sau","CaixaBank",null,null,null,null,null,null,null,null],["2023/ES/215","ETid-1708","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",50000,null,"EUR","SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00199-2022.pdf","https://www.enforcementtracker.com/ETid-1708",null,null,null,null,"sociedad espanola de radiodifusion sl",null,null,null,null,null,null,null,null,null],["2023/ES/214","ETid-1709","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",50000,null,"EUR","LA VANGUARDIA EDICIONES, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00197-2022.pdf","https://www.enforcementtracker.com/ETid-1709",null,null,null,null,"la vanguardia ediciones sl",null,null,null,null,null,null,null,null,null],["2023/ES/213","ETid-1710","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",50000,null,"EUR","DIARIO ABC, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00193-2022.pdf","https://www.enforcementtracker.com/ETid-1710",null,null,null,null,"diario abc sl",null,null,null,null,null,null,null,null,null],["2023/ES/212","ETid-1711","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",50000,null,"EUR","CONECTA5 TELECINCO, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00191-2022.pdf","https://www.enforcementtracker.com/ETid-1711",null,null,null,null,"conecta5 telecinco sau",null,null,null,null,null,null,null,null,null],["2023/ES/211","ETid-1712","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",50000,null,"EUR","DISPLAY CONNECTORS, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00194-2022.pdf","https://www.enforcementtracker.com/ETid-1712",null,null,null,null,"display connectors sl",null,null,null,null,null,null,null,null,null],["2023/ES/210","ETid-1713","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",50000,null,"EUR","EL DIARIO DE PRENSA DIGITAL SL.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00196-2022.pdf","https://www.enforcementtracker.com/ETid-1713",null,null,null,null,"el diario de prensa digital sl",null,null,null,null,null,null,null,null,null],["2023/ES/209","ETid-1714","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",40000,null,"EUR","EDITORIAL DE PRENSA CANARIA, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00195-2022.pdf","https://www.enforcementtracker.com/ETid-1714",null,null,null,null,"editorial de prensa canaria sa",null,null,null,null,null,null,null,null,null],["2023/ES/208","ETid-1715","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",40000,null,"EUR","TITANIA COMPAÑÍA EDITORIAL, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00200-2022.pdf","https://www.enforcementtracker.com/ETid-1715",null,null,null,null,"titania compania editorial sl",null,null,null,null,null,null,null,null,null],["2023/ES/207","ETid-1716","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-21","day",50000,null,"EUR","UNIDAD EDITORIAL INFORMACION GENERAL S.L.U.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00201-2022.pdf","https://www.enforcementtracker.com/ETid-1716",null,null,null,null,"unidad editorial informacion general slu",null,null,null,null,null,null,null,null,null],["2023/FI/005","Tietosuojavaltuutetun toimisto (Finland) - 6064/163/20","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-03-21","day",null,null,null,"City X (Board for Growth and Learning)",null,"Art. 25(2), Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(f)","Accountability, Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2023/20231803","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6064/163/20",null,"gdprhub",null,null,"FI: city x",null,null,null,null,null,null,null,null,null],["2023/BE/014","APD/GBA (Belgium) - 29/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-03-17","day",null,null,null,"Meta",null,"Art. 25(1), Art. 25(2), Art. 32, Art. 33, Art. 34, Art. 60","Accountability, Data breach, Data security",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-nr.-29-2023-van-17-maart-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_29/2023",null,"gdprhub",null,null,"BE: meta",null,null,null,null,null,null,null,null,null],["2023/ES/197","ETid-1752","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-17","day",10000,null,"EUR","NGENIERÍA Y TELECOM JAÉN, S.L.","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00448-2022.pdf","https://www.enforcementtracker.com/ETid-1752",null,null,null,null,"ngenieria y telecom jaen sl",null,null,null,null,null,null,null,null,null],["2023/CY/009","Commissioner (Cyprus) - 11.17.001.010.201","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2023-03-16","day",null,null,null,"Cyprus Hairdressers and Barbers Registration Council",null,"Art. 5(1)(a), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/AB0419759D932D4BC22589A300345448/$file/%CE%9A%CE%B1%CF%84%CE%B1%CE%B3%CE%B3%CE%B5%CE%BB%CE%AF%CE%B1%2520%CE%B5%CE%BD%CE%B1%CE%BD%CF%84%CE%AF%CE%BF%CE%BD%2520%CE%A3%CE%95%CE%9A%CE%9A%CE%9A.pdf?openelement","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.010.201",null,"gdprhub",null,null,"CY: cyprus hairdressers and barbers registration council",null,null,null,null,null,null,null,null,null],["2023/RO/037","ETid-1686","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-16","day",1000,null,"EUR","Centrul Medical dr. Furtună Dan","Health Care","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16_03_2023&lang=ro","https://www.enforcementtracker.com/ETid-1686",null,null,null,null,"RO: centrul medical dr furtuna dan",null,null,null,null,null,null,null,null,null],["2023/RO/036","ETid-1687","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-16","day",3000,null,"EUR","Med Life S.A.","Health Care","Art. 32(1)(b), Art. 32(2), Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16_03_2023&lang=ro","https://www.enforcementtracker.com/ETid-1687",null,null,null,null,"med life sa",null,null,null,null,null,null,null,null,null],["2023/ES/222","ETid-1689","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-16","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00154-2022.pdf","https://www.enforcementtracker.com/ETid-1689",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/FR/011","ETid-1698","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2023-03-16","day",125000,null,"EUR","CITYSCOOT","Transportation and Energy","Art. 28(3), Art. 5(1)(c)","Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/geolocalisation-de-scooters-de-location-sanction-de-125-000-euros-lencontre-de-cityscoot","https://www.enforcementtracker.com/ETid-1698","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2023-003","gdprhub",null,null,"FR: cityscoot",null,null,null,null,null,null,null,null,null],["2023/ES/192","ETid-1768","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-16","day",100000,null,"EUR","ORANGE ESPAGNE S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00413-2021.pdf","https://www.enforcementtracker.com/ETid-1768",null,null,null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2023/ES/002","ETid-2426","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-16","day",145000,null,"EUR","AFIANZA ASESORES S.L.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00084-2022.pdf","https://www.enforcementtracker.com/ETid-2426","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202100318","gdprhub",null,null,"afianza asesores sl",null,null,null,null,null,null,null,null,null],["2023/BG/001","ETid-2884","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2023-03-16","day",1020,null,"EUR","Telecommunications Operator","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://cpdp.bg/%d1%80%d0%b5%d1%88%d0%b5%d0%bd%d0%b8%d0%b5-%d0%bf%d0%be-%d0%b6%d0%b0%d0%bb%d0%b1%d0%b0-%d1%81-%d1%80%d0%b5%d0%b3-%e2%84%96-%d0%bf%d0%bf%d0%bd-01-169-02-03-2022-%d0%b3/","https://www.enforcementtracker.com/ETid-2884",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/040","ETid-1683","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-15","day",10000,null,"EUR","Alianța pentru Unirea Românilor","Individuals and Private Associations","Art. 5(1)(c), Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15_03_2023&lang=ro","https://www.enforcementtracker.com/ETid-1683",null,null,null,null,"RO: alianta pentru unirea romanilor",null,null,null,null,null,null,null,null,null],["2023/RO/039","ETid-1684","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-15","day",4000,null,"EUR","Partidul Uniunea Salvați România","Individuals and Private Associations","Art. 32(1)(a), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15_03_2023&lang=ro","https://www.enforcementtracker.com/ETid-1684",null,null,null,null,"RO: partidul uniunea salvati romania",null,null,null,null,null,null,null,null,null],["2023/ES/221","ETid-1690","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-15","day",480,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00468-2022.pdf","https://www.enforcementtracker.com/ETid-1690",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/218","ETid-1695","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-15","day",136000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 32, Art. 6","Data security, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00453-2022.pdf","https://www.enforcementtracker.com/ETid-1695",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/RO/038","ETid-1685","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-14","day",3000,null,"EUR","Tinmar Energy SA","Transportation and Energy","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_14_03_2023&lang=ro","https://www.enforcementtracker.com/ETid-1685",null,null,null,null,"tinmar energy sa",null,null,null,null,null,null,null,null,null],["2023/ES/219","ETid-1692","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-14","day",240,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00405-2022.pdf","https://www.enforcementtracker.com/ETid-1692",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/BE/015","APD/GBA (Belgium) - 27/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-03-13","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 34(1)","Data breach, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-27-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_27/2023",null,"gdprhub",null,"Landlord",null,null,null,null,null,"person",null,null,null,null],["2023/RO/041","ETid-1682","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-13","day",2000,null,"EUR","Modaone SRL","Industry and Commerce","Art. 12, Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_13.03.2023&lang=ro","https://www.enforcementtracker.com/ETid-1682",null,null,null,null,"modaone srl",null,null,null,null,null,null,null,null,null],["2023/EE/002","AKI (Estonia) - 2.1.-1/23/2891-5","gdprhub","Estonia","EE","AKI (Estonia)","2023-03-10","day",null,null,null,null,null,"Art. 6(1)(a), Art. 6(1)(f)","Unlawful processing",null,null,"https://www.aki.ee/sites/default/files/ettekirjutus-hoiatus_isikuandmete_kaitse_asjas_2.1-1-23-2891_eraisik.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-1/23/2891-5",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/188","ETid-1775","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-03-10","day",40000,null,"EUR","VODAFONE ONO, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00570-2022.pdf","https://www.enforcementtracker.com/ETid-1775",null,null,null,null,"vodafone ono sau","Vodafone",null,null,null,null,null,null,null,null],["2023/IS/013","Persónuvernd (Iceland) - 2022081293","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2023-03-10","day",null,null,null,"City of Reykjavik",null,"Art. 32, Art. 4","Data security",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-reykjavikurborgar#","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2022081293",null,"gdprhub",null,null,"IS: city of reykjavik",null,null,null,null,null,null,null,null,null],["2023/IT/091","ETid-1739","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-09","day",3000,null,"EUR","Store owner","Industry and Commerce","Art. 13, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9872646","https://www.enforcementtracker.com/ETid-1739",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/086","ETid-1770","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-09","day",1600,null,"EUR","Deca s.r.l.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9874604","https://www.enforcementtracker.com/ETid-1770",null,null,null,null,"deca srl",null,null,null,null,null,null,null,null,null],["2023/IT/085","ETid-1778","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-09","day",10000,null,"EUR","Banca Cambiano 1884 S.p.A.","Finance, Insurance and Consulting","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9877728","https://www.enforcementtracker.com/ETid-1778",null,null,null,null,"banca cambiano 1884 spa",null,null,null,null,null,null,null,null,null],["2023/IT/082","ETid-1805","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-09","day",3000,null,"EUR","Aesse S.r.l.s.","Industry and Commerce","Art. 12, Art. 13, Art. 14, Art. 15, Art. 5(1)(a), Art. 6(1)(a), Art. 7","Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9880336","https://www.enforcementtracker.com/ETid-1805","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9880336","gdprhub",null,null,"aesse srls",null,null,null,null,null,null,null,null,null],["2023/IT/080","ETid-1821","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-09","day",2000,null,"EUR","Consorzio Concessioni Reti Gas S.c.a.r.l.","Transportation and Energy","Art. 12, Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9877754","https://www.enforcementtracker.com/ETid-1821",null,null,null,null,"IT: consorzio concessioni reti gas scarl",null,null,null,null,null,null,null,null,null],["2023/NO/009","Datatilsynet (Norway) - 21/03126","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-03-08","day",null,"2500000","NOK","Argon Medical Devices",null,"Art. 33(1), Art. 58(2)(i), Art. 83(4)(a)","Data breach",null,"Violation found","https://www.datatilsynet.no/contentassets/c4d1b273cca24eaea43316c2043d9c92/vedtak-om-overtredelsesgebyr---argon-medical-devices-inc..pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/03126",null,"gdprhub",null,null,"NO: argon medical devices",null,2500000.0,222806,"day 2023-03-08|11.2205|NOK",null,null,null,null,null],["2023/NO/002","ETid-1697","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2023-03-08","day",220000,null,"EUR","Argon Medical Devices","Employment","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/overtredelsesgebyr-til-argon-medical-devices/","https://www.enforcementtracker.com/ETid-1697",null,null,null,null,"NO: argon medical devices",null,null,null,null,null,null,null,null,null],["2023/AT/006","DSB (Austria) - 2022-0.726.643","gdprhub","Austria","AT","DSB (Austria)","2023-03-06","day",null,null,null,"Meta Platforms Inc.",null,"Art. 28, Art. 29, Art. 44, Art. 5(2)","Data principles, International transfers, Processor obligations",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230306_2022_0_726_643_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.726.643",null,"gdprhub",null,null,"meta platforms inc","Meta",null,null,null,null,null,null,null,null],["2023/RO/043","ETid-1680","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-06","day",2250,null,"EUR","Finopro IFN SA","Finance, Insurance and Consulting","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_06.03.2023_2&lang=ro","https://www.enforcementtracker.com/ETid-1680",null,null,null,null,"finopro ifn sa",null,null,null,null,null,null,null,null,null],["2023/RO/042","ETid-1681","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-03-06","day",3000,null,"EUR","Integral Collection SRL","Finance, Insurance and Consulting","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_06.03.2023_2&lang=ro","https://www.enforcementtracker.com/ETid-1681",null,null,null,null,"integral collection srl",null,null,null,null,null,null,null,null,null],["2023/BE/012","APD/GBA (Belgium) - 19/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-03-03","day",null,null,null,null,null,"Art. 12, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-19-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_19/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/013","APD/GBA (Belgium) - 18/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-03-02","day",null,null,null,"A care home",null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-18-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_18/2023",null,"gdprhub",null,null,"BE: a care home",null,null,null,null,null,null,null,null,null],["2023/IT/084","ETid-1786","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-02","day",50000,null,"EUR","Azienda sanitaria locale di Bari","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9870725#1","https://www.enforcementtracker.com/ETid-1786",null,null,null,null,"IT: azienda sanitaria locale di bari",null,null,null,null,null,null,null,null,null],["2023/IT/081","ETid-1807","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-02","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9880317","https://www.enforcementtracker.com/ETid-1807",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/IT/077","ETid-1830","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-02","day",1000,null,"EUR","Razmataz Live s.r.l..","Industry and Commerce","Art. 28, Art. 5(1)(a), Art. 6(1)","Data principles, Processor obligations, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9873408","https://www.enforcementtracker.com/ETid-1830","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9873408","gdprhub",null,null,"razmataz live srl",null,null,null,null,null,null,null,null,null],["2023/IT/076","ETid-1869","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-03-02","day",50000,null,"EUR","H&M Hennes & Mauritz s.r.l.","Industry and Commerce","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9890504#2","https://www.enforcementtracker.com/ETid-1869",null,null,null,null,"h and m hennes and mauritz srl",null,null,null,null,null,null,null,null,null],["2023/IT/110","Garante per la protezione dei dati personali (Italy) - 9875254","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-03-02","day",null,null,null,null,null,"Art. 35, Art. 36, Art. 89, Art. 9(2)(j), Art. 9(4)","DPIA, Special categories",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9875254","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9875254",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/121","Garante per la protezione dei dati personali (Italy) - 9880398","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-03-02","day",50000,"50,000","EUR","H&M",null,"Art. 5(1)(a), Art. 88","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9880398","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9880398",null,"gdprhub",null,null,"IT: h and m",null,null,null,null,null,null,null,null,null],["2023/BE/011","APD/GBA (Belgium) - 17/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-03-01","day",null,null,null,null,null,"Art. 12(3), Art. 15(1), Art. 15(1)(a), Art. 32, Art. 5(1)(f), Art. 5(2)","Data principles, Data security, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-17-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_17/2023",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2023/PL/021","ETid-1759","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-03-01","day",11100,null,"EUR","Housing cooperative","Individuals and Private Associations","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/pl/138/2658","https://www.enforcementtracker.com/ETid-1759",null,null,null,null,"PL: housing cooperative",null,null,null,null,null,null,null,null,null],["2023/ES/258","AEPD (Spain) - PS/00016/2022","gdprhub","Spain","ES","AEPD (Spain)","2023-02-28","day",null,null,null,"Holidays Edreams",null,"Art. 15, Art. 56, Art. 60, Art. 83(2)","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00016-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00016/2022",null,"gdprhub",null,null,"ES: holidays edreams",null,null,null,null,null,null,null,null,null],["2023/NO/008","Datatilsynet (Norway) - 20/03771","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-02-28","day",null,null,null,null,null,"Art. 4(16)(a), Art. 4(23)(b), Art. 44, Art. 46(2)(c), Art. 56(1), Art. 58(2)(b), Art. 60(3), Art. 80(1)","International transfers",null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/03771",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/224","ETid-1675","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-28","day",15000,null,"EUR","GRUPO NORCONSULTING, S.L.","Finance, Insurance and Consulting","Art. 15, Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00239-2022.pdf","https://www.enforcementtracker.com/ETid-1675","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00239/2022","gdprhub",null,null,"grupo norconsulting sl",null,null,null,null,null,null,null,null,null],["2023/ES/223","ETid-1676","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-28","day",800,null,"EUR","EUROPYMES SERVICIOS INTEGRALES S.L.","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00138-2022.pdf","https://www.enforcementtracker.com/ETid-1676",null,null,null,null,"europymes servicios integrales sl",null,null,null,null,null,null,null,null,null],["2023/ES/196","ETid-1756","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-28","day",1800,null,"EUR","WUNSCHURLAUB S.L.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00068-2022.pdf","https://www.enforcementtracker.com/ETid-1756",null,null,null,null,"wunschurlaub sl",null,null,null,null,null,null,null,null,null],["2023/ES/195","ETid-1757","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-28","day",600,null,"EUR","ECOMM MOVADGENCY S.L.","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00127-2022.pdf","https://www.enforcementtracker.com/ETid-1757",null,null,null,null,"ecomm movadgency sl",null,null,null,null,null,null,null,null,null],["2023/ES/194","ETid-1758","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-28","day",3000,null,"EUR","CITIZENGO FOUNDATION","Individuals and Private Associations","Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00184-2022.pdf","https://www.enforcementtracker.com/ETid-1758",null,null,null,null,"ES: citizengo foundation",null,null,null,null,null,null,null,null,null],["2023/ES/189","ETid-1774","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-28","day",800,null,"EUR","GUUDJOB WORLDWIDE S.L.",null,"Art. 12, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued",null,"https://www.enforcementtracker.com/ETid-1774",null,null,null,null,"guudjob worldwide sl",null,null,null,null,null,null,null,null,null],["2023/NO/016","Personvernnemnda (Norway) - PVN-2022-19","gdprhub","Norway","NO","Personvernnemnda (Norway)","2023-02-28","day",null,null,null,null,null,"Art. 17(1)(a), Art. 17(1)(c), Art. 17(3)(b), Art. 17(3)(d)","Data subject rights",null,"Rejected","https://pvn.no/pvn-2022-19","https://gdprhub.eu/index.php?title=Personvernnemnda_%28Norway%29_-_PVN-2022-19",null,"gdprhub",null,"Child welfare services",null,null,null,null,null,null,null,null,null,null],["2023/IE/012","DPC (Ireland) - IN-19-7-6","gdprhub","Ireland","IE","DPC (Ireland)","2023-02-27","day",null,null,null,"Archbishop of Dublin",null,"Art. 17","Data subject rights",null,"Other Outcome","https://gdprhub.eu/images/3/34/Decision_IN-19-7-6.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-19-7-6",null,"gdprhub",null,null,"IE: archbishop of dublin",null,null,null,null,null,null,null,null,null],["2023/ES/220","ETid-1691","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-27","day",4000,null,"EUR","Attorney","Finance, Insurance and Consulting","Art. 5(1)(f), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00311-2022.pdf","https://www.enforcementtracker.com/ETid-1691",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IE/004","ETid-1696","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2023-02-27","day",750000,null,"EUR","Bank of Ireland 365","Finance, Insurance and Consulting","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/en/resources/law/decisions/bank-of-ireland-365-%28BOI%29-February-2023","https://www.enforcementtracker.com/ETid-1696","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-20-7-2","gdprhub",null,null,"IE: bank of ireland 365",null,null,null,null,null,null,null,null,null],["2023/ES/284","AEPD (Spain) - PS-00224-2022","gdprhub","Spain","ES","AEPD (Spain)","2023-02-24","day",70000,"70,000","EUR","SUPERCOR, S.A.",null,"Art. 32(1), Art. 5(1)(f), Art. 6","Data principles, Data security, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00224-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00224-2022",null,"gdprhub",null,null,"supercor sa",null,null,null,null,null,null,null,null,null],["2023/LV/003","DVI (Latvia) - SIA \"Fitsypro\"","gdprhub","Latvia","LV","DVI (Latvia)","2023-02-23","day",1000,"1,000","EUR",null,null,"Art. 58(1)(b), Art. 58(1)(e), Art. 83(2), Art. 83(5)(e)",null,null,"Violation found","https://www.dvi.gov.lv/lv/media/2412/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_%22Fitsypro%22",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2023/IT/083","ETid-1800","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-02-23","day",300000,null,"EUR","Ediscom S.p.a.","Industry and Commerce","Art. 14, Art. 25, Art. 6, Art. 7","Accountability, Consent, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9870014","https://www.enforcementtracker.com/ETid-1800","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9870014","gdprhub",null,null,"ediscom spa",null,null,null,null,null,null,null,null,null],["2023/IT/109","Garante per la protezione dei dati personali (Italy) - 9871886","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-02-23","day",54609,"54,609,62","EUR",null,null,"Art. 13, Art. 28, Art. 5(1)(a), Art. 6, Art. 7","Consent, Data principles, Processor obligations, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9871886","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9871886",null,"gdprhub",null,"Telesales company",null,null,null,null,null,null,null,null,null,null],["2023/IT/108","Garante per la protezione dei dati personali (Italy) - 9873031","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-02-23","day",null,null,null,null,null,"Art. 5(1)(a)","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9873031","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9873031",null,"gdprhub",null,"Online newspaper",null,null,null,null,null,null,"annulled","The Garante removed this decision from its website after a final court judgment against it.","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9873031",null],["2023/SI/001","IP (Slovenia) - 0603-99/2021/4","gdprhub","Slovenia","SI","IP (Slovenia)","2023-02-23","day",320,"320","EUR",null,null,null,null,null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2023/Marec/Marec_2023-Odlocbe_ZP.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0603-99/2021/4",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/179","ETid-1802","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-22","day",30000,null,"EUR","DISPLAY CONNECTORS, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00555-2022.pdf","https://www.enforcementtracker.com/ETid-1802",null,null,null,null,"display connectors sl",null,null,null,null,null,null,null,null,null],["2023/BE/010","APD/GBA (Belgium) - 15/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-02-21","day",null,null,null,null,null,"Art. 12(1), Art. 12(6), Art. 13(1), Art. 13(2), Art. 14(1), Art. 14(2), Art. 24(1), Art. 24(2), Art. 25(1), Art. 30(1)(a), Art. 38(3), Art. 4(11), Art. 5(1), Art. 5(1)(a), Art. 5(2), Art. 6(1), Art. 6(1)(a), Art. 7(1), Art. 7(3)","Accountability, Consent, Data principles, Data protection officer, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-15-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_15/2023",null,"gdprhub",null,"Public authority",null,null,null,null,null,null,null,null,null,null],["2023/AT/009","DSB (Austria) - 2023-0.137.735","gdprhub","Austria","AT","DSB (Austria)","2023-02-21","day",null,null,null,null,null,"Art. 57(4)",null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230221_2023_0_137_735_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2023-0.137.735",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/235","ETid-1658","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00412-2022.pdf","https://www.enforcementtracker.com/ETid-1658",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/234","ETid-1659","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",300,null,"EUR","COMANDANCIA DE LLEIDA","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00235-2022.pdf","https://www.enforcementtracker.com/ETid-1659",null,null,null,null,"ES: comandancia de lleida",null,null,null,null,null,null,null,null,null],["2023/ES/233","ETid-1660","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00390-2022.pdf","https://www.enforcementtracker.com/ETid-1660",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/232","ETid-1661","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00300-2022.pdf","https://www.enforcementtracker.com/ETid-1661",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/231","ETid-1662","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00373-2022.pdf","https://www.enforcementtracker.com/ETid-1662",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/230","ETid-1663","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",180,null,"EUR","SUPER 24H LOS ROSALES, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00403-2022.pdf","https://www.enforcementtracker.com/ETid-1663",null,null,null,null,"super 24h los rosales sl",null,null,null,null,null,null,null,null,null],["2023/ES/229","ETid-1664","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",1200,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00202-2022.pdf","https://www.enforcementtracker.com/ETid-1664",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/228","ETid-1665","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",300,null,"EUR","PLANET COSTA DORADA SOCIEDAD LIMITADA","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00258-2022.pdf","https://www.enforcementtracker.com/ETid-1665",null,null,null,null,"ES: planet costa dorada sociedad limitada",null,null,null,null,null,null,null,null,null],["2023/ES/227","ETid-1672","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00343-2022.pdf","https://www.enforcementtracker.com/ETid-1672",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/226","ETid-1673","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",10000,null,"EUR","HERON CITY VALENCIA MANAGEMENT S.L.","Industry and Commerce","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00368-2022.pdf","https://www.enforcementtracker.com/ETid-1673",null,null,null,null,"heron city valencia management sl",null,null,null,null,null,null,null,null,null],["2023/ES/225","ETid-1674","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-21","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00355-2022.pdf","https://www.enforcementtracker.com/ETid-1674",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/GR/008","ETid-1767","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-02-20","day",40000,null,"EUR","Vodafone","Media, Telecoms and Broadcasting","Art. 15, Art. 33","Data breach, Data subject rights","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-tilepikoinoniako-paroho-gia-mi-gnostopoiisi","https://www.enforcementtracker.com/ETid-1767","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_7/2023","gdprhub",null,null,"GR: vodafone","Vodafone",null,null,null,null,null,null,null,null],["2023/BE/009","APD/GBA (Belgium) - 14/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-02-17","day",null,null,null,null,null,"Art. 5(1)(a), Art. 58(2)(c), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-14-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_14/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/FI/003","ETid-1678","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2023-02-17","day",440000,null,"EUR","Suomen Asiakastieto Oy","Finance, Insurance and Consulting","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://tietosuoja.fi/-/suomen-asiakastiedolle-seuraamusmaksu-tietosuojavaltuutetun-maarayksen-noudattamatta-jattamisesta","https://www.enforcementtracker.com/ETid-1678","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_310/161/23","gdprhub",null,null,"suomen asiakastieto oy",null,null,null,null,null,null,null,null,null],["2023/BE/006","APD/GBA (Belgium) - 12/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-02-16","day",null,null,null,"Requests and Social Affairs Department of the King's Office",null,"Art. 12, Art. 13, Art. 15, Art. 5(1)(a), Art. 5(1)(c), Art. 6(1), Art. 6(3)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-12-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_12/2023",null,"gdprhub",null,null,"BE: requests and social affairs department of the king s office",null,null,null,null,null,null,null,null,null],["2023/HR/015","AZOP (Croatia) - Decision 16-02-2023","gdprhub","Croatia","HR","AZOP (Croatia)","2023-02-16","day",null,null,null,null,null,"Art. 5, Art. 6","Data principles, Unlawful processing",null,"Violation found","https://azop.hr/wp-content/uploads/2023/12/Rjesenje-oglasna-ploca_stambena-zgrada.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_16-02-2023",null,"gdprhub",null,"Building manager",null,null,null,null,null,null,null,null,null,null],["2023/BE/007","APD/GBA (Belgium) - 10/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-02-13","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15, Art. 15(1), Art. 15(1)(c)","Data subject rights, Transparency",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-10-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_10/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/BE/008","APD/GBA (Belgium) - 11/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-02-13","day",null,null,null,null,null,"Art. 12(3), Art. 17(1)(c), Art. 19, Art. 21(2), Art. 21(3)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-11-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_11/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/GR/012","HDPA (Greece) - 2/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-02-13","day",null,null,null,null,null,"Art. 13, Art. 31, Art. 4(7), Art. 5(1), Art. 5(1)(a), Art. 57(1)(f), Art. 58(2)(b)","Data principles, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2023-03/2_2023%20μονοπρόσωπο%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_2/2023",null,"gdprhub",null,"Hotel",null,null,null,null,null,null,null,null,null,null],["2023/LV/004","DVI (Latvia) - SIA \"SOAAR\"","gdprhub","Latvia","LV","DVI (Latvia)","2023-02-10","day",800,"800","EUR",null,null,"Art. 58(1)(e)",null,null,"Violation found","https://www.dvi.gov.lv/lv/media/2409/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_%22SOAAR%22",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2023/BE/005","APD/GBA (Belgium) - 09/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-02-09","day",null,null,null,null,null,"Art. 12(3), Art. 17(1), Art. 58(2)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-09-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_09/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/BG/005","ETid-2277","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2023-02-09","day",5100,null,"EUR",null,"Employment","Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://cpdp.bg/%d1%80%d0%b5%d1%88%d0%b5%d0%bd%d0%b8%d0%b5-%d0%bf%d0%be-%d0%b6%d0%b0%d0%bb%d0%b1%d0%b0-%d1%81-%d1%80%d0%b5%d0%b3-%e2%84%96-%d0%bf%d0%bf%d0%bd-01-197-14-03-2022-%d0%b3/","https://www.enforcementtracker.com/ETid-2277","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PPN-_01-197/2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/DK/002","Datatilsynet (Denmark) - 2021-31-4871","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-02-08","day",null,null,null,"GulogGratis",null,"Art. 58(2)(d), Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/feb/gul-og-gratis-brug-af-cookie-walls","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-4871",null,"gdprhub",null,null,"DK: guloggratis",null,null,null,null,null,null,null,null,null],["2023/DK/001","Datatilsynet (Denmark) - 2021-31-5553","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-02-08","day",null,null,null,"Jysk Fynske Medier",null,"Art. 5(1)(a), Art. 5(2), Art. 58(2)(d), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/feb/jysk-fynske-mediers-brug-af-cookie-walls","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5553",null,"gdprhub",null,null,"DK: jysk fynske medier",null,null,null,null,null,null,null,null,null],["2023/RO/044","ETid-1642","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-02-08","day",5000,null,"EUR","Medijobs Platform SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08.02.2023&lang=ro","https://www.enforcementtracker.com/ETid-1642",null,null,null,null,"medijobs platform srl",null,null,null,null,null,null,null,null,null],["2023/PL/020","ETid-1808","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-02-08","day",7200,null,"EUR","Company","Finance, Insurance and Consulting","Art. 24(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.50.2021","https://www.enforcementtracker.com/ETid-1808",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/003","ETid-2292","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-08","day",500,null,"EUR","Hiper Store S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/documento/ps-00016-2023.pdf","https://www.enforcementtracker.com/ETid-2292",null,null,null,null,"hiper store sl",null,null,null,null,null,null,null,null,null],["2023/IT/160","Garante per la protezione dei dati personali (Italy) - 9996609","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-02-08","day",null,null,null,"Maggioli S.p.A.",null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 28, Art. 4(11), Art. 5, Art. 7","Accountability, Consent, Data principles, Processor obligations, Transparency",null,"Violation found","https://gdprhub.eu/images/1/1c/IT_DPA_9996009_08.02.2024.pdf%20","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9996609",null,"gdprhub",null,null,"maggioli spa",null,null,null,null,null,null,null,null,null],["2023/PL/022","ETid-1732","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-02-07","day",321,null,"EUR","Housing association","Real Estate","Art. 33(1), Art. 5(1)(a)","Data breach, Data principles","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/pl/138/2656","https://www.enforcementtracker.com/ETid-1732",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IS/012","Persónuvernd (Iceland) - 2021101915","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2023-02-07","day",null,null,null,null,null,"Art. 13, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/hljodritun-simtala-og-midlun-theirra-til-logreglu","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2021101915",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2023/NO/007","Datatilsynet (Norway) - 0/02422","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-02-06","day",null,"10000000","NOK","SATS ASA",null,"Art. 12, Art. 12(1), Art. 12(3), Art. 13, Art. 15, Art. 17, Art. 5(1)(a), Art. 5(1)(e), Art. 58(2)(i), Art. 6(1), Art. 60(3)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/f974410ee2e142c99cfc208cbae7634e/administrative-fine---sats-asa.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_0/02422",null,"gdprhub",null,null,"sats asa",null,10000000.0,905567,"day 2023-02-06|11.0428|NOK",null,null,null,null,null],["2023/NO/003","ETid-1656","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2023-02-06","day",900000,null,"EUR","Sats ASA","Industry and Commerce","Art. 13, Art. 15, Art. 17, Art. 6(1)","Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/overtredelsesgebyr-til-sats/","https://www.enforcementtracker.com/ETid-1656",null,null,null,null,"sats asa",null,null,null,null,null,null,null,null,null],["2023/HU/002","ETid-1824","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2023-02-06","day",80500,null,"EUR","I&S Limited Kft","Accommodation and Hospitality","Art. 24, Art. 25, Art. 6(1), Art. 9(2)","Accountability, Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=647:szepsegszalonban-vegzett-kameras-megfigyeles-es-marketing-celu-adatkezeles","https://www.enforcementtracker.com/ETid-1824",null,null,null,null,"i and s ltd kft",null,null,null,null,null,null,null,null,null],["2023/HU/006","NAIH (Hungary) - NAIH-2732-2-2023","gdprhub","Hungary","HU","NAIH (Hungary)","2023-02-06","day",null,"30000000","HUF",null,null,"Art. 13(1), Art. 13(2), Art. 24, Art. 25, Art. 32(1)(b), Art. 32(2), Art. 5(1), Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)","Accountability, Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=647:szepsegszalonban-vegzett-kameras-megfigyeles-es-marketing-celu-adatkezeles","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2732-2-2023",null,"gdprhub",null,"Beauty salon",null,null,30000000.0,76760,"day 2023-02-06|390.8300|HUF",null,null,null,null,null],["2023/ES/237","ETid-1627","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-03","day",500,null,"EUR","MIRACLE IBIZA S.L.","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00130-2022.pdf","https://www.enforcementtracker.com/ETid-1627",null,null,null,null,"miracle ibiza sl",null,null,null,null,null,null,null,null,null],["2023/ES/236","ETid-1628","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-02-03","day",600,null,"EUR","HOTEL VILLA SORO, S.L.","Accommodation and Hospitality","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00608-2022.pdf","https://www.enforcementtracker.com/ETid-1628",null,null,null,null,"hotel villa soro sl",null,null,null,null,null,null,null,null,null],["2023/CY/007","ETid-1818","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023-02-03","day",3250,null,"EUR","Epic Ltd.","Media, Telecoms and Broadcasting","Art. 32(1), Art. 6(1)","Data security, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/AB0419759D932D4BC22589A300345448?OpenDocument","https://www.enforcementtracker.com/ETid-1818",null,null,null,null,"epic ltd",null,null,null,null,null,null,null,null,null],["2023/BE/004","APD/GBA (Belgium) - 06/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-02-02","day",null,null,null,null,null,"Art. 15(1)(a), Art. 15(1)(c)","Data subject rights",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-06-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_06/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/DK/003","Datatilsynet (Denmark) - 2021-432-0070","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2023-02-02","day",null,null,null,"Statens Serum Institute",null,"Art. 14(1), Art. 14(3), Art. 14(5)(b), Art. 5(1)(b)","Data principles, Transparency",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2023/feb/statens-serum-instituts-opfyldelse-af-oplysningspligten","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-432-0070",null,"gdprhub",null,null,"DK: statens serum institute",null,null,null,null,null,null,null,null,null],["2023/GR/010","ETid-1765","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-02-02","day",10000,null,"EUR","Vodafone","Media, Telecoms and Broadcasting","Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-tilepikoinoniako-paroho-gia-epexergasia-dedomenon","https://www.enforcementtracker.com/ETid-1765","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_5/2023","gdprhub",null,null,"GR: vodafone","Vodafone",null,null,null,null,null,null,null,null],["2023/GR/009","ETid-1766","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-02-02","day",30000,null,"EUR","Piraeus Bank","Finance, Insurance and Consulting","Art. 33, Art. 34","Data breach, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/index.php/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-se-trapeza-gia-paranomi-diabibasi-kai-mi-gnostopoiisi","https://www.enforcementtracker.com/ETid-1766","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_4/2023","gdprhub",null,null,"GR: piraeus bank",null,null,null,null,null,null,null,null,null],["2023/IT/095","Garante per la protezione dei dati personali (Italy) - 9852214","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-02-02","day",null,null,null,null,null,"Art. 13, Art. 5, Art. 58(1), Art. 58(2)(f), Art. 6, Art. 8, Art. 9","Consent, Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9852214#english","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9852214",null,"gdprhub",null,"AI chatbot provider",null,null,null,null,null,null,null,null,null,null],["2023/RO/045","ETid-1605","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-02-01","day",1000,null,"EUR","Tensa Art Design SA","Industry and Commerce","Art. 21(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_01.02.2023&lang=ro","https://www.enforcementtracker.com/ETid-1605",null,null,null,null,"tensa art design sa",null,null,null,null,null,null,null,null,null],["2023/RO/047","ETid-1600","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-01-31","day",1000,null,"EUR","Dent Estet Clinic SA","Health Care","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_31_01_2023_1&lang=ro","https://www.enforcementtracker.com/ETid-1600",null,null,null,null,"dent estet clinic sa",null,null,null,null,null,null,null,null,null],["2023/RO/046","ETid-1601","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-01-31","day",1000,null,"EUR","Dentist","Health Care","Art. 6(1)(a), Art. 9(2)(a)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_31_01_2023_1&lang=ro","https://www.enforcementtracker.com/ETid-1601",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/241","ETid-1602","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-31","day",180,null,"EUR",null,null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00474-2022.pdf","https://www.enforcementtracker.com/ETid-1602",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/240","ETid-1603","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-31","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00026-2022.pdf","https://www.enforcementtracker.com/ETid-1603",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/239","ETid-1604","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-31","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00597-2021.pdf","https://www.enforcementtracker.com/ETid-1604",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/034","BfDI (Germany) - 16-536/007","gdprhub","Germany","DE","BfDI (Germany)","2023-01-27","day",null,null,null,"ITZBund",null,"Art. 58(2)(b)",null,null,"Violation found","https://fragdenstaat.de/anfrage/sanktionen-gegen-das-stba-bzw-itzbund/804990/anhang/img20230525-17520168_geschwaerzt.pdf","https://gdprhub.eu/index.php?title=BfDI_%28Germany%29_-_16-536/007",null,"gdprhub",null,null,"DE: itzbund",null,null,null,null,null,null,null,null,null],["2023/ES/244","ETid-1596","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-27","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00299-2022.pdf","https://www.enforcementtracker.com/ETid-1596",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/BG/009","CPDP (Bulgaria) - PPN-01-462/15.06.2021","gdprhub","Bulgaria","BG","CPDP (Bulgaria)","2023-01-26","day",null,null,null,null,null,"Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://cpdp.bg/%25d1%2580%25d0%25b5%25d1%2588%25d0%25b5%25d0%25bd%25d0%25b8%25d0%25b5-%25d0%25bf%25d0%25be-%25d0%25b6%25d0%25b0%25d0%25bb%25d0%25b1%25d0%25b0-%25d1%2581-%25d1%2580%25d0%25b5%25d0%25b3-%25e2%2584%2596-%25d0%25bf%25d0%25bf%25d0%25bd-01-462-15-06-2021-%25d0%25b3/","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PPN-01-462/15.06.2021",null,"gdprhub",null,"Co-owner of a residential building",null,null,null,null,null,"person",null,null,null,null],["2023/IT/093","ETid-1693","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-01-26","day",5000,null,"EUR","Azienda ULSS n.5 Polesana","Health Care","Art. 5(1)(f), Art. 9","Data principles, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9861289","https://www.enforcementtracker.com/ETid-1693",null,null,null,null,"IT: azienda ulss n5 polesana",null,null,null,null,null,null,null,null,null],["2023/IT/089","ETid-1754","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-01-26","day",7000,null,"EUR","Azienda Ospedaliera Bianchi Melacrino Morelli","Health Care","Art. 32, Art. 5, Art. 9","Data principles, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9863050","https://www.enforcementtracker.com/ETid-1754",null,null,null,null,"IT: azienda ospedaliera bianchi melacrino morelli",null,null,null,null,null,null,null,null,null],["2023/IT/087","ETid-1761","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-01-26","day",5000,null,"EUR","Misterbianco municipality","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9865528","https://www.enforcementtracker.com/ETid-1761",null,null,null,null,"IT: misterbianco municipality",null,null,null,null,null,null,null,null,null],["2023/BG/003","ETid-2882","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2023-01-26","day",12800,null,"EUR","Political Party","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://cpdp.bg/%d1%80%d0%b5%d1%88%d0%b5%d0%bd%d0%b8%d0%b5-%d0%bf%d0%be-%d0%b6%d0%b0%d0%bb%d0%b1%d0%b8-%d1%81-%d1%80%d0%b5%d0%b3-%e2%84%96-%d0%bf%d0%bf%d0%bd-01-223-12-03-2021-%d0%b3-%d0%bf%d0%bf%d0%bd-01-307-09-0/","https://www.enforcementtracker.com/ETid-2882","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PPN-01-223/2021%2C_PPN-01-307/2021%2C_PPN-01-296/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IT/111","Garante per la protezione dei dati personali (Italy) - 9867661","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-26","day",null,null,null,"Il Sole 24 Ore S.p.a.",null,"Art. 17(1)(c), Art. 58(2)(a), Art. 58(2)(c), Art. 58(2)(g)","Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9867661","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9867661",null,"gdprhub",null,null,"il sole 24 ore spa",null,null,null,null,null,null,null,null,null],["2023/BE/003","APD/GBA (Belgium) - 04/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-01-25","day",null,null,null,null,null,"Art. 12(2), Art. 17(1), Art. 5(1)(c), Art. 5(2)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-04-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_04/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/243","ETid-1597","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-25","day",180,null,"EUR",null,null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00491-2022.pdf","https://www.enforcementtracker.com/ETid-1597",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/242","ETid-1598","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-25","day",3000,null,"EUR","CASAL DE L'ESPLUGA DE FRANCOLÍ","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00497-2022.pdf","https://www.enforcementtracker.com/ETid-1598",null,null,null,null,"ES: casal de l espluga de francoli",null,null,null,null,null,null,null,null,null],["2023/PL/013","ETid-1982","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-01-25","day",4100,null,"EUR","Company",null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/decyzje/DKE.561.35.2022","https://www.enforcementtracker.com/ETid-1982",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/LT/001","ETid-2200","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2023-01-24","day",8000,null,"EUR","Company","Health Care","Art. 15(3), Art. 5(1)(a)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/Apibendrinimas%20d%C4%97l%20BDAR%2015%20str_%202023-01-24.pdf","https://www.enforcementtracker.com/ETid-2200",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/IE/005","ETid-1666","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2023-01-23","day",460000,null,"EUR","Centric Health Ltd.","Health Care","Art. 32(1), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2023-02/IN-21-2-4%20Final%20Decision_Redacted.pdf","https://www.enforcementtracker.com/ETid-1666",null,null,null,null,"centric health ltd",null,null,null,null,null,null,null,null,null],["2023/IT/102","Garante per la protezione dei dati personali (Italy) - 9861289","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-23","day",5000,"5.000","EUR","Azienda ULSS",null,"Art. 32, Art. 5(1)(f), Art. 9","Data principles, Data security, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9861941","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9861289",null,"gdprhub",null,null,"IT: azienda ulss",null,null,null,null,null,null,null,null,null],["2023/ES/247","ETid-1580","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-20","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00167-2022.pdf","https://www.enforcementtracker.com/ETid-1580",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/246","ETid-1581","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-20","day",360,null,"EUR","TECNO MOTOR LA MUELA, S.L.L","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00425-2022.pdf","https://www.enforcementtracker.com/ETid-1581",null,null,null,null,"ES: tecno motor la muela sll",null,null,null,null,null,null,null,null,null],["2023/IE/006","ETid-1578","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2023-01-19","day",5500000,null,"EUR","WhatsApp Ireland Ltd.","Media, Telecoms and Broadcasting","Art. 12, Art. 13(1)(c), Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-inquiry-whatsapp","https://www.enforcementtracker.com/ETid-1578","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Whatsapp_Ireland_Limited_-_IN-18-5-6","gdprhub",null,null,"whatsapp ireland ltd","Meta",null,null,null,null,null,null,null,null],["2023/PL/023","ETid-1688","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2023-01-19","day",6400,null,"EUR","Szczecin-Centrum District Court","Public Sector and Education","Art. 24(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/pl/138/2639","https://www.enforcementtracker.com/ETid-1688",null,null,null,null,"PL: szczecin centrum district court",null,null,null,null,null,null,null,null,null],["2023/NL/009","ETid-1776","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2023-01-19","day",150000,null,"EUR","Dutch Social Insurance Institution (SVB)","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.autoriteitpersoonsgegevens.nl/nl/nieuws/boete-voor-svb-na-gebrekkige-identiteitscontrole","https://www.enforcementtracker.com/ETid-1776","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_19.01.2023","gdprhub",null,null,"NL: dutch social insurance institution",null,null,null,null,null,null,null,null,null],["2023/ES/009","ETid-2249","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-19","day",56000,null,"EUR","BANCO BILBAO VIZCAYA ARGENTARIA, S.A","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00147-2023.pdf","https://www.enforcementtracker.com/ETid-2249",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2023/SE/021","IMY (Sweden) - 2022-1032","gdprhub","Sweden","SE","IMY (Sweden)","2023-01-19","day",null,null,null,"Lensway Group AB",null,"Art. 12(2), Art. 12(6)","Transparency",null,"Violation found","https://www.imy.se/contentassets/4a448ecb94804740b8e4389d771d1732/beslut-tillsyn-lensway-group-ab.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_2022-1032",null,"gdprhub",null,null,"lensway group ab",null,null,null,null,null,null,null,null,null],["2023/SE/013","IMY (Sweden) - DI-2021-4355","gdprhub","Sweden","SE","IMY (Sweden)","2023-01-19","day",null,null,null,"If Skadeförsäkring AB",null,"Art. 32, Art. 32(1), Art. 58(2)(b), Art. 60, Art. 9","Data security, Special categories",null,"Violation found","https://edpb.europa.eu/system/files/2023-05/se_2023-01_decision_public_redacted_0.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-4355",null,"gdprhub",null,null,"if skadeforsakring ab",null,null,null,null,null,null,null,null,null],["2023/SE/014","IMY (Sweden) - IMY-2022-1032","gdprhub","Sweden","SE","IMY (Sweden)","2023-01-19","day",null,null,null,"Lensway",null,"Art. 12(2), Art. 12(6), Art. 17, Art. 56, Art. 60","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2023-05/se_2023-01_decision_public_redacted_1.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2022-1032",null,"gdprhub",null,null,"SE: lensway",null,null,null,null,null,null,null,null,null],["2023/PL/024","UODO (Poland) - DKN.5131.12.2020","gdprhub","Poland","PL","UODO (Poland)","2023-01-19","day",null,"30,000","PLN",null,null,"Art. 24(1), Art. 25(1), Art. 25(2), Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5131.12.2020#","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.12.2020",null,"gdprhub",null,null,null,null,30000.0,6374,"day 2023-01-19|4.7063|PLN",null,null,null,null,null],["2023/BE/002","APD/GBA (Belgium) - 02/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2023-01-18","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 17(1)","Data subject rights, Transparency",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-02-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_02/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/RO/048","ETid-1577","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-01-18","day",1000,null,"EUR","Dante Internațional SA","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_18_01_2023&lang=ro","https://www.enforcementtracker.com/ETid-1577",null,null,null,null,"dante international sa",null,null,null,null,null,null,null,null,null],["2023/ES/245","ETid-1582","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-18","day",2000,null,"EUR","Private investigator","Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00357-2022.pdf","https://www.enforcementtracker.com/ETid-1582","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202206542","gdprhub",null,null,"ES: private investigator",null,null,null,null,null,null,null,null,null],["2023/IT/097","Garante per la protezione dei dati personali (Italy) - 9860461","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-18","day",null,null,null,null,null,"Art. 9","Special categories",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9860461","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9860461",null,"gdprhub",null,"Newspaper",null,null,null,null,null,null,null,null,null,null],["2023/IT/098","Garante per la protezione dei dati personali (Italy) - 9860487","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-18","day",null,null,null,null,null,"Art. 9","Special categories",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9860487","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9860487",null,"gdprhub",null,"Newspaper",null,null,null,null,null,null,null,null,null,null],["2023/IT/099","Garante per la protezione dei dati personali (Italy) - 9860513","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-18","day",null,null,null,null,null,"Art. 9","Special categories",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9860513","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9860513",null,"gdprhub",null,"Newspaper",null,null,null,null,null,null,null,null,null,null],["2023/IT/100","Garante per la protezione dei dati personali (Italy) - 9860529","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-18","day",null,null,null,null,null,"Art. 9","Special categories",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9860529","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9860529",null,"gdprhub",null,"Newspaper",null,null,null,null,null,null,null,null,null,null],["2023/FI/004","Tietosuojavaltuutetun toimisto (Finland) - 3116/163/20","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2023-01-18","day",null,null,null,null,null,"Art. 12(1), Art. 13(1)(c), Art. 5(1)","Data principles, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2023/20231703","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3116/163/20",null,"gdprhub",null,"Pre-school",null,null,null,null,null,null,null,null,null,null],["2023/BG/008","CPDP (Bulgaria) - PPN-01-291/03.05.2022","gdprhub","Bulgaria","BG","CPDP (Bulgaria)","2023-01-17","day",null,"2,000","BGN",null,null,"Art. 24, Art. 5(1)(a), Art. 6(1)","Accountability, Data principles, Unlawful processing",null,"Violation found","https://cpdp.bg/%25d1%2580%25d0%25b5%25d1%2588%25d0%25b5%25d0%25bd%25d0%25b8%25d0%25b5-%25d0%25bf%25d0%25be-%25d0%25b6%25d0%25b0%25d0%25bb%25d0%25b1%25d0%25b0-%25d1%2581-%25d1%2580%25d0%25b5%25d0%25b3-%25e2%2584%2596-%25d0%25bf%25d0%25bf%25d0%25bd-01-291-03-05-2022-%25d0%25b3/","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PPN-01-291/03.05.2022",null,"gdprhub",null,null,null,null,2000.0,1023,"day 2023-01-17|1.9558|BGN",null,null,null,null,null],["2023/SE/011","ETid-1579","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2023-01-17","day",17900,null,"EUR","Dalarna Region","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2023/beslut-tillsyn-region-dalarna.pdf","https://www.enforcementtracker.com/ETid-1579","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2022-695","gdprhub",null,null,"SE: dalarna region",null,null,null,null,null,null,null,null,null],["2023/BG/002","ETid-2883","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2023-01-17","day",1020,null,"EUR","Telecommunications Operator","Media, Telecoms and Broadcasting","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://cpdp.bg/%d1%80%d0%b5%d1%88%d0%b5%d0%bd%d0%b8%d0%b5-%d0%bf%d0%be-%d0%b6%d0%b0%d0%bb%d0%b1%d0%b0-%d1%81-%d1%80%d0%b5%d0%b3-%e2%84%96-%d0%bf%d0%bf%d0%bd-01-291-03-05-2022-%d0%b3/","https://www.enforcementtracker.com/ETid-2883","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PP-01-291/03.05.2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/IE/009","DPC (Ireland) - 05/SIU/2018","gdprhub","Ireland","IE","DPC (Ireland)","2023-01-16","day",50000,"50000","EUR","Kildare County Council",null,"Art. 13, Art. 2, Art. 26, Art. 32, Art. 5, Art. 58, Art. 6, Art. 83","Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/en/resources/law/decisions/kildare-county-council-january-2023","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_05/SIU/2018",null,"gdprhub",null,null,"IE: kildare county council",null,null,null,null,null,null,null,null,null],["2023/AT/005","DSB (Austria) - W101 2218962-2/33E","gdprhub","Austria","AT","DSB (Austria)","2023-01-16","day",null,null,null,null,null,null,null,null,"Rejected","https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=6380de79-8202-40a0-ae40-34175e72691b&Position=1&SkipToDocumentPage=True&Abfrage=Bvwg&Entscheidungsart=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=&VonDatum=01.01.2014&BisDatum=&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=EinerWoche&ResultPageSize=100&Suchworte=DSGVO&Dokumentnummer=BVWGT_20230116_W101_2218962_2_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_W101_2218962-2/33E",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/250","ETid-1571","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-16","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00371-2022.pdf","https://www.enforcementtracker.com/ETid-1571",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/249","ETid-1572","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-16","day",56000,null,"EUR","Vodafone España, S.A.U.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00434-2022.pdf","https://www.enforcementtracker.com/ETid-1572",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2023/ES/248","ETid-1576","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-16","day",40000,null,"EUR","Thomas International Systems, S.A.","Finance, Insurance and Consulting","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00214-2022.pdf","https://www.enforcementtracker.com/ETid-1576",null,null,null,null,"thomas international systems sa",null,null,null,null,null,null,null,null,null],["2023/CY/008","ETid-1817","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023-01-16","day",7000,null,"EUR","Πολίτης newspaper","Media, Telecoms and Broadcasting","Art. 5(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/AB0419759D932D4BC22589A300345448?OpenDocument","https://www.enforcementtracker.com/ETid-1817","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.010.045","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/255","ETid-1554","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-13","day",1000,null,"EUR","EDITORIAL RIBADEO S.L.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00465-2022.pdf","https://www.enforcementtracker.com/ETid-1554",null,null,null,null,"editorial ribadeo sl",null,null,null,null,null,null,null,null,null],["2023/GR/011","ETid-1566","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2023-01-13","day",50000,null,"EUR","Intellexa SA","Industry and Commerce","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-stin-etaireia-intellexa-gia-mi-synergasia-me-tin-arhi","https://www.enforcementtracker.com/ETid-1566",null,null,null,null,"intellexa sa",null,null,null,null,null,null,null,null,null],["2023/RO/049","ETid-1552","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-01-12","day",2000,null,"EUR","BRISTOL LOGISTICS SA","Transportation and Energy","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_12_01_2023&lang=ro","https://www.enforcementtracker.com/ETid-1552",null,null,null,null,"bristol logistics sa",null,null,null,null,null,null,null,null,null],["2023/ES/254","ETid-1555","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-12","day",3000,null,"EUR","SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L.","Employment","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00469-2022.pdf","https://www.enforcementtracker.com/ETid-1555",null,null,null,null,"servicios integrales del hogar tenerife sl",null,null,null,null,null,null,null,null,null],["2023/LV/002","DVI (Latvia) - LocateFamily administrācija","gdprhub","Latvia","LV","DVI (Latvia)","2023-01-11","day",null,null,null,"LocateFamily",null,"Art. 5(1)(b), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.dvi.gov.lv/lv/media/2349/download?attachment","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_LocateFamily_administr%C4%81cija",null,"gdprhub",null,null,"LV: locatefamily",null,null,null,null,null,null,null,null,null],["2023/IT/094","ETid-1633","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-01-11","day",2500,null,"EUR","Azienda Sanitaria Locale di Brindisi","Health Care","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9853446","https://www.enforcementtracker.com/ETid-1633","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9853446","gdprhub",null,null,"IT: azienda sanitaria locale di brindisi",null,null,null,null,null,null,null,null,null],["2023/IT/092","ETid-1694","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-01-11","day",6000,null,"EUR","Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9857610","https://www.enforcementtracker.com/ETid-1694",null,null,null,null,"IT: ufficio scolastico regionale per la lombardia ufficio iv ambito territoriale di brescia",null,null,null,null,null,null,null,null,null],["2023/IT/088","ETid-1755","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2023-01-11","day",5000,null,"EUR","Azienda Ospedale-Università Padova","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9861356","https://www.enforcementtracker.com/ETid-1755","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9861356","gdprhub",null,null,"IT: azienda ospedale universita padova",null,null,null,null,null,null,null,null,null],["2023/IT/101","Garante per la protezione dei dati personali (Italy) - 9861827","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-11","day",5000,"5,000","EUR","Reweb s.r.l.",null,"Art. 12, Art. 13, Art. 17, Art. 5(1)(a), Art. 5(1)(c), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9861827","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9861827",null,"gdprhub",null,null,"reweb srl",null,null,null,null,null,null,null,null,null],["2023/IT/103","Garante per la protezione dei dati personali (Italy) - 9864063","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-11","day",80000,"80,000","EUR",null,null,"Art. 25(1), Art. 25(2), Art. 32, Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(f), Art. 6","Accountability, Data principles, Data security, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9864063","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9864063",null,"gdprhub",null,"Electronic communications provider",null,null,null,null,null,null,null,null,null,null],["2023/IT/105","Garante per la protezione dei dati personali (Italy) - 9866622","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-11","day",null,null,null,"Google LLC",null,"Art. 17(1)(c), Art. 21(1)","Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9866622","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9866622",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2023/IT/107","Garante per la protezione dei dati personali (Italy) - 9868111","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2023-01-11","day",5000,"5,000","EUR","Associazione Nazionale Magistrati",null,"Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9868111","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9868111",null,"gdprhub",null,null,"IT: associazione nazionale magistrati",null,null,null,null,null,null,null,null,null],["2023/GR/013","HDPA (Greece) - 1/2023","gdprhub","Greece","GR","HDPA (Greece)","2023-01-11","day",null,null,null,"Google",null,"Art. 17, Art. 21(1), Art. 21(2), Art. 51, Art. 55, Art. 56(2)","Data subject rights",null,"Other Outcome","https://www.dpa.gr/index.php/el/enimerwtiko/prakseisArxis/dikaioma-sti-lithi-parapompi-exetasis-kataggelias-kata-tis-google-llc-apo","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_1/2023",null,"gdprhub",null,null,"GR: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2023/ES/253","ETid-1556","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-10","day",120,null,"EUR","Homeowners Association","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00351-2022.pdf","https://www.enforcementtracker.com/ETid-1556",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/252","ETid-1557","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-10","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00570-2021.pdf","https://www.enforcementtracker.com/ETid-1557",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/287","APDCAT (Catalonia) - IAI 50/2022","gdprhub","Spain","ES","APDCAT (Catalonia)","2023-01-09","day",null,null,null,null,null,"Art. 6(1)(c), Art. 86","Unlawful processing",null,null,"https://apdcat.gencat.cat/web/.content/Resolucio/Resolucions_Cercador/Dictamens/2022/Documents/ca_iai_2022_050.pdf","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_IAI_50/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2023/AT/022","DSB (Austria) - DSB-D130.217","gdprhub","Austria","AT","DSB (Austria)","2023-01-09","day",null,null,null,"Wikimedia Foundation Inc",null,"Art. 17, Art. 17(3)(a), Art. 3, Art. 4(7), Art. 5(1)(d), Art. 85","Data principles, Data subject rights",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20230109_2022_0_479_809_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D130.217",null,"gdprhub",null,null,"wikimedia foundation inc",null,null,null,null,null,null,null,null,null],["2023/NO/006","Datatilsynet (Norway) - 20/01772","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-01-09","day",null,null,null,"Church of Norway - Den norske kirke",null,"Art. 12(1), Art. 14(1)(d), Art. 14(2)(f), Art. 14(5)(c), Art. 17(1)(d), Art. 58(2)(b), Art. 6(1), Art. 6(1)(c), Art. 6(1)(e), Art. 6(3), Art. 9(2)(d), Art. 9(2)(g)","Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/269d6dc8a3c94bf48f9f345c1d71222d/~-20_01772-19-vedtak-om-irettesettelse---behandling-av-mindreariges-opplysninger-i-den-norske-ki-334535_19_1.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01772",null,"gdprhub",null,null,"NO: church of norway den norske kirke",null,null,null,null,null,null,null,null,null],["2023/NO/005","Datatilsynet (Norway) - 20/02144","gdprhub","Norway","NO","Datatilsynet (Norway)","2023-01-09","day",null,null,null,"PostNord AS",null,"Art. 32(1), Art. 32(2), Art. 58(2)(d)","Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/4cc976be3b2f4ddcb379150c7227f1f8/~-20_02144-16-vedtak-om-palegg---postnord-as-359108_4_1.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02144",null,"gdprhub",null,null,"postnord as",null,null,null,null,null,null,null,null,null],["2023/ES/251","ETid-1558","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-09","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00174-2022.pdf","https://www.enforcementtracker.com/ETid-1558",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/ES/260","AEPD (Spain) - EXP202102056","gdprhub","Spain","ES","AEPD (Spain)","2023-01-06","day",null,null,null,"Island Council of El Hierro",null,"Art. 30, Art. 32, Art. 5(1)(f), Art. 58(2), Art. 83, Art. 99","Data principles, Data security",null,"Violation found","https://www.aepd.es/es/documento/ps-00009-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202102056",null,"gdprhub",null,null,"ES: island council of el hierro",null,null,null,null,null,null,null,null,null],["2023/IE/007","ETid-1543","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2023-01-04","day",390000000,null,"EUR","Meta Platforms Ireland Limited","Media, Telecoms and Broadcasting","Art. 12, Art. 13(1)(c), Art. 5(1)(a), Art. 6(1)","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland","https://www.enforcementtracker.com/ETid-1543",null,null,null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2023/RO/050","ETid-1546","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-01-04","day",3000,null,"EUR","Apă Canal Ilfov SA","Industry and Commerce","Art. 32(1)(b), Art. 32(2), Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_04.01.2023&lang=ro","https://www.enforcementtracker.com/ETid-1546",null,null,null,null,"apa canal ilfov sa",null,null,null,null,null,null,null,null,null],["2023/RO/051","ETid-1545","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2023-01-03","day",500,null,"EUR","Homeowners Association","Real Estate","Art. 5(1)(e)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_03_01_2023&lang=ro","https://www.enforcementtracker.com/ETid-1545",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/ES/256","ETid-1549","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-03","day",3000,null,"EUR","Transport Workers' Union of Aragon","Individuals and Private Associations","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00342-2022.pdf","https://www.enforcementtracker.com/ETid-1549",null,null,null,null,"ES: transport workers union of aragon",null,null,null,null,null,null,null,null,null],["2023/ES/238","ETid-1609","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2023-01-02","day",24000,null,"EUR","FACTOR ENERGÍA, S.A.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00508-2022.pdf","https://www.enforcementtracker.com/ETid-1609",null,null,null,null,"factor energia sa",null,null,null,null,null,null,null,null,null],["2023/DE/033","ETid-1617","cms_tracker","Germany","DE","Data Protection Authority of Sachsen-Anhalt","2023","year",9000,null,"EUR","Magdeburg University Hospital","Health Care","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.mz.de/mitteldeutschland/landespolitik/datenskandal-am-uniklinikum-magdeburg-verheimlichtes-datenleck-fuer-die-uniklinik-magdeburg-wird-es-teuer-3533154?reduced=true","https://www.enforcementtracker.com/ETid-1617",null,null,null,null,"DE: magdeburg university hospital",null,null,null,null,null,null,null,null,null],["2023/MT/002","ETid-1909","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2023","year",5000,null,"EUR",null,null,"Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://idpc.org.mt/decisions//","https://www.enforcementtracker.com/ETid-1909",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/MT/001","ETid-1910","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2023","year",2500,null,"EUR",null,null,"Art. 13, Art. 14, Art. 24(2), Art. 38(1), Art. 5(1)(a)","Accountability, Data principles, Data protection officer, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://idpc.org.mt/decisions//","https://www.enforcementtracker.com/ETid-1910",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/031","ETid-1995","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2023","year",215000,null,"EUR","Humboldt Forum Service GmbH","Employment",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.spiegel.de/kultur/humboldt-forum-muss-bussgelder-in-hoehe-von-215-000-euro-zahlen-a-48cba15c-7f1f-43d6-93bd-fa5ac5b99f8c?sara_ref=re-so-app-sh","https://www.enforcementtracker.com/ETid-1995",null,null,null,null,"humboldt forum service gmbh",null,null,null,null,null,null,null,null,null],["2023/CY/005","ETid-2050","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023","year",3000,null,"EUR","Breikot Management Ltd","Media, Telecoms and Broadcasting","Art. 5(1)(c), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/F1ABD895424BBAB1C2258A3E0028A4CA?OpenDocument","https://www.enforcementtracker.com/ETid-2050",null,null,null,null,"breikot management ltd",null,null,null,null,null,null,null,null,null],["2023/CY/004","ETid-2066","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023","year",8000,null,"EUR","Cypriot Ministry of the Interior","Public Sector and Education",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/F1ABD895424BBAB1C2258A3E0028A4CA?OpenDocument","https://www.enforcementtracker.com/ETid-2066",null,null,null,null,"CY: cypriot ministry of the interior",null,null,null,null,null,null,null,null,null],["2023/DE/030","ETid-2229","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2023","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/baden-wuerttemberg/landesdatenschutzbeauftragter/862-39-tb-lfd-baden-wuerttemberg-2023-17-6100-vom-02-02-2024/file","https://www.enforcementtracker.com/ETid-2229",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/029","ETid-2230","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2023","year",null,null,"EUR","Pizza delivery service","Accommodation and Hospitality","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/baden-wuerttemberg/landesdatenschutzbeauftragter/862-39-tb-lfd-baden-wuerttemberg-2023-17-6100-vom-02-02-2024/file","https://www.enforcementtracker.com/ETid-2230",null,null,null,null,"DE: pizza delivery service",null,null,null,null,null,null,null,null,null],["2023/DE/028","ETid-2231","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2023","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/baden-wuerttemberg/landesdatenschutzbeauftragter/862-39-tb-lfd-baden-wuerttemberg-2023-17-6100-vom-02-02-2024/file","https://www.enforcementtracker.com/ETid-2231",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/027","ETid-2232","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2023","year",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/baden-wuerttemberg/landesdatenschutzbeauftragter/862-39-tb-lfd-baden-wuerttemberg-2023-17-6100-vom-02-02-2024/file","https://www.enforcementtracker.com/ETid-2232",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/026","ETid-2233","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2023","year",1200,null,"EUR","Police officer","Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/baden-wuerttemberg/landesdatenschutzbeauftragter/862-39-tb-lfd-baden-wuerttemberg-2023-17-6100-vom-02-02-2024/file","https://www.enforcementtracker.com/ETid-2233",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/025","ETid-2234","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",null,null,"EUR","Company","Employment",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2234",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/024","ETid-2235","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",null,null,"EUR","Company","Employment","Art. 6(1)(a)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2235",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/023","ETid-2236","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",null,null,"EUR","Company","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2236",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/022","ETid-2237","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",null,null,"EUR","Clinic","Health Care","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2237",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/021","ETid-2238","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",null,null,"EUR","Real estate agency","Real Estate",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2238",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/020","ETid-2239","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",null,null,"EUR","Operator of a dating platform",null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2239",null,null,null,null,"DE: operator of a dating platform",null,null,null,null,null,null,null,null,null],["2023/DE/019","ETid-2240","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",null,null,"EUR","Website operator",null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2240",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/018","ETid-2241","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2023","year",1001000,null,"EUR","Police officers","Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/864-6-tb-dsgvo-lfd-bremen-2023-o-drs-nr-vom-15-03-2024/file","https://www.enforcementtracker.com/ETid-2241",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/CY/001","ETid-2248","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2023","year",8000,null,"EUR","Bank of Cyprus Public Company Ltd.","Finance, Insurance and Consulting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/F880C7270072D4E0C2258AAE0049CEAB?OpenDocument","https://www.enforcementtracker.com/ETid-2248",null,null,null,null,"bank of cyprus public company ltd",null,null,null,null,null,null,null,null,null],["2023/AT/001","ETid-2256","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2023","year",28000,null,"EUR","Political party","Public Sector and Education",null,null,"Unknown","Fine issued","https://www.dsb.gv.at/newsletter/dsb-newsletter-1-2024.html","https://www.enforcementtracker.com/ETid-2256",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/017","ETid-2280","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2023","year",75000,null,"EUR","Company","Employment","Art. 32, Art. 9","Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/868-32-tb-lfd-hamburg-2023-o-drs-nr-vom-15-04-2024/file","https://www.enforcementtracker.com/ETid-2280",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/016","ETid-2281","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2023","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/868-32-tb-lfd-hamburg-2023-o-drs-nr-vom-15-04-2024/file","https://www.enforcementtracker.com/ETid-2281",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/015","ETid-2282","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2023","year",null,null,"EUR","Daycare center","Public Sector and Education","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/868-32-tb-lfd-hamburg-2023-o-drs-nr-vom-15-04-2024/file","https://www.enforcementtracker.com/ETid-2282",null,null,null,null,"DE: daycare center",null,null,null,null,null,null,null,null,null],["2023/DE/014","ETid-2299","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2023","year",null,null,"EUR","Supermarket","Employment","Art. 6(1), Art. 9(1)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/869-25-tb-lfd-brandenburg-2023-o-drs-nr-vom-22-04-2024/file","https://www.enforcementtracker.com/ETid-2299",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/013","ETid-2300","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2023","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/869-25-tb-lfd-brandenburg-2023-o-drs-nr-vom-22-04-2024/file","https://www.enforcementtracker.com/ETid-2300",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/012","ETid-2301","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2023","year",null,null,"EUR","Police officer","Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/869-25-tb-lfd-brandenburg-2023-o-drs-nr-vom-22-04-2024/file","https://www.enforcementtracker.com/ETid-2301",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/011","ETid-2302","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2023","year",null,null,"EUR","Fishing club","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/869-25-tb-lfd-brandenburg-2023-o-drs-nr-vom-22-04-2024/file","https://www.enforcementtracker.com/ETid-2302",null,null,null,null,"DE: fishing club",null,null,null,null,null,null,null,null,null],["2023/DE/010","ETid-2309","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2023","year",3600,null,"EUR","Physician","Health Care","Art. 32(1)(b), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/874-52-tb-lfd-hessen-2023-21-27-vom-07-05-2024/file","https://www.enforcementtracker.com/ETid-2309",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/009","ETid-2310","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2023","year",25000,null,"EUR","Company",null,"Art. 21(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/874-52-tb-lfd-hessen-2023-21-27-vom-07-05-2024/file","https://www.enforcementtracker.com/ETid-2310",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/008","ETid-2311","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2023","year",5000,null,"EUR","Company",null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/874-52-tb-lfd-hessen-2023-21-27-vom-07-05-2024/file","https://www.enforcementtracker.com/ETid-2311",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/007","ETid-2353","cms_tracker","Germany","DE","Data Protection Authority of Bavaria","2023","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutzarchiv.org/fileadmin/Dokumente/2023/13_TB_Noeb_Bayern_2023_oDrsNr_28022024.pdf","https://www.enforcementtracker.com/ETid-2353",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/006","ETid-2354","cms_tracker","Germany","DE","Data Protection Authority of Bavaria","2023","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutzarchiv.org/fileadmin/Dokumente/2023/13_TB_Noeb_Bayern_2023_oDrsNr_28022024.pdf","https://www.enforcementtracker.com/ETid-2354",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/005","ETid-2355","cms_tracker","Germany","DE","Data Protection Authority of Bavaria","2023","year",null,null,"EUR","Store detective","Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutzarchiv.org/fileadmin/Dokumente/2023/13_TB_Noeb_Bayern_2023_oDrsNr_28022024.pdf","https://www.enforcementtracker.com/ETid-2355",null,null,null,null,"DE: store detective",null,null,null,null,null,null,null,null,null],["2023/DE/004","ETid-2356","cms_tracker","Germany","DE","Data Protection Authority of Bavaria","2023","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutzarchiv.org/fileadmin/Dokumente/2023/13_TB_Noeb_Bayern_2023_oDrsNr_28022024.pdf","https://www.enforcementtracker.com/ETid-2356",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/003","ETid-2357","cms_tracker","Germany","DE","Data Protection Authority of Bavaria","2023","year",null,null,"EUR","Physician","Health Care",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutzarchiv.org/fileadmin/Dokumente/2023/13_TB_Noeb_Bayern_2023_oDrsNr_28022024.pdf","https://www.enforcementtracker.com/ETid-2357",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2023/DE/002","ETid-2358","cms_tracker","Germany","DE","Data Protection Authority of Bavaria","2023","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutzarchiv.org/fileadmin/Dokumente/2023/13_TB_Noeb_Bayern_2023_oDrsNr_28022024.pdf","https://www.enforcementtracker.com/ETid-2358",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2023/DE/001","ETid-2433","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2023","year",16600,null,"EUR","Company","Real Estate","Art. 12, Art. 26, Art. 6","Transparency, Unlawful processing","Unknown","Fine issued","https://datenschutzarchiv.org/fileadmin/Dokumente/2023/29_TB_LfD_Niedersachen_2023_oDR-Nr_06062024.pdf","https://www.enforcementtracker.com/ETid-2433",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IE/011","DPC (Ireland) - Meta Platforms Ireland Limited (Facebook) - IN-18-5-5","gdprhub","Ireland","IE","DPC (Ireland)","2022-12-31","day",210000000,"210,000,000","EUR","Meta Platforms Ireland Limited",null,"Art. 12, Art. 13, Art. 21, Art. 24, Art. 4, Art. 5, Art. 56, Art. 58, Art. 6, Art. 60, Art. 65, Art. 7, Art. 77, Art. 79, Art. 83, Art. 9","Accountability, Consent, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://noyb.eu/sites/default/files/2023-01/DPCDecision_Facebook.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Meta_Platforms_Ireland_Limited_%28Facebook%29_-_IN-18-5-5",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/IE/012","DPC (Ireland) - Meta Platforms Ireland Limited (Instagram) - IN-18-5-7","gdprhub","Ireland","IE","DPC (Ireland)","2022-12-31","day",180000000,"180,000,000","EUR","Meta Platforms Ireland Limited",null,"Art. 12, Art. 13, Art. 21, Art. 24, Art. 4, Art. 5, Art. 56, Art. 58, Art. 6, Art. 60, Art. 65, Art. 7, Art. 77, Art. 79, Art. 83, Art. 9","Accountability, Consent, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://noyb.eu/sites/default/files/2023-01/DPCDecision_Instagram.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Meta_Platforms_Ireland_Limited_%28Instagram%29_-_IN-18-5-7",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/IE/001","ETid-1677","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2022-12-30","day",15000,null,"EUR","A&G Couriers Limited T/A Fastway Couriers (Ireland)","Transportation and Energy","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2023-03/IN-21-6-2%20Fastway%20Couriers%20Final%20Decision_Redacted%28S01%29.pdf","https://www.enforcementtracker.com/ETid-1677",null,null,null,null,"a and g couriers ltd ta fastway couriers",null,null,null,null,null,null,null,null,null],["2022/PL/001","ETid-2182","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-12-30","day",6300,null,"EUR","Company",null,null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.20.2022","https://www.enforcementtracker.com/ETid-2182",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/FR/019","CNIL (France) - SAN-2022-025","gdprhub","France","FR","CNIL (France)","2022-12-29","day",8000000,"8,000,000","EUR","Apple Distribution",null,"Art. 4(11)",null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046907077","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-025",null,"gdprhub",null,null,"FR: apple distribution",null,null,null,null,null,null,null,null,null],["2022/FR/021","CNIL (France) - SAN-2022-026","gdprhub","France","FR","CNIL (France)","2022-12-29","day",3000000,"3,000,000","EUR","VOODOO",null,null,null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046988935?init=true&page=1&query=SAN-2022-026&searchField=ALL&tab_selection=all","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-026",null,"gdprhub",null,null,"FR: voodoo",null,null,null,null,null,null,null,null,null],["2022/FR/020","CNIL (France) - SAN-2022-027","gdprhub","France","FR","CNIL (France)","2022-12-29","day",5000000,"5,000,000","EUR","TikTok",null,null,null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046977994?page=1&pageSize=10&query=2016%252F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-027",null,"gdprhub",null,null,"FR: tiktok","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2022/ES/010","ETid-1551","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-29","day",3000,null,"EUR","ADENET SYSTEMS, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00436-2022.pdf","https://www.enforcementtracker.com/ETid-1551",null,null,null,null,"adenet systems sl",null,null,null,null,null,null,null,null,null],["2022/ES/007","ETid-1561","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-29","day",24000,null,"EUR","SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L.","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00286-2022.pdf","https://www.enforcementtracker.com/ETid-1561","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202898","gdprhub",null,null,"suministrador iberico de energia sl",null,null,null,null,null,null,null,null,null],["2022/ES/013","ETid-1547","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-28","day",300,null,"EUR","Homeowners Association","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00376-2022.pdf","https://www.enforcementtracker.com/ETid-1547",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/012","ETid-1548","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-28","day",400,null,"EUR","MAE WEST SYSTEMS, S.L.","Accommodation and Hospitality","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00169-2022.pdf","https://www.enforcementtracker.com/ETid-1548",null,null,null,null,"mae west systems sl",null,null,null,null,null,null,null,null,null],["2022/ES/011","ETid-1550","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-28","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00126-2022.pdf","https://www.enforcementtracker.com/ETid-1550",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/009","ETid-1559","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-28","day",600,null,"EUR","Homeowners Association","Real Estate","Art. 13, Art. 6(1)(e)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00348-2022.pdf","https://www.enforcementtracker.com/ETid-1559",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/008","ETid-1560","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-28","day",300,null,"EUR","Store owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00294-2022.pdf","https://www.enforcementtracker.com/ETid-1560",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/006","ETid-1584","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-28","day",100000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00340-2021.pdf","https://www.enforcementtracker.com/ETid-1584",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/ES/005","ETid-1585","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-28","day",2000,null,"EUR","Homeowners Association","Employment","Art. 15, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00269-2022.pdf","https://www.enforcementtracker.com/ETid-1585",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/001","ETid-1540","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-12-27","day",3000,null,"EUR","Kaufland Romania SCS","Industry and Commerce","Art. 29, Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_27_12_2022&lang=ro","https://www.enforcementtracker.com/ETid-1540",null,null,null,null,"kaufland romania scs",null,null,null,null,null,null,null,null,null],["2022/FI/001","ETid-1583","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2022-12-27","day",122000,null,"EUR","Company","Industry and Commerce","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://tietosuoja.fi/-/terveystietoja-ilman-asianmukaista-suostumusta-kasitelleelle-yritykselle-seuraamusmaksu","https://www.enforcementtracker.com/ETid-1583","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_1198/161/2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/MT/008","IDPC (Malta) - CDP/IMI/LSA/22/2021","gdprhub","Malta","MT","IDPC (Malta)","2022-12-27","day",null,null,null,null,null,"Art. 12(3), Art. 15(1), Art. 15(2), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2023-05/mt_2022-12decisionpublic_redacted_0.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_CDP/IMI/LSA/22/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/053","APD/GBA (Belgium) - 189/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-12-22","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 5(2), Art. 58(2)(c)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-189-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_189/2022",null,"gdprhub",null,"Human resources provider",null,null,null,null,null,null,null,null,null,null],["2022/DK/037","Datatilsynet (Denmark) - 2021-31-5654","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-12-22","day",null,null,null,"Securitas A/S",null,"Art. 6(1)(a), Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/dec/videregivelse-af-personoplysninger-levede-op-til-gdpr","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5654",null,"gdprhub",null,null,"securitas as",null,null,null,null,null,null,null,null,null],["2022/RO/002","ETid-1539","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-12-22","day",10000,null,"EUR","SUDREZIDENȚIAL Broker S.R.L.","Finance, Insurance and Consulting","Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_22_12_2022&lang=ro","https://www.enforcementtracker.com/ETid-1539",null,null,null,null,"sudrezidential broker srl",null,null,null,null,null,null,null,null,null],["2023/LT/003","ETid-1563","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2022-12-22","day",6000,null,"EUR","Praktiškas UAB","Industry and Commerce","Art. 5(1)(a), Art. 9(1)","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/2022-12-22%20Sprendimas%20sporto%20klube%20biometriniai%2C%20bauda.pdf","https://www.enforcementtracker.com/ETid-1563",null,null,null,null,"praktiskas uab",null,null,null,null,null,null,null,null,null],["2022/IE/002","ETid-1564","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2022-12-22","day",100000,null,"EUR","VIEC Limited","Industry and Commerce","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2023-01/Final%20Decision%20VIEC%20IN-21-2-5%20121222_Redacted.pdf","https://www.enforcementtracker.com/ETid-1564",null,null,null,null,"viec ltd",null,null,null,null,null,null,null,null,null],["2022/IS/020","Persónuvernd (Iceland) - Case no. 2021112113","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-12-22","day",null,null,null,null,null,"Art. 5(1), Art. 6(1)(c)","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-embaettis-landlaeknis","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021112113",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/HU/008","ETid-1811","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-12-21","day",8000,null,"EUR","Hotel","Accommodation and Hospitality","Art. 12, Art. 13, Art. 31, Art. 5(1)(e), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu/eves-beszamolok?download=648:naih-beszamolo-a-2022-evi-tevekenysegrol","https://www.enforcementtracker.com/ETid-1811",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IT/180","Garante per la protezione dei dati personali (Italy) - 9853406","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-12-21","day",null,null,null,"Meta Ireland Limited",null,"Art. 5, Art. 56, Art. 57, Art. 58, Art. 6, Art. 61, Art. 66, Art. 9","Data principles, Special categories, Unlawful processing",null,"Other Outcome","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9853406","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9853406",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/HU/029","NAIH (Hungary) - NAIH-5114-35/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-12-21","day",null,"3000000","HUF",null,null,"Art. 12(1), Art. 13, Art. 31, Art. 5(1)(e), Art. 58(2)(f), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=660:szallashelyen-kameras-megfigyelorendszer-uzemeltetese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-5114-35/2022",null,"gdprhub",null,"Operator of a surveillance camera system",null,null,3000000.0,7445,"day 2022-12-21|402.9300|HUF",null,null,null,null,null],["2022/BG/005","CPDP (Bulgaria) - PNN-01-33/2022","gdprhub","Bulgaria","BG","CPDP (Bulgaria)","2022-12-20","day",null,"500","BGN",null,null,"Art. 32","Data security",null,"Violation found","https://www.cpdp.bg/en/index.php","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PNN-01-33/2022",null,"gdprhub",null,"Doctor",null,null,500.0,256,"day 2022-12-20|1.9558|BGN","person",null,null,null,null],["2022/ES/016","ETid-1534","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-20","day",1000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00272-2022.pdf","https://www.enforcementtracker.com/ETid-1534",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/015","ETid-1535","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-20","day",2000,null,"EUR","Property owner administrative board","Individuals and Private Associations","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00125-2022.pdf","https://www.enforcementtracker.com/ETid-1535",null,null,null,null,"ES: property owner administrative board",null,null,null,null,null,null,null,null,null],["2022/ES/014","ETid-1536","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-20","day",3000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00566-2021.pdf","https://www.enforcementtracker.com/ETid-1536",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/GR/039","HDPA (Greece) - 65/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-12-20","day",null,null,null,null,null,"Art. 12(1), Art. 12(3), Art. 12(4), Art. 13, Art. 15(1), Art. 51, Art. 55","Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/parabiasi-dikaiomatos-prosbasis-apo-etaireia-dimoskopiseon","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_65/2022",null,"gdprhub",null,"Polling company",null,null,null,null,null,null,null,null,null,null],["2022/FR/014","CNIL (France) - Deliberation SAN-2022-024 of December 20, 2022","gdprhub","France","FR","CNIL (France)","2022-12-19","day",60000000,"60,000,000","EUR","Microsoft Ireland Operations Limited",null,"Art. 4(11)",null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046768989","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_Deliberation_SAN-2022-024_of_December_20%2C_2022",null,"gdprhub",null,null,"microsoft ireland operations ltd","Microsoft",null,null,null,null,null,null,null,null],["2022/DK/038","Datatilsynet (Denmark) - 2021-31-5737","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-12-19","day",null,null,null,null,null,"Art. 6(1), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/dec/kritik-af-arbejdsgiver-for-at-orientere-bredere-kreds-om-baggrund-for-afskedigelse","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5737",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2022/GR/001","ETid-1771","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-12-19","day",7000,null,"EUR","ΜΑΡΙΑ ΠΕΔΙΩΤΗ ΚΑΙ ΣΙΑ Ο.Ε.",null,"Art. 12, Art. 15, Art. 31","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/kataggelia-kata-etaireias-gia-parabiasi-dikaiomatos-prosbasis","https://www.enforcementtracker.com/ETid-1771",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/054","APD/GBA (Belgium) - 188/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-12-18","day",null,null,null,null,null,"Art. 12(1), Art. 12(4), Art. 17, Art. 17(1), Art. 17(1)(c), Art. 17(3), Art. 24(1), Art. 25(1), Art. 25(2), Art. 38, Art. 38(1), Art. 4(1), Art. 5(1), Art. 5(1)(a), Art. 5(2), Art. 6, Art. 6(1)(f)","Accountability, Data principles, Data protection officer, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-188-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_188/2022",null,"gdprhub",null,"Producer of a television show",null,null,null,null,null,null,null,null,null,null],["2022/NL/003","AP (The Netherlands) - z2020-08787","gdprhub","Netherlands","NL","AP (The Netherlands)","2022-12-16","day",null,null,null,"CAK",null,"Art. 12(3)","Transparency",null,"Violation found",null,"https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_z2020-08787",null,"gdprhub",null,null,"NL: cak",null,null,null,null,null,null,null,null,null],["2022/AT/008","DSB (Austria) - 2022-0.876.190","gdprhub","Austria","AT","DSB (Austria)","2022-12-15","day",null,null,null,null,null,"Art. 55(1), Art. 55(2), Art. 56, Art. 6(1)","Unlawful processing",null,"Other Outcome","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20221215_2022_0_876_190_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.876.190",null,"gdprhub",null,"Embassy",null,null,null,null,null,null,null,null,null,null],["2022/RO/003","ETid-1531","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-12-15","day",5000,null,"EUR","Societatea Energetică Electrica S.A.","Transportation and Energy","Art. 28(3)(a)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15_12_2022&lang=ro","https://www.enforcementtracker.com/ETid-1531",null,null,null,null,"societatea energetica electrica sa",null,null,null,null,null,null,null,null,null],["2022/ES/018","ETid-1532","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-15","day",16000,null,"EUR","HOSPITAL RECOLETAS PONFERRADA, S.L.","Health Care","Art. 15, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00204-2022.pdf","https://www.enforcementtracker.com/ETid-1532","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202200999","gdprhub",null,null,"hospital recoletas ponferrada sl",null,null,null,null,null,null,null,null,null],["2022/ES/017","ETid-1533","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-15","day",30000,null,"EUR","ORANGE ESPAGNE, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00344-2022.pdf","https://www.enforcementtracker.com/ETid-1533",null,null,null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2022/IT/035","ETid-1606","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",55000,null,"EUR","Azienda Universitaria Friuli Occidentale","Health Care","Art. 14, Art. 35, Art. 5(1)(a), Art. 9","DPIA, Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9844989","https://www.enforcementtracker.com/ETid-1606",null,null,null,null,"IT: azienda universitaria friuli occidentale",null,null,null,null,null,null,null,null,null],["2022/IT/034","ETid-1607","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",55000,null,"EUR","Azienda Universitaria Friuli Centrale","Health Care","Art. 14, Art. 35, Art. 5(1)(a), Art. 9","DPIA, Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9844989","https://www.enforcementtracker.com/ETid-1607",null,null,null,null,"IT: azienda universitaria friuli centrale",null,null,null,null,null,null,null,null,null],["2022/IT/033","ETid-1608","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",55000,null,"EUR","Azienda Universitaria Giuliano Isontina","Health Care","Art. 14, Art. 35, Art. 5(1)(a), Art. 9","DPIA, Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9845156","https://www.enforcementtracker.com/ETid-1608","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9845156","gdprhub",null,null,"IT: azienda universitaria giuliano isontina",null,null,null,null,null,null,null,null,null],["2022/IT/025","ETid-1626","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",3000,null,"EUR","Scuola Statale Secondaria di I^ grado \"Bianco-Pascol\"","Public Sector and Education","Art. 12, Art. 5, Art. 6, Art. 9","Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9852255","https://www.enforcementtracker.com/ETid-1626",null,null,null,null,"IT: scuola statale secondaria di i grado bianco pascol",null,null,null,null,null,null,null,null,null],["2022/IT/021","ETid-1634","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",5000,null,"EUR","Comune di Borgia","Employment","Art. 37(7), Art. 5(1)(a), Art. 6","Data principles, Data protection officer, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9852800","https://www.enforcementtracker.com/ETid-1634",null,null,null,null,"IT: comune di borgia",null,null,null,null,null,null,null,null,null],["2022/IT/020","ETid-1635","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",8000,null,"EUR","Comune di Vicchio","Employment","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9852800","https://www.enforcementtracker.com/ETid-1635",null,null,null,null,"IT: comune di vicchio",null,null,null,null,null,null,null,null,null],["2022/IT/019","ETid-1636","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",6000,null,"EUR","Comune di Bracciano","Employment","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9853429","https://www.enforcementtracker.com/ETid-1636",null,null,null,null,"IT: comune di bracciano",null,null,null,null,null,null,null,null,null],["2022/IT/004","ETid-1670","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",30000,null,"EUR","Verizon Connect Italy S.p.A.","Industry and Commerce","Art. 28, Art. 5(1)(a), Art. 6","Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9856694","https://www.enforcementtracker.com/ETid-1670","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9856694","gdprhub",null,null,"verizon connect italy spa",null,null,null,null,null,null,null,null,null],["2022/IT/003","ETid-1671","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",4900000,null,"EUR","Edison Energia S.p.A.","Transportation and Energy","Art. 21(2), Art. 25(1), Art. 5(1)(a), Art. 5(2), Art. 6, Art. 7","Accountability, Consent, Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9856345","https://www.enforcementtracker.com/ETid-1671",null,null,null,null,"edison energia spa",null,null,null,null,null,null,null,null,null],["2022/IT/002","ETid-1762","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-15","day",120000,null,"EUR","Eurosanità S.P.A.","Health Care","Art. 32, Art. 5, Art. 9","Data principles, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9870788","https://www.enforcementtracker.com/ETid-1762","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9860553","gdprhub",null,null,"eurosanita spa",null,null,null,null,null,null,null,null,null],["2022/IT/181","Garante per la protezione dei dati personali (Italy) - 9855545","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-12-15","day",null,null,null,null,null,"Art. 5, Art. 58, Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9855545","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9855545",null,"gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2022/IT/185","Garante per la protezione dei dati personali (Italy) - 9861249","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-12-15","day",50000,"50,000","EUR","Giessegi Industria Mobili S.p.A.",null,"Art. 13, Art. 28, Art. 35, Art. 5(1)(a), Art. 6","DPIA, Data principles, Processor obligations, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9861249","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9861249",null,"gdprhub",null,null,"giessegi industria mobili spa",null,null,null,null,null,null,null,null,null],["2022/GR/038","HDPA (Greece) - 4/15-12-2022","gdprhub","Greece","GR","HDPA (Greece)","2022-12-15","day",null,null,null,null,null,"Art. 5, Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2023-01/4_2022_monoprosopo%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_4/15-12-2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/IS/022","Persónuvernd (Iceland) - 2022020333","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-12-14","day",null,null,null,"Íslandsbanki (Bank of Iceland)",null,"Art. 32(1), Art. 5(1), Art. 5(2), Art. 6","Data principles, Data security, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-islandsbanka-hf.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2022020333",null,"gdprhub",null,null,"IS: islandsbanki",null,null,null,null,null,null,null,null,null],["2022/LU/015","CNPD (Luxembourg) - Délibération n° 24FR/2022","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2022-12-13","day",3700,"3,700","EUR",null,null,"Art. 12(1), Art. 13(2)(a), Art. 13(2)(b), Art. 58(2)","Transparency",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2022/dcision-24fr-2022-sous-forme-anonymise.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_24FR/2022",null,"gdprhub",null,"Website and app operator",null,null,null,null,null,null,null,null,null,null],["2022/ES/021","ETid-1525","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-13","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00296-2022.pdf","https://www.enforcementtracker.com/ETid-1525",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/ES/020","ETid-1529","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-13","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00295-2022.pdf","https://www.enforcementtracker.com/ETid-1529",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/ES/019","ETid-1530","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-13","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00290-2022.pdf","https://www.enforcementtracker.com/ETid-1530",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/FI/002","ETid-1565","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2022-12-13","day",750000,null,"EUR","Alektum Oy","Finance, Insurance and Consulting","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://tietosuoja.fi/documents/6927448/146469002/Apulaistietosuojavaltuutetun+ja+seuraamuskollegion+päätökset+6633.182.2018_6707.154.2018_7685.152.2020.pdf/8760a298-e1c6-18aa-a3cd-c1d40d14e1b7/Apulaistietosuojavaltuutetun+ja+seuraamuskollegion+päätökset+6633.182.2018_6707.154.2018_7685.152.2020.pdf?t=1673420299312","https://www.enforcementtracker.com/ETid-1565","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6633/182/2018%2C_6707/154/2018_and_7685/152/2020","gdprhub",null,null,"alektum oy",null,null,null,null,null,null,null,null,null],["2022/LU/007","ETid-1647","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-12-13","day",1500,null,"EUR","Manager of a real estate co-ownership","Real Estate","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-avis/2023/dlibration-18-fr-2022-du-13-dcembre-2022.pdf","https://www.enforcementtracker.com/ETid-1647","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_18/FR/2022","gdprhub",null,null,"LU: manager of a real estate co ownership",null,null,null,null,null,null,null,null,null],["2022/LU/005","ETid-1703","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-12-13","day",1000,null,"EUR","Company",null,"Art. 12(1)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://cnpd.public.lu/fr/actualites/national/2023/03/decisions-transparence.html","https://www.enforcementtracker.com/ETid-1703",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LU/004","ETid-1704","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-12-13","day",2500,null,"EUR","Company",null,"Art. 12(1)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://cnpd.public.lu/fr/actualites/national/2023/03/decisions-transparence.html","https://www.enforcementtracker.com/ETid-1704",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LU/003","ETid-1705","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-12-13","day",2100,null,"EUR","Company",null,"Art. 12(1), Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://cnpd.public.lu/fr/actualites/national/2023/03/decisions-transparence.html","https://www.enforcementtracker.com/ETid-1705",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LU/002","ETid-1706","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-12-13","day",700,null,"EUR","Company",null,"Art. 12(1), Art. 13(1)(f)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://cnpd.public.lu/fr/actualites/national/2023/03/decisions-transparence.html","https://www.enforcementtracker.com/ETid-1706",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LU/001","ETid-1707","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-12-13","day",1400,null,"EUR","Company",null,"Art. 12(1), Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://cnpd.public.lu/fr/actualites/national/2023/03/decisions-transparence.html","https://www.enforcementtracker.com/ETid-1707",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/FI/026","Tietosuojavaltuutetun toimisto (Finland) - 4672/161/2022","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-12-13","day",null,null,null,"City of Helsinki",null,"Art. 13(2), Art. 25(1), Art. 32, Art. 44, Art. 46, Art. 5(1)(a)","Accountability, Data principles, Data security, International transfers, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221663","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4672/161/2022",null,"gdprhub",null,null,"FI: city of helsinki",null,null,null,null,null,null,null,null,null],["2022/RO/004","ETid-1520","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-12-09","day",2000,null,"EUR","Casa Rusu S.R.L.","Industry and Commerce","Art. 25(1), Art. 32(1)(b), Art. 32(2)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09_12_2022&lang=ro","https://www.enforcementtracker.com/ETid-1520","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Comunicat_Presa_09_12_2022","gdprhub",null,null,"casa rusu srl",null,null,null,null,null,null,null,null,null],["2022/ES/024","ETid-1521","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-09","day",480,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00240-2022.pdf","https://www.enforcementtracker.com/ETid-1521",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/023","ETid-1522","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-09","day",8000,null,"EUR","Notary","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00459-2022.pdf","https://www.enforcementtracker.com/ETid-1522",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/022","ETid-1523","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-09","day",120,null,"EUR",null,"Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00143-2022.pdf","https://www.enforcementtracker.com/ETid-1523",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/FI/003","ETid-1526","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2022-12-09","day",230000,null,"EUR","Viking Line Oy Abp","Accommodation and Hospitality","Art. 12(3), Art. 13, Art. 15(1), Art. 25(1)","Accountability, Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://tietosuoja.fi/-/viking-linelle-seuraamusmaksu-tyontekijoiden-terveystietojen-lainvastaisesta-kasittelysta","https://www.enforcementtracker.com/ETid-1526","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8492/163/20","gdprhub",null,null,"viking line oy abp",null,null,null,null,null,null,null,null,null],["2022/EE/004","AKI (Estonia) - 2.1.-1/22/2643","gdprhub","Estonia","EE","AKI (Estonia)","2022-12-08","day",2500,"2500","EUR",null,null,"Art. 17(1)(a), Art. 4(1), Art. 6(1)","Data subject rights, Unlawful processing",null,"Violation found","https://www.aki.ee/sites/default/files/ettekirjutused/2022/ettekirjutus-hoiatus_isikuandmete_kaitse_asjas_.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-1/22/2643",null,"gdprhub",null,"Former employer",null,null,null,null,null,null,null,null,null,null],["2022/FR/001","ETid-1527","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-12-08","day",300000,null,"EUR","FREE SAS","Media, Telecoms and Broadcasting","Art. 12, Art. 15, Art. 17, Art. 32, Art. 33","Data breach, Data security, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/securite-des-donnees-et-droits-des-personnes-sanction-de-300-000-euros-lencontre-de-la-societe-free","https://www.enforcementtracker.com/ETid-1527",null,null,null,null,"FR: free","Free (Iliad)",null,null,null,null,null,null,null,null],["2022/HR/002","ETid-1594","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-08","day",2654,null,"EUR","Jewelry manufacturer","Industry and Commerce","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1594",null,null,null,null,"HR: jewelry manufacturer",null,null,null,null,null,null,null,null,null],["2022/HR/001","ETid-1595","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-08","day",2654,null,"EUR","Retailer","Industry and Commerce","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1595",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HR/004","ETid-1592","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-07","day",2654,null,"EUR","Retailer","Industry and Commerce","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1592",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HR/003","ETid-1593","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-07","day",1991,null,"EUR","Fish market","Industry and Commerce","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1593",null,null,null,null,"HR: fish market",null,null,null,null,null,null,null,null,null],["2022/EE/005","AKI (Estonia) - 2.1.-4/22/2585","gdprhub","Estonia","EE","AKI (Estonia)","2022-12-06","day",null,null,null,"OÜ Laidoneri KV",null,"Art. 5, Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.aki.ee/sites/default/files/ettekirjutused/2022/ettekirjutus-hoiatus_isikuandmete_kaitse_asjas_ou_laidoneri_kv.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-4/22/2585",null,"gdprhub",null,null,"ou laidoneri kv",null,null,null,null,null,null,null,null,null],["2022/EE/006","AKI (Estonia) - 2.1.-5/22/22012","gdprhub","Estonia","EE","AKI (Estonia)","2022-12-06","day",null,null,null,"M&M Inkasso OÜ",null,"Art. 6(1)(d)","Unlawful processing",null,"Violation found","https://www.aki.ee/sites/default/files/ettekirjutused/2022/ettekirjutus-hoiatus_isikuandmete_kaitse_asjas_mm_inkasso_ou.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-5/22/22012",null,"gdprhub",null,null,"m and m inkasso ou",null,null,null,null,null,null,null,null,null],["2022/HR/006","ETid-1590","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-06","day",3185,null,"EUR","Retailer","Industry and Commerce","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1590",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HR/005","ETid-1591","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-06","day",1991,null,"EUR","Retailer","Industry and Commerce","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1591",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/EU/003","EDPB - Binding Decision 3/2022 - 'Meta (Facebook)'","gdprhub","European Union","EU","EDPB","2022-12-05","day",null,null,null,"Meta Platforms Ireland Limited (Facebook)",null,"Art. 12, Art. 13, Art. 21, Art. 24, Art. 4, Art. 5, Art. 56, Art. 58, Art. 6, Art. 60, Art. 65, Art. 7, Art. 77, Art. 79, Art. 83, Art. 9","Accountability, Consent, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,null,"https://edpb.europa.eu/system/files/2023-01/edpb_bindingdecision_202203_ie_sa_meta_facebookservice_redacted_en.pdf","https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_3/2022_-_%27Meta_%28Facebook%29%27",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/EU/004","EDPB - Binding Decision 4/2022 - 'Meta (Instagram)'","gdprhub","European Union","EU","EDPB","2022-12-05","day",null,null,null,"Meta Platforms Ireland Limited",null,"Art. 12, Art. 13, Art. 21, Art. 24, Art. 4, Art. 5, Art. 56, Art. 58, Art. 6, Art. 60, Art. 65, Art. 7, Art. 77, Art. 79, Art. 83, Art. 9","Accountability, Consent, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,null,"https://edpb.europa.eu/system/files/2023-01/edpb_binding_decision_202204_ie_sa_meta_instagramservice_redacted_en.pdf","https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_4/2022_-_%27Meta_%28Instagram%29%27",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/EU/005","EDPB - Binding Decision 5/2022 - 'Whatsapp'","gdprhub","European Union","EU","EDPB","2022-12-05","day",null,null,null,"Whatsapp Ireland Limited",null,"Art. 12, Art. 13, Art. 21, Art. 24, Art. 4, Art. 5, Art. 56, Art. 58, Art. 6, Art. 60, Art. 65, Art. 7, Art. 77, Art. 79, Art. 83, Art. 9","Accountability, Consent, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,null,"https://edpb.europa.eu/system/files/2023-01/edpb_bindingdecision_202205_ie_sa_whatsapp_en.pdf","https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_5/2022_-_%27Whatsapp%27",null,"gdprhub",null,null,"whatsapp ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/HR/008","ETid-1588","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-05","day",1991,null,"EUR","Betting place","Industry and Commerce",null,"Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1588",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HR/007","ETid-1589","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-12-05","day",3583,null,"EUR","Retailer","Industry and Commerce","Art. 27(1)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1589",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IS/015","Persónuvernd (Iceland) - 2020061965","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-12-05","day",null,null,null,"Social Services",null,"Art. 6(1)(c), Art. 9(2)(h)","Special categories, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-felagsthjonustu-a-personuupplysingum","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020061965",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/IS/018","Persónuvernd (Iceland) - Case no. 2021010248","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-12-05","day",null,null,null,null,null,"Art. 17(1), Art. 17(3)(d), Art. 6(1)(e), Art. 6(1)(f)","Data subject rights, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-islenskrar-erfdagreiningar-ehf.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021010248",null,"gdprhub",null,"Genealogical database",null,null,null,null,null,null,null,null,null,null],["2022/ES/031","ETid-1508","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-03","day",3000,null,"EUR","INDECEMI, S.L.","Industry and Commerce","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00113-2022.pdf","https://www.enforcementtracker.com/ETid-1508",null,null,null,null,"indecemi sl",null,null,null,null,null,null,null,null,null],["2022/ES/030","ETid-1509","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-03","day",600,null,"EUR","LORENT 2013, S.L","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00262-2022.pdf","https://www.enforcementtracker.com/ETid-1509",null,null,null,null,"lorent 2013 sl",null,null,null,null,null,null,null,null,null],["2022/ES/029","ETid-1510","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-03","day",300,null,"EUR","Homeowners Association","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00322-2022.pdf","https://www.enforcementtracker.com/ETid-1510",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/028","ETid-1515","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-02","day",3500,null,"EUR","CASA 7 PERSONAL SHOPPER, S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00404-2022.pdf","https://www.enforcementtracker.com/ETid-1515",null,null,null,null,"casa 7 personal shopper sl",null,null,null,null,null,null,null,null,null],["2022/ES/027","ETid-1516","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-12-02","day",3600,null,"EUR","Federation of Sports for People with Intellectual Disabilities of Castilla la Mancha-FECAM","Individuals and Private Associations","Art. 13, Art. 9(2)(a)","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00264-2022.pdf","https://www.enforcementtracker.com/ETid-1516",null,null,null,null,"ES: federation of sports for people with intellectual disabilities of castilla la mancha fecam",null,null,null,null,null,null,null,null,null],["2022/BG/004","CPDP (Bulgaria) - PNN-01-487/2021","gdprhub","Bulgaria","BG","CPDP (Bulgaria)","2022-12-01","day",null,null,null,"H.MB EAD",null,"Art. 6(1)(a), Art. 6(1)(b)","Unlawful processing",null,"Violation found","https://www.cpdp.bg/en/index.php","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PNN-01-487/2021",null,"gdprhub",null,null,"BG: h mb ead",null,null,null,null,null,null,null,null,null],["2022/IT/045","ETid-1537","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-01","day",100000,null,"EUR","Lazio Region","Employment","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9833616","https://www.enforcementtracker.com/ETid-1537",null,null,null,null,"IT: lazio region",null,null,null,null,null,null,null,null,null],["2022/IT/039","ETid-1562","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-01","day",6000,null,"EUR","Store owner (Joy Unique Collection)","Industry and Commerce","Art. 13, Art. 5","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9838992","https://www.enforcementtracker.com/ETid-1562","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9838992","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/IT/038","ETid-1573","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-01","day",3000,null,"EUR","Store owner (Woolen)","Industry and Commerce","Art. 13, Art. 5","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9838976","https://www.enforcementtracker.com/ETid-1573",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IT/037","ETid-1574","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-01","day",6000,null,"EUR","A.R.N.A.S. Civico","Employment","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9842783","https://www.enforcementtracker.com/ETid-1574","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9842783","gdprhub",null,null,"IT: arnas civico",null,null,null,null,null,null,null,null,null],["2022/IT/036","ETid-1575","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-01","day",20000,null,"EUR","Amazon Italia Logistica s.r.l.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9843805","https://www.enforcementtracker.com/ETid-1575","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9843805","gdprhub",null,null,"amazon italia logistica srl","Amazon",null,null,null,null,null,null,null,null],["2022/IT/001","ETid-1763","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-12-01","day",2000,null,"EUR","Store owner","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9861988","https://www.enforcementtracker.com/ETid-1763",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/NL/004","AP (The Netherlands) - AWB-21 3909","gdprhub","Netherlands","NL","AP (The Netherlands)","2022-11-30","day",560,"560.5","EUR",null,null,"Art. 15(1)","Data subject rights",null,null,"https://uitspraken.rechtspraak.nl/#!/details?id=ECLI:NL:RBZWB:2022:7219&showbutton=true&keyword=AVG","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_AWB-21_3909",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/FR/018","CNIL (France) - SAN-2022-022","gdprhub","France","FR","CNIL (France)","2022-11-30","day",300000,"300,000","EUR","Free",null,"Art. 12(3), Art. 15, Art. 17(1)(a), Art. 32, Art. 33","Data breach, Data security, Data subject rights, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046693390?init=true&page=1&query=san-2022-022&searchField=ALL&tab_selection=all","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-022",null,"gdprhub",null,null,"FR: free","Free (Iliad)",null,null,null,null,null,null,null,null],["2022/PL/002","ETid-1632","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-11-30","day",9600,null,"EUR","PIONIER (law firm)","Finance, Insurance and Consulting","Art. 5(1)(a), Art. 6(1), Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/pl/138/2610","https://www.enforcementtracker.com/ETid-1632",null,null,null,null,"PL: pionier",null,null,null,null,null,null,null,null,null],["2022/PL/022","UODO (Poland) - DKN.5112.5.2021","gdprhub","Poland","PL","UODO (Poland)","2022-11-30","day",9738,"9,738","EUR",null,null,"Art. 5(1)(a), Art. 5(2), Art. 6(1), Art. 9(2)(a)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5112.5.2021","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.5.2021",null,"gdprhub",null,"Law firm",null,null,null,null,null,null,null,null,null,null],["2022/ES/033","ETid-1504","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-29","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00378-2022.pdf","https://www.enforcementtracker.com/ETid-1504",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/032","ETid-1507","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-29","day",3000,null,"EUR","Company",null,"Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00335-2022.pdf","https://www.enforcementtracker.com/ETid-1507",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IS/019","Persónuvernd (Iceland) - Case no. 2021101924","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-11-29","day",null,null,null,null,null,"Art. 6(1)(a), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-advania-island-ehf.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021101924",null,"gdprhub",null,"Provider of a digital signature",null,null,null,null,null,null,null,null,null,null],["2022/IE/004","ETid-1502","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2022-11-25","day",265000000,null,"EUR","Meta Platforms Ireland Limited","Media, Telecoms and Broadcasting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-in-facebook-data-scraping-inquiry","https://www.enforcementtracker.com/ETid-1502",null,null,null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/RO/005","ETid-1503","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-25","day",3000,null,"EUR","OTP LEASING ROMANIA IFN SA","Finance, Insurance and Consulting","Art. 25(1), Art. 32(1)(b), Art. 32(2)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_25_11_2022&lang=ro","https://www.enforcementtracker.com/ETid-1503",null,null,null,null,"otp leasing romania ifn sa",null,null,null,null,null,null,null,null,null],["2022/ES/026","ETid-1517","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-25","day",1800,null,"EUR","ALPA 57 PRODUCCIONES, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00438-2022.pdf","https://www.enforcementtracker.com/ETid-1517",null,null,null,null,"ES: alpa 57 producciones",null,null,null,null,null,null,null,null,null],["2022/ES/025","ETid-1518","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-25","day",5000,null,"EUR","Association for the prevention and study of crimes, abuses and negligence in information technology and advanced communications (APEDANICA)","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00485-2021.pdf","https://www.enforcementtracker.com/ETid-1518",null,null,null,null,"ES: association for the prevention and study of crimes abuses and negligence in information technology and advanced communications",null,null,null,null,null,null,null,null,null],["2022/HR/010","ETid-1586","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-11-25","day",1991,null,"EUR","Company in the hospitality industry","Accommodation and Hospitality","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1586",null,null,null,null,"HR: company in the hospitality industry",null,null,null,null,null,null,null,null,null],["2022/HR/009","ETid-1587","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-11-25","day",1991,null,"EUR","Betting place","Industry and Commerce","Art. 27(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izreceno-novih-10-upravnih-novcanih-kazni/","https://www.enforcementtracker.com/ETid-1587",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/051","APD/GBA (Belgium) - 172/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-24","day",null,null,null,"the estate agency",null,"Art. 12(1), Art. 12(3), Art. 12(4), Art. 17(1), Art. 19, Art. 21(1), Art. 58(2), Art. 6, Art. 6(1)(a), Art. 6(1)(f)","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-172-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_172/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/006","ETid-1501","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-24","day",1000,null,"EUR","Medicover S.R.L.","Health Care","Art. 32(1)(b), Art. 32(2), Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_24_11_2022&lang=ro","https://www.enforcementtracker.com/ETid-1501",null,null,null,null,"medicover srl",null,null,null,null,null,null,null,null,null],["2022/FR/002","ETid-1506","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-11-24","day",600000,null,"EUR","ÉLECTRICITÉ DE FRANCE","Transportation and Energy","Art. 12, Art. 13, Art. 14, Art. 15, Art. 21, Art. 7","Consent, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046650733?isSuggest=true","https://www.enforcementtracker.com/ETid-1506","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_Deliberation_of_the_restricted_training_n%C2%B0SAN-2022-021_of_November_24%2C_2022_concerning_the_company_ELECTRICIT%C3%89_DE_FRANCE","gdprhub",null,null,"FR: electricite de france",null,null,null,null,null,null,null,null,null],["2022/IT/043","ETid-1541","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-24","day",1000000,null,"EUR","Areti spa","Transportation and Energy","Art. 12, Art. 15, Art. 24, Art. 5(2)","Accountability, Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9832979","https://www.enforcementtracker.com/ETid-1541","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9832979","gdprhub",null,null,"areti spa",null,null,null,null,null,null,null,null,null],["2022/IT/032","ETid-1610","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-24","day",1000,null,"EUR","STS Di Prisinzano s.r.l","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9842389","https://www.enforcementtracker.com/ETid-1610",null,null,null,null,"sts di prisinzano srl",null,null,null,null,null,null,null,null,null],["2022/IT/018","ETid-1637","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-24","day",1000,null,"EUR",null,"Individuals and Private Associations","Art. 32, Art. 5, Art. 6, Art. 9","Data principles, Data security, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9844780","https://www.enforcementtracker.com/ETid-1637",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/IT/015","ETid-1640","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-24","day",3000,null,"EUR","Ordine dei Medici Chirurghi e degli Odontoiatri della Provincia di Cagliari","Health Care","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9839018","https://www.enforcementtracker.com/ETid-1640",null,null,null,null,"IT: ordine dei medici chirurghi e degli odontoiatri della provincia di cagliari",null,null,null,null,null,null,null,null,null],["2022/IT/008","ETid-1654","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-24","day",4000,null,"EUR","Società Lombarda Sport s.r.l.","Health Care","Art. 5, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9842370","https://www.enforcementtracker.com/ETid-1654",null,null,null,null,"societa lombarda sport srl",null,null,null,null,null,null,null,null,null],["2022/IS/014","Persónuvernd (Iceland) - 2021102040","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-11-23","day",null,null,null,"GI rannsókna ehf. (Gallup)",null,null,null,null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-gallup","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2021102040",null,"gdprhub",null,null,"gi rannsokna ehf",null,null,null,null,null,null,null,null,null],["2022/IS/021","Persónuvernd (Iceland) - Case no. 2021020294","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-11-23","day",null,null,null,null,null,"Art. 14, Art. 5(1), Art. 6(1), Art. 6(1)(c)","Data principles, Transparency, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-menntastofnunar-1","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021020294",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/IS/016","Persónuvernd (Iceland) - Case no. 2021030666","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-11-23","day",null,null,null,null,null,"Art. 5, Art. 6(1)(c)","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-menntastofnunar","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021030666",null,"gdprhub",null,"School administrator",null,null,null,null,null,"person",null,null,null,null],["2022/BE/050","APD/GBA (Belgium) - 169/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-22","day",null,null,null,"RTBF",null,null,null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-169-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_169/2022",null,"gdprhub",null,null,"BE: rtbf",null,null,null,null,null,null,null,null,null],["2022/AT/014","DSB (Austria) - 2022-0.792.182","gdprhub","Austria","AT","DSB (Austria)","2022-11-21","day",null,null,null,"Public Employment Service",null,null,null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20221121_2022_0_792_182_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.792.182",null,"gdprhub",null,null,"AT: public employment service",null,null,null,null,null,null,null,null,null],["2022/ES/034","ETid-1499","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-21","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00161-2022.pdf","https://www.enforcementtracker.com/ETid-1499",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/RO/007","ETid-1500","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-21","day",20000,null,"EUR","ING Bank NV Amsterdam Sucursala București","Finance, Insurance and Consulting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_21_11_2022&lang=ro","https://www.enforcementtracker.com/ETid-1500",null,null,null,null,"ing bank nv amsterdam sucursala bucuresti","ING",null,null,null,null,null,null,null,null],["2022/BE/052","APD/GBA (Belgium) - 165/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-18","day",null,null,null,"Zorg & Gezondheid",null,"Art. 12(1), Art. 13(1), Art. 13(2), Art. 14(1), Art. 14(2), Art. 15, Art. 5(1)(a), Art. 57(4)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-165-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_165/2022",null,"gdprhub",null,null,"BE: zorg and gezondheid",null,null,null,null,null,null,null,null,null],["2022/RO/008","ETid-1497","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-18","day",300,null,"EUR","Homeowners Association Bld. Pipera 1-2E","Individuals and Private Associations","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_18_11_2022&lang=ro","https://www.enforcementtracker.com/ETid-1497","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_President_of_the_Association_of_Owners_Bld._Pipera_1-2E","gdprhub",null,null,"RO: homeowners association bld pipera 1 2e",null,null,null,null,null,null,null,null,null],["2022/NL/005","AP (The Netherlands) - mobiele camera-auto's Rotterdam - besluit tot boeteoplegging","gdprhub","Netherlands","NL","AP (The Netherlands)","2022-11-17","day",50000,"50,000","EUR","Dutch police",null,null,null,null,"Violation found","https://www.autoriteitpersoonsgegevens.nl/uploads/imported/besluit_boete_mobiele_camera-autos_rotterdam.pdf","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_mobiele_camera-auto%27s_Rotterdam_-_besluit_tot_boeteoplegging",null,"gdprhub",null,null,"NL: dutch police",null,null,null,null,null,null,null,null,null],["2022/BE/048","APD/GBA (Belgium) - 162/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-16","day",null,null,null,"Toerisme Vlaanderen",null,"Art. 24(1), Art. 25(1), Art. 25(2), Art. 38(1), Art. 39(1), Art. 4(11), Art. 5(1)(a), Art. 5(1)(c), Art. 5(2), Art. 6(1)(a), Art. 6(1)(c), Art. 6(3), Art. 7(1), Art. 7(3)","Accountability, Consent, Data principles, Data protection officer, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-162-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_162/2022",null,"gdprhub",null,null,"BE: toerisme vlaanderen",null,null,null,null,null,null,null,null,null],["2022/RO/009","ETid-1495","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-16","day",28000,null,"EUR","Raiffeisen Bank SA","Finance, Insurance and Consulting","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16_11_2022&lang=ro","https://www.enforcementtracker.com/ETid-1495",null,null,null,null,"raiffeisen bank sa","Raiffeisen",null,null,null,null,null,null,null,null],["2022/PL/021","UODO (Poland) - DKN.5112.1.2020","gdprhub","Poland","PL","UODO (Poland)","2022-11-16","day",null,"1,968,524","PLN","Virgin Mobile Polska Sp. z o. o.",null,"Art. 24(1), Art. 25(1), Art. 32(1)(b), Art. 32(1)(d), Art. 32(2), Art. 5(1)(f), Art. 5(2), Art. 83(2)","Accountability, Data principles, Data security",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5112.1.2020","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.1.2020",null,"gdprhub",null,null,"PL: virgin mobile polska",null,1968524.0,418256,"day 2022-11-16|4.7065|PLN",null,null,null,null,null],["2022/ES/035","ETid-1492","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-15","day",80000,null,"EUR","BANKINTER, S.A.","Finance, Insurance and Consulting","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00634-2021.pdf","https://www.enforcementtracker.com/ETid-1492",null,null,null,null,"bankinter sa",null,null,null,null,null,null,null,null,null],["2022/HU/010","ETid-1645","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-11-15","day",5200,null,"EUR","News service","Media, Telecoms and Broadcasting","Art. 12, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=616:elektronikus-direkt-marketing-hozzajarulas-ervenyessege","https://www.enforcementtracker.com/ETid-1645","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-7058-5/2022","gdprhub",null,null,"HU: news service",null,null,null,null,null,null,null,null,null],["2022/FI/013","Tietosuojavaltuutetun toimisto (Finland) - 4022/171/22","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-11-15","day",null,null,null,null,null,"Art. 32(1), Art. 32(2), Art. 58(2)(b)","Data security",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2022/20221603","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4022/171/22",null,"gdprhub",null,"Healthcare provider",null,null,null,null,null,null,null,null,null,null],["2022/SI/004","IP (Slovenia) - 0603-98/2022/6","gdprhub","Slovenia","SI","IP (Slovenia)","2022-11-14","day",null,null,null,null,null,"Art. 5(2), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2023/Junij/Junij_2023-Odlocbe_ZP.zip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0603-98/2022/6",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2022/FI/024","Tietosuojavaltuutetun toimisto (Finland) - 9492/153/22","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-11-14","day",null,null,null,null,null,"Art. 16, Art. 17","Data subject rights",null,"Rejected","https://finlex.fi/fi/viranomaiset/tsv/2022/20221584","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_9492/153/22",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/037","ETid-1490","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-11","day",48000,null,"EUR","Banco Bilbao Vizcaya Argentaria S.L.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00419-2022.pdf","https://www.enforcementtracker.com/ETid-1490",null,null,null,null,"banco bilbao vizcaya argentaria sl","BBVA",null,null,null,null,null,null,null,null],["2022/ES/036","ETid-1491","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-11","day",3600,null,"EUR","XASTRE DO PETO, S.L.","Accommodation and Hospitality","Art. 13, Art. 21, Art. 6(1)","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00310-2022.pdf","https://www.enforcementtracker.com/ETid-1491",null,null,null,null,"xastre do peto sl",null,null,null,null,null,null,null,null,null],["2022/ES/039","ETid-1488","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-10","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00060-2022.pdf","https://www.enforcementtracker.com/ETid-1488",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/038","ETid-1489","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-10","day",900,null,"EUR","Homeowners Association","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00256-2022.pdf","https://www.enforcementtracker.com/ETid-1489",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/FR/003","ETid-1496","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-11-10","day",800000,null,"EUR","DISCORD INC.","Media, Telecoms and Broadcasting","Art. 13, Art. 25(2), Art. 32, Art. 35, Art. 5(1)(e)","Accountability, DPIA, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046562676?init=true&page=1&query=discord%20inc&searchField=ALL&tab_selection=all","https://www.enforcementtracker.com/ETid-1496","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-020","gdprhub",null,null,"discord inc",null,null,null,null,null,null,null,null,null],["2022/IT/051","ETid-1505","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",500000,null,"EUR","Vodafone Italia S.p.A.","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13, Art. 5(1)(a), Art. 6, Art. 7","Consent, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9826417","https://www.enforcementtracker.com/ETid-1505","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9826417","gdprhub",null,null,"vodafone italia spa","Vodafone",null,null,null,null,null,null,null,null],["2022/IT/047","ETid-1514","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",40000,null,"EUR","Azienda Usl Valle d'Aosta","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9826440","https://www.enforcementtracker.com/ETid-1514",null,null,null,null,"IT: azienda usl valle d aosta",null,null,null,null,null,null,null,null,null],["2022/IT/044","ETid-1538","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",4000,null,"EUR","Villafranca di Verona municipality","Employment","Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9834986","https://www.enforcementtracker.com/ETid-1538",null,null,null,null,"IT: villafranca di verona municipality",null,null,null,null,null,null,null,null,null],["2022/IT/042","ETid-1542","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",20000,null,"EUR","Sportitalia","Employment","Art. 13, Art. 30(1)(c), Art. 5(1)(a), Art. 9","Data principles, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9832838","https://www.enforcementtracker.com/ETid-1542","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9832838","gdprhub",null,null,"IT: sportitalia",null,null,null,null,null,null,null,null,null],["2022/IT/041","ETid-1544","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",5000,null,"EUR","Cisterna di Latina Municipality","Public Sector and Education","Art. 12, Art. 37, Art. 5","Data principles, Data protection officer, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9834477","https://www.enforcementtracker.com/ETid-1544",null,null,null,null,"IT: cisterna di latina municipality",null,null,null,null,null,null,null,null,null],["2022/IT/040","ETid-1553","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",10000,null,"EUR","I-Model s.r.l.","Industry and Commerce","Art. 17, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9837981","https://www.enforcementtracker.com/ETid-1553","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9837981","gdprhub",null,null,"i model srl",null,null,null,null,null,null,null,null,null],["2022/IT/027","ETid-1615","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",5000,null,"EUR","Cisterna di Latina municipality","Public Sector and Education","Art. 12, Art. 37, Art. 5","Data principles, Data protection officer, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9834477","https://www.enforcementtracker.com/ETid-1615",null,null,null,null,"IT: cisterna di latina municipality",null,null,null,null,null,null,null,null,null],["2022/IT/026","ETid-1616","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",6000,null,"EUR","Conservatorio di Musica S. Cecilia di Roma","Public Sector and Education","Art. 38, Art. 5, Art. 6","Data principles, Data protection officer, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9835095","https://www.enforcementtracker.com/ETid-1616","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9835095","gdprhub",null,null,"IT: conservatorio di musica s cecilia di roma",null,null,null,null,null,null,null,null,null],["2022/IT/022","ETid-1631","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-11-10","day",15000,null,"EUR","Poliambulatorio Radiologico \"il Sorriso\" S.r.l.","Health Care","Art. 13, Art. 37, Art. 5","Data principles, Data protection officer, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9843603","https://www.enforcementtracker.com/ETid-1631",null,null,null,null,"poliambulatorio radiologico il sorriso srl",null,null,null,null,null,null,null,null,null],["2022/RO/010","ETid-1482","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-09","day",1000,null,"EUR","SC Das Sense Society SRL","Accommodation and Hospitality","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09.11.2022&lang=ro","https://www.enforcementtracker.com/ETid-1482",null,null,null,null,"das sense society srl",null,null,null,null,null,null,null,null,null],["2022/CZ/001","ETid-2825","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2022-11-09","day",400,null,"EUR","Legal Person","Media, Telecoms and Broadcasting","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/126-cj-uoou-0070121-39-dokument-c-126.pdf","https://www.enforcementtracker.com/ETid-2825",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IS/012","Persónuvernd (Iceland) - Case no. 2021101926","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-11-09","day",null,null,null,"Google LLC",null,"Art. 17, Art. 17(3)(a)","Data subject rights",null,"Rejected","https://www.personuvernd.is/urlausnir/birting-leitarnidurstadna-i-leitarvel-google-1","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021101926",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/IS/013","Persónuvernd (Iceland) - Case no. 2021122409","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-11-09","day",null,null,null,"Nova hf.",null,"Art. 32, Art. 5(1)(f), Art. 6","Data principles, Data security, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-nova-hf.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021122409",null,"gdprhub",null,null,"nova hf",null,null,null,null,null,null,null,null,null],["2022/IS/023","Persónuvernd (Island) - 2020122992","gdprhub","Iceland","IS","Persónuvernd (Island)","2022-11-09","day",null,null,null,"Netgíró ehf",null,"Art. 5, Art. 6","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-creditinfo-lanstrausts-netgiro-ehf-og-il-sjods","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2020122992",null,null,null,null,"netgiro ehf",null,null,null,null,null,null,null,null,null],["2022/BE/049","APD/GBA (Belgium) - 160/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-08","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15, Art. 17, Art. 17(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-160-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_160/2022",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2022/BE/047","APD/GBA (Belgium) - 161/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-08","day",null,null,null,null,null,"Art. 17, Art. 3(1), Art. 3(2), Art. 77","Data subject rights",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-161-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_161/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/NO/021","Datatilsynet (Norway) - 21/01057","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-11-08","day",null,null,null,null,null,"Art. 57(1), Art. 57(1)(f)",null,null,"Rejected","https://pvn.no/pvn-2022-11","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/01057",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/011","ETid-1481","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-08","day",5000,null,"EUR","SC Prestige Media PHG SRL","Media, Telecoms and Broadcasting","Art. 5(1)(a), Art. 5(2), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08_11_2022&lang=ro","https://www.enforcementtracker.com/ETid-1481",null,null,null,null,"prestige media phg srl",null,null,null,null,null,null,null,null,null],["2022/BE/045","APD/GBA (Belgium) - 158/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-07","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 17(1), Art. 24, Art. 6, Art. 6(1)(a), Art. 6(1)(f)","Accountability, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-158-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_158/2022",null,"gdprhub",null,"Service provider",null,null,null,null,null,null,null,null,null,null],["2022/BE/046","APD/GBA (Belgium) - 159/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-11-07","day",null,null,null,null,null,"Art. 12(3), Art. 17(1)(a), Art. 24, Art. 4(1), Art. 4(2), Art. 5(1)(b), Art. 5(1)(e), Art. 5(2)","Accountability, Data principles, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-159-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_159/2022",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2022/RO/012","ETid-1479","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-11-07","day",2000,null,"EUR","Romanian Post","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07_11_2022&lang=ro","https://www.enforcementtracker.com/ETid-1479",null,null,null,null,"RO: romanian post",null,null,null,null,null,null,null,null,null],["2022/ES/001","ETid-2288","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-07","day",60000,null,"EUR","INFORMÁTICA MÉDICA, S.L.","Health Care","Art. 28","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.aepd.es/documento/ps-00576-2021.pdf","https://www.enforcementtracker.com/ETid-2288",null,null,null,null,"informatica medica sl",null,null,null,null,null,null,null,null,null],["2022/ES/040","ETid-1487","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-03","day",70000,null,"EUR","UNITED PARCEL SERVICE ESPAÑA LTD Y COMPAÑIA SRC","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00280-2022.pdf","https://www.enforcementtracker.com/ETid-1487",null,null,null,null,"united parcel service espana ltd y compania src",null,null,null,null,null,null,null,null,null],["2022/ES/004","ETid-1801","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-03","day",75000,null,"EUR","Burwebs S.L.","Media, Telecoms and Broadcasting","Art. 12(2), Art. 13, Art. 25, Art. 30(1)","Accountability, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00554-2021.pdf","https://www.enforcementtracker.com/ETid-1801",null,null,null,null,"burwebs sl",null,null,null,null,null,null,null,null,null],["2022/ES/045","ETid-1478","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-02","day",25000,null,"EUR","CAIXABANK S.A.","Finance, Insurance and Consulting","Art. 16","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/reposicion-ps-00183-2022.pdf","https://www.enforcementtracker.com/ETid-1478",null,null,null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2022/ES/043","ETid-1484","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-02","day",5000,null,"EUR","CÍTRICOS TANTA, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00097-2022.pdf","https://www.enforcementtracker.com/ETid-1484",null,null,null,null,"citricos tanta sl",null,null,null,null,null,null,null,null,null],["2022/ES/042","ETid-1485","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-11-02","day",2000,null,"EUR","Rapido Finance, S.L.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00211-2022.pdf","https://www.enforcementtracker.com/ETid-1485",null,null,null,null,"rapido finance sl",null,null,null,null,null,null,null,null,null],["2022/PL/006","ETid-1494","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-11-02","day",1700,null,"EUR","Mayor","Public Sector and Education","Art. 25(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.8.2022","https://www.enforcementtracker.com/ETid-1494","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.8.2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/PT/002","ETid-1498","cms_tracker","Portugal","PT","Portuguese Data Protection Authority (CNPD)","2022-11-02","day",180000,null,"EUR","Setúbal municipality","Public Sector and Education",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/122026","https://www.enforcementtracker.com/ETid-1498","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2022/140","gdprhub",null,null,"PT: setubal municipality",null,null,null,null,null,null,null,null,null],["2022/PT/001","ETid-1524","cms_tracker","Portugal","PT","Portuguese Data Protection Authority (CNPD)","2022-11-02","day",4300000,null,"EUR","Portuguese National Statistical Institute","Public Sector and Education","Art. 12, Art. 13, Art. 44, Art. 46(2), Art. 5(1)(a), Art. 9(1)","Data principles, International transfers, Special categories, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.cnpd.pt/comunicacao-publica/noticias/cnpd-sanciona-ine-por-cinco-contraordenacoes/","https://www.enforcementtracker.com/ETid-1524",null,null,null,null,"PT: portuguese national statistical institute",null,null,null,null,null,null,null,null,null],["2022/GR/031","HDPA (Greece) - 61/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-11-01","day",null,null,null,"Ministry of Education and Religious Affairs",null,"Art. 12, Art. 13, Art. 25(1), Art. 35, Art. 46, Art. 5(1)(a), Art. 6(1)(e)","Accountability, DPIA, Data principles, International transfers, Transparency, Unlawful processing",null,"Violation found","https://www.dpa.gr/sites/default/files/2022-11/61_2022%2520anonym_0.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_61/2022",null,"gdprhub",null,null,"GR: ministry of education and religious affairs",null,null,null,null,null,null,null,null,null],["2022/ES/047","ETid-1476","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-31","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00117-2022.pdf","https://www.enforcementtracker.com/ETid-1476",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/046","ETid-1477","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-31","day",70000,null,"EUR","BANCO BILBAO VIZCAYA ARGENTARIA, S.A.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(b), Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00375-2022.pdf","https://www.enforcementtracker.com/ETid-1477",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2022/ES/044","ETid-1480","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-31","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00164-2022.pdf","https://www.enforcementtracker.com/ETid-1480",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/ES/041","ETid-1486","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-31","day",525000,null,"EUR","TECHPUMP SOLUTIONS S.L.","Media, Telecoms and Broadcasting","Art. 13, Art. 25, Art. 30(1), Art. 6(1), Art. 8","Accountability, Consent, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00555-2021.pdf","https://www.enforcementtracker.com/ETid-1486",null,null,null,null,"techpump solutions sl",null,null,null,null,null,null,null,null,null],["2022/IS/017","Persónuvernd (Iceland) - Case no. 2021061304","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-10-31","day",null,null,null,null,null,"Art. 12, Art. 15, Art. 58","Data subject rights, Transparency",null,"Violation found","https://www.personuvernd.is/urlausnir/afgreidsla-bl-ehf.-a-adgangsbeidni-ekki-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021061304",null,"gdprhub",null,"Car repair shop",null,null,null,null,null,null,null,null,null,null],["2022/ES/233","AEPD (Spain) - PS-00218-2022","gdprhub","Spain","ES","AEPD (Spain)","2022-10-28","day",null,null,null,"ministry of inclusion, social security and migration",null,"Art. 32, Art. 5(1), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.aepd.es/es/documento/ps-00218-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00218-2022",null,"gdprhub",null,null,"ES: ministry of inclusion social security and migration",null,null,null,null,null,null,null,null,null],["2022/DK/033","Datatilsynet (Denmark) - 2021-41-0149","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-10-27","day",null,null,null,"JP/Politikens Hus A/S",null,"Art. 4(11), Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/okt/alvorlig-kritik-af-jppolitikens-samtykkeloesning-paa-wwwebdk","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-41-0149",null,"gdprhub",null,null,"jp politikens hus as",null,null,null,null,null,null,null,null,null],["2022/ES/051","ETid-1471","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-26","day",10000,null,"EUR","ACKERMANN & SCHWARTZ ATTORNEYS AT LAW SLP","Finance, Insurance and Consulting","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00047-2022.pdf","https://www.enforcementtracker.com/ETid-1471",null,null,null,null,"ackermann and schwartz attorneys at law slp",null,null,null,null,null,null,null,null,null],["2022/ES/002","ETid-2287","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-26","day",6400,null,"EUR","AIO E-COMMERCE, S.L.","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/documento/ps-00507-2021.pdf","https://www.enforcementtracker.com/ETid-2287",null,null,null,null,"aio e commerce sl",null,null,null,null,null,null,null,null,null],["2022/ES/050","ETid-1472","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-25","day",9000,null,"EUR","EL RACO DEL PIS INVERSIONES S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00104-2022.pdf","https://www.enforcementtracker.com/ETid-1472",null,null,null,null,"el raco del pis inversiones sl",null,null,null,null,null,null,null,null,null],["2022/GR/037","HDPA (Greece) - 64/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-10-25","day",null,null,null,null,null,"Art. 25(1)","Accountability",null,"Violation found","https://www.dpa.gr/sites/default/files/2022-12/64_2022%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_64/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/055","ETid-1466","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-24","day",240,null,"EUR","Company",null,"Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00108-2022.pdf","https://www.enforcementtracker.com/ETid-1466",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/054","ETid-1467","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-24","day",400,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00212-2022.pdf","https://www.enforcementtracker.com/ETid-1467",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/053","ETid-1468","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-24","day",8000,null,"EUR","ADSL HOUSE, S.L.","Media, Telecoms and Broadcasting","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00354-2022.pdf","https://www.enforcementtracker.com/ETid-1468",null,null,null,null,"adsl house sl",null,null,null,null,null,null,null,null,null],["2022/ES/056","ETid-1459","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-20","day",1000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00219-2022.pdf","https://www.enforcementtracker.com/ETid-1459",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/IT/046","ETid-1528","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-20","day",7000,null,"EUR","I.S.P.R.O.","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9828965","https://www.enforcementtracker.com/ETid-1528",null,null,null,null,"IT: ispro",null,null,null,null,null,null,null,null,null],["2022/IT/029","ETid-1613","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-20","day",5000,null,"EUR","Fondazione Teatro Regio di Torino","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9828987","https://www.enforcementtracker.com/ETid-1613","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9828987","gdprhub",null,null,"IT: fondazione teatro regio di torino",null,null,null,null,null,null,null,null,null],["2022/IT/028","ETid-1614","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-20","day",9000,null,"EUR","Azienda Ospedaliero-Universitaria Careggi di Firenze","Health Care","Art. 5(1)(f), Art. 9","Data principles, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9832526","https://www.enforcementtracker.com/ETid-1614",null,null,null,null,"IT: azienda ospedaliero universitaria careggi di firenze",null,null,null,null,null,null,null,null,null],["2022/IT/024","ETid-1629","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-20","day",900,null,"EUR","Istituto di Istruzione Superiore G. Renda di Polistena, Reggio Calabria","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9828059","https://www.enforcementtracker.com/ETid-1629","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9828059","gdprhub",null,null,"IT: istituto di istruzione superiore g renda di polistena reggio calabria",null,null,null,null,null,null,null,null,null],["2022/IT/023","ETid-1630","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-20","day",10000,null,"EUR","Italian Archery Federation (FITARCO)","Individuals and Private Associations","Art. 10, Art. 6","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9831323","https://www.enforcementtracker.com/ETid-1630",null,null,null,null,"IT: italian archery federation",null,null,null,null,null,null,null,null,null],["2022/IT/016","ETid-1639","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-20","day",12000,null,"EUR","Comune di Salento","Public Sector and Education","Art. 12, Art. 13, Art. 15, Art. 30, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9831369","https://www.enforcementtracker.com/ETid-1639",null,null,null,null,"IT: comune di salento",null,null,null,null,null,null,null,null,null],["2022/IT/009","ETid-1653","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-20","day",1400000,null,"EUR","Douglas Italia S.p.a.","Industry and Commerce","Art. 12(1), Art. 13(2)(a), Art. 24, Art. 25(1), Art. 5(2), Art. 6, Art. 7","Accountability, Consent, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9825667","https://www.enforcementtracker.com/ETid-1653","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9825667","gdprhub",null,null,"douglas italia spa",null,null,null,null,null,null,null,null,null],["2022/IT/167","Garante per la protezione dei dati personali (Italy) - 9827446","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-10-20","day",30000,"30,000","EUR","Policlinico Casilino di Roma",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 9","Data principles, Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9827446","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9827446",null,"gdprhub",null,null,"IT: policlinico casilino di roma",null,null,null,null,null,null,null,null,null],["2022/NO/008","Datatilsynet (Norway) - 20/03293 (decision 2)","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-10-19","day",null,null,null,"Directorate of Norwegian Correctional Service",null,null,null,null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2022/tilsynrapport-og-palegg-til-kriminalomsorgen/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/03293_%28decision_2%29",null,"gdprhub",null,null,"NO: directorate of norwegian correctional service",null,null,null,null,null,null,null,null,null],["2022/ES/059","ETid-1446","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-19","day",5000,null,"EUR","RESTEXPERIENCE, S.L.","Accommodation and Hospitality","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00101-2022.pdf","https://www.enforcementtracker.com/ETid-1446",null,null,null,null,"restexperience sl",null,null,null,null,null,null,null,null,null],["2022/GB/001","ETid-1461","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2022-10-19","day",5033000,null,"EUR","Interserve Group Limited","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media/action-weve-taken/mpns/4021951/interserve-group-limited-monetary-penalty-notice.pdf","https://www.enforcementtracker.com/ETid-1461","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Interserve_Group_Limited_monetary_penalty_notice","gdprhub",null,null,"interserve group ltd",null,null,null,null,null,null,null,null,null],["2022/IS/011","Persónuvernd (Iceland) - Case no. 2021040978","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-10-19","day",null,null,null,"Landsbankinn hf.",null,"Art. 4(7)",null,null,"Rejected","https://www.personuvernd.is/urlausnir/afgreidsla-landsbankans-a-adgangsbeidni-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Case_no._2021040978",null,"gdprhub",null,null,"landsbankinn hf",null,null,null,null,null,null,null,null,null],["2022/BE/039","APD/GBA (Belgium) - 149/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-10-18","day",null,null,null,null,null,"Art. 24(1), Art. 28(2), Art. 28(3), Art. 44, Art. 46, Art. 49(1)(d), Art. 49(4), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(d), Art. 5(1)(e), Art. 5(1)(f), Art. 5(2), Art. 57(4), Art. 6(1)(e)","Accountability, Data principles, International transfers, Processor obligations, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-149-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_149/2022",null,"gdprhub",null,"Social housing organisation",null,null,null,null,null,null,null,null,null,null],["2022/RO/014","ETid-1449","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-10-18","day",2000,null,"EUR","SC Materiale Constructii Online SRL","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_18_10_2022&lang=ro","https://www.enforcementtracker.com/ETid-1449",null,null,null,null,"materiale constructii online srl",null,null,null,null,null,null,null,null,null],["2022/RO/013","ETid-1450","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-10-18","day",150,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)(a)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_18_10_2022&lang=ro","https://www.enforcementtracker.com/ETid-1450",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/BE/038","APD/GBA (Belgium) - 147/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-10-17","day",null,null,null,null,null,"Art. 13(1)(c), Art. 2(1), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(b), Art. 6(1)(f)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-147-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_147/2022",null,"gdprhub",null,"Vacation park owner",null,null,null,null,null,null,null,null,null,null],["2022/ES/060","ETid-1444","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-17","day",180,null,"EUR","INMUR JOYEROS, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00352-2022.pdf","https://www.enforcementtracker.com/ETid-1444",null,null,null,null,"inmur joyeros sl",null,null,null,null,null,null,null,null,null],["2022/ES/058","ETid-1447","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-17","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00567-2021.pdf","https://www.enforcementtracker.com/ETid-1447",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/FR/004","ETid-1448","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-10-17","day",20000000,null,"EUR","Clearview Al Inc.","Industry and Commerce","Art. 12, Art. 15, Art. 17, Art. 31, Art. 6","Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859?isSuggest=true","https://www.enforcementtracker.com/ETid-1448","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-019","gdprhub",null,null,"clearview al inc","Clearview AI",null,null,null,null,null,null,null,null],["2022/ES/057","ETid-1451","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-17","day",6000,null,"EUR","Company",null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00188-2022.pdf","https://www.enforcementtracker.com/ETid-1451",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/052","ETid-1470","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-17","day",35000,null,"EUR","OES GLOBAL ENERGY S.L.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00099-2022.pdf","https://www.enforcementtracker.com/ETid-1470",null,null,null,null,"oes global energy sl",null,null,null,null,null,null,null,null,null],["2022/ES/061","ETid-1441","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-14","day",12000,null,"EUR","SEAN SERIOS S.L.","Public Sector and Education","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00520-2021.pdf","https://www.enforcementtracker.com/ETid-1441",null,null,null,null,"sean serios sl",null,null,null,null,null,null,null,null,null],["2022/BE/042","APD/GBA (Belgium) - 146/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-10-13","day",null,null,null,null,null,"Art. 5(1), Art. 5(1)(c), Art. 5(1)(e)","Data principles",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-146-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_146/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/037","APD/GBA (Belgium) - 145/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-10-12","day",null,null,null,null,null,"Art. 12(2), Art. 5(1)(c), Art. 58(2)(c)","Data principles, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/waarschuwing-en-berisping-nr.-145-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_145/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/040","APD/GBA (Belgium) - 143/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-10-11","day",null,null,null,null,null,"Art. 12, Art. 12(3), Art. 12(4), Art. 15, Art. 15(1), Art. 15(3), Art. 4(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-143-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_143/2022",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2022/SE/015","IMY (Sweden) - DI-2021-3399","gdprhub","Sweden","SE","IMY (Sweden)","2022-10-10","day",null,null,null,"Trionic Sverige AB",null,"Art. 13(1)(e), Art. 6(1), Art. 6(1)(c), Art. 6(1)(f)","Transparency, Unlawful processing",null,"Violation found","https://edpb.europa.eu/system/files/2023-02/se_2022-10_decisionpublic_redacted.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-3399",null,"gdprhub",null,null,"trionic sverige ab",null,null,null,null,null,null,null,null,null],["2022/ES/068","ETid-1425","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-09","day",4000,null,"EUR","PUNTO BADAL-BCN S.L.","Real Estate","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00145-2022.pdf","https://www.enforcementtracker.com/ETid-1425",null,null,null,null,"punto badal bcn sl",null,null,null,null,null,null,null,null,null],["2022/ES/067","ETid-1426","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-09","day",24000,null,"EUR","CAJA DE SEGUROS REUNIDOS, COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00275-2022.pdf","https://www.enforcementtracker.com/ETid-1426",null,null,null,null,"caja de seguros reunidos compania de seguros y reaseguros sa",null,null,null,null,null,null,null,null,null],["2022/ES/066","ETid-1429","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-09","day",900,null,"EUR",null,"Individuals and Private Associations","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00370-2022.pdf","https://www.enforcementtracker.com/ETid-1429",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/065","ETid-1430","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-09","day",800,null,"EUR","Company",null,"Art. 13, Art. 6(1)(e)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00595-2021.pdf","https://www.enforcementtracker.com/ETid-1430",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/064","ETid-1431","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-09","day",6000,null,"EUR","UNION DE OFICIALES DE LA GUARDIA CIVIL PROFESIONAL","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00002-2022.pdf","https://www.enforcementtracker.com/ETid-1431",null,null,null,null,"ES: union de oficiales de la guardia civil profesional",null,null,null,null,null,null,null,null,null],["2022/ES/063","ETid-1432","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-09","day",64000,null,"EUR","EVERIS SPAIN S.L","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00401-2022.pdf","https://www.enforcementtracker.com/ETid-1432",null,null,null,null,"everis spain sl",null,null,null,null,null,null,null,null,null],["2022/IT/058","ETid-1462","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-06","day",15000,null,"EUR","Servizio Idrico Integrato S.c.p.a.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9817058","https://www.enforcementtracker.com/ETid-1462","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9817058","gdprhub",null,null,"IT: servizio idrico integrato scpa",null,null,null,null,null,null,null,null,null],["2022/IT/050","ETid-1511","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-06","day",2000000,null,"EUR","Alpha Exploration","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13, Art. 14, Art. 27(4), Art. 28, Art. 32, Art. 35, Art. 6, Art. 7","Consent, DPIA, Data principles, Data security, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9828901","https://www.enforcementtracker.com/ETid-1511","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9828901","gdprhub",null,null,"IT: alpha exploration",null,null,null,null,null,null,null,null,null],["2022/IT/049","ETid-1512","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-06","day",10000,null,"EUR","Codess Sociale, Soc. Coop. sociale.","Individuals and Private Associations","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9827402","https://www.enforcementtracker.com/ETid-1512",null,null,null,null,"IT: codess sociale soc coop sociale",null,null,null,null,null,null,null,null,null],["2022/IT/031","ETid-1611","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-06","day",3000,null,"EUR","Associazione Rescue Drones Network ODV","Individuals and Private Associations","Art. 12, Art. 15(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9828076","https://www.enforcementtracker.com/ETid-1611",null,null,null,null,"IT: associazione rescue drones network odv",null,null,null,null,null,null,null,null,null],["2022/IT/030","ETid-1612","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-06","day",10000,null,"EUR","Poste Italiane S.p.a.","Transportation and Energy",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9831387","https://www.enforcementtracker.com/ETid-1612",null,null,null,null,"poste italiane spa",null,null,null,null,null,null,null,null,null],["2022/IT/005","ETid-1669","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-10-06","day",100000,null,"EUR","Veneto region","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9830178","https://www.enforcementtracker.com/ETid-1669","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9830178","gdprhub",null,null,"IT: veneto region",null,null,null,null,null,null,null,null,null],["2022/HU/013","ETid-1440","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-10-05","day",72500,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 12(1), Art. 5(2), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=564:hitelbiralatot-megelozo-elobiralat-jogalapja-es-az-ahhoz-kapcsolodo-tajekoztatas","https://www.enforcementtracker.com/ETid-1440",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/041","APD/GBA (Belgium) - 141/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-10-04","day",null,null,null,null,null,"Art. 17, Art. 17(3), Art. 17(3)(a), Art. 89","Data subject rights",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-141-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_141/2022",null,"gdprhub",null,"Newspaper",null,null,null,null,null,null,null,null,null,null],["2022/ES/069","ETid-1421","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-04","day",6000,null,"EUR","Club Náutico el Estacio","Individuals and Private Associations","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00004-2022.pdf","https://www.enforcementtracker.com/ETid-1421",null,null,null,null,"ES: club nautico el estacio",null,null,null,null,null,null,null,null,null],["2022/GB/002","ETid-1422","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2022-10-04","day",1547000,null,"EUR","Easylife Ltd.","Industry and Commerce","Art. 13(1)(c), Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ico.org.uk/media/action-weve-taken/mpns/4021801/easylife-limited-mpn-article-5-1-a-20221004.pdf","https://www.enforcementtracker.com/ETid-1422","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Monetary_Penalty_Notice_to_Easylife_Limited","gdprhub",null,null,"easylife ltd",null,null,null,null,null,null,null,null,null],["2022/ES/062","ETid-1433","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-10-04","day",600,null,"EUR","Homeowners Association","Real Estate","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00146-2022.pdf","https://www.enforcementtracker.com/ETid-1433",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/016","ETid-1434","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-10-03","day",150,null,"EUR","Website operator","Individuals and Private Associations","Art. 6(1)(a)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_03.10.2022&lang=ro","https://www.enforcementtracker.com/ETid-1434",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/GR/005","ETid-1455","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-10-03","day",20000,null,"EUR","ALFA BANK S.A.","Finance, Insurance and Consulting","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epexergasia-dedomenon-meso-pistotikonhreostikon-karton-apo-tin-trapeza-1","https://www.enforcementtracker.com/ETid-1455",null,null,null,null,"alfa bank sa",null,null,null,null,null,null,null,null,null],["2022/GR/004","ETid-1456","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-10-03","day",20000,null,"EUR","EUROBANK ERGASIAS S.A.","Finance, Insurance and Consulting","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epexergasia-dedomenon-meso-pistotikonhreostikon-karton-apo-tin-trapeza-0","https://www.enforcementtracker.com/ETid-1456",null,null,null,null,"eurobank ergasias sa",null,null,null,null,null,null,null,null,null],["2022/GR/003","ETid-1457","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-10-03","day",20000,null,"EUR","PIRAEUS BANK S.A.","Finance, Insurance and Consulting","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epexergasia-dedomenon-meso-pistotikonhreostikon-karton-apo-tin-trapeza","https://www.enforcementtracker.com/ETid-1457",null,null,null,null,"GR: piraeus bank",null,null,null,null,null,null,null,null,null],["2022/GR/002","ETid-1458","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-10-03","day",20000,null,"EUR","NATIONAL BANK OF GREECE S.A.","Finance, Insurance and Consulting","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epexergasia-dedomenon-meso-pistotikonhreostikon-karton-apo-tin-ethniki","https://www.enforcementtracker.com/ETid-1458",null,null,null,null,"national bank of greece sa",null,null,null,null,null,null,null,null,null],["2022/ES/234","AEPD (Spain) - PS-00587-2021","gdprhub","Spain","ES","AEPD (Spain)","2022-09-30","day",null,null,null,"Consejeria de Sanidad de la Comunidad de Madrid",null,"Art. 24, Art. 25, Art. 32, Art. 4, Art. 5(1)(f), Art. 5(2), Art. 57(1), Art. 58(2), Art. 83(4), Art. 83(5), Art. 83(7), Art. 9(1)","Accountability, Data principles, Data security, Special categories",null,"Violation found","https://www.aepd.es/documento/ps-00587-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00587-2021",null,"gdprhub",null,null,"ES: consejeria de sanidad de la comunidad de madrid",null,null,null,null,null,null,null,null,null],["2022/BE/035","APD/GBA (Belgium) - 140/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-09-29","day",null,null,null,null,null,"Art. 12(3), Art. 16","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-140-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_140/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/072","ETid-1410","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-28","day",180,null,"EUR","Y OTRO MAS C.B.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00316-2022.pdf","https://www.enforcementtracker.com/ETid-1410",null,null,null,null,"ES: y otro mas cb",null,null,null,null,null,null,null,null,null],["2022/ES/071","ETid-1411","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-28","day",720,null,"EUR","CLUB NATACIO LLEIDA","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00093-2022.pdf","https://www.enforcementtracker.com/ETid-1411",null,null,null,null,"ES: club natacio lleida",null,null,null,null,null,null,null,null,null],["2022/ES/070","ETid-1417","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-28","day",31200,null,"EUR","BAYARD REVISTAS, S.A.","Media, Telecoms and Broadcasting","Art. 32, Art. 33, Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00246-2022.pdf","https://www.enforcementtracker.com/ETid-1417",null,null,null,null,"bayard revistas sa",null,null,null,null,null,null,null,null,null],["2022/BE/036","APD/GBA (Belgium) - 138/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-09-27","day",null,null,null,null,null,"Art. 24(1), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(2), Art. 6(1)(f)","Accountability, Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-138-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_138/2022",null,"gdprhub",null,"Neighbour",null,null,null,null,null,"person",null,null,null,null],["2022/BE/033","APD/GBA (Belgium) - 136/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-09-26","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(3), Art. 4(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-136-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_136/2022",null,"gdprhub",null,"Car company",null,null,null,null,null,null,null,null,null,null],["2022/BE/034","APD/GBA (Belgium) - 137/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-09-26","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 17(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-137-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_137/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/HU/009","ETid-1753","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-09-26","day",26700,null,"EUR","TV2 Média Csoport Zrt.","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13, Art. 6(1)","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=620:weboldal-suti-hozzajarulas-keretrendszerenek-jogi-megfelelosege","https://www.enforcementtracker.com/ETid-1753","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-3195-11/2022","gdprhub",null,null,"tv2 media csoport zrt",null,null,null,null,null,null,null,null,null],["2022/HU/014","ETid-1407","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-09-25","day",1200,null,"EUR","Health insurance provider","Health Care","Art. 31, Art. 5(1)(a), Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=557:erintetti-jogok-biztositasanak-serelme-a-vakcina-regisztracio-lekerdezes-vakcinareg-neak-gov-hu-kapcsan","https://www.enforcementtracker.com/ETid-1407",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/073","ETid-1404","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-23","day",3000,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00379-2021.pdf","https://www.enforcementtracker.com/ETid-1404",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/049","ETid-1474","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-23","day",1200,null,"EUR","URBANO DIVERTIA, S.L.",null,"Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00341-2022.pdf","https://www.enforcementtracker.com/ETid-1474",null,null,null,null,"urbano divertia sl",null,null,null,null,null,null,null,null,null],["2022/BE/032","APD/GBA (Belgium) - 135/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-09-22","day",null,null,null,null,null,"Art. 12(3), Art. 15(1), Art. 15(3), Art. 26, Art. 4(23), Art. 56(1)","Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-135-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_135/2022",null,"gdprhub",null,"Company with offices in Belgium and the UK",null,null,null,null,null,null,null,null,null,null],["2022/RO/017","ETid-1409","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-09-22","day",2000,null,"EUR","Bitfactor SRL","Finance, Insurance and Consulting","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_22_09_2022&lang=ro","https://www.enforcementtracker.com/ETid-1409",null,null,null,null,"bitfactor srl",null,null,null,null,null,null,null,null,null],["2022/GR/007","ETid-1453","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-09-22","day",3000,null,"EUR","Gas station","Industry and Commerce","Art. 12, Art. 14","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-mi-ikanopoiisi-dikaiomatos-prosbasis-se-yliko","https://www.enforcementtracker.com/ETid-1453",null,null,null,null,"GR: gas station",null,null,null,null,null,null,null,null,null],["2022/CY/015","Commissioner (Cyprus) - 11.17.001.010.064","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2022-09-21","day",5000,"5000","EUR",null,null,"Art. 24(1), Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security",null,"Violation found","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/0F1B99C0D69F7754C22588FB0043AB18/$file/%25CE%259A%25CE%25B1%25CF%2584%25CE%25B1%25CE%25B3%25CE%25B3%25CE%25B5%25CE%25BB%25CE%25AF%25CE%25B1%2520%25CE%25B3%25CE%25B9%25CE%25B1%2520%25CE%25B4%25CE%25B9%25CE%25B1%25CF%2581%25CF%2581%25CE%25BF%25CE%25AE%2520%25CF%2580%25CF%2581%25CE%25BF%25CF%2583%25CF%2589%25CF%2580%25CE%25B9%25CE%25BA%25CF%258E%25CE%25BD%2520%25CE%25B4%25CE%25B5%25CE%25B4%25CE%25BF%25CE%25BC%25CE%25AD%25CE%25BD%25CF%2589%25CE%25BD%2520%25CF%2580%25CE%25BF%25CE%25BB%25CE%25AF%25CF%2584%25CE%25B7%2520%25CF%2583%25CE%25B5%2520%25CF%2584%25CF%2581%25CE%25AF%25CF%2584%25CE%25BF%2520%25CF%2580%25CF%2581%25CF%258C%25CF%2583%25CF%2589%25CF%2580%25CE%25BF.pdf?openelement","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.010.064",null,"gdprhub",null,"Cyprus electricity authority",null,null,null,null,null,null,null,null,null,null],["2022/DE/047","ETid-1399","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2022-09-21","day",50000,null,"EUR","Property development company","Real Estate","Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/bussgeld-daten-aus-dem-grundbuch-stehen-nicht-zur-freien-verfuegung/","https://www.enforcementtracker.com/ETid-1399",null,null,null,null,"DE: property development company",null,null,null,null,null,null,null,null,null],["2022/DE/046","ETid-1408","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2022-09-21","day",5000,null,"EUR","Surveyor","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/bussgeld-daten-aus-dem-grundbuch-stehen-nicht-zur-freien-verfuegung/","https://www.enforcementtracker.com/ETid-1408",null,null,null,null,"DE: surveyor",null,null,null,null,null,null,null,null,null],["2022/RO/015","ETid-1436","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-09-21","day",5000,null,"EUR","Curtea Veche Publishing SRL","Media, Telecoms and Broadcasting","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_21_09_2022&lang=ro","https://www.enforcementtracker.com/ETid-1436",null,null,null,null,"curtea veche publishing srl",null,null,null,null,null,null,null,null,null],["2022/IS/009","Persónuvernd (Iceland) - 2021101909","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-09-21","day",null,null,null,null,null,"Art. 5(1)(d)","Data principles",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-um-barn-hja-grunnskola","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2021101909",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2022/DE/048","ETid-1398","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2022-09-20","day",525000,null,"EUR","Company","Industry and Commerce","Art. 38(6)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2022/20220920-BlnBDI-PM-Bussgeld-DSB.pdf","https://www.enforcementtracker.com/ETid-1398",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/074","ETid-1402","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-20","day",1800,null,"EUR","Union Sindical Obrera","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00356-2022.pdf","https://www.enforcementtracker.com/ETid-1402",null,null,null,null,"ES: union sindical obrera",null,null,null,null,null,null,null,null,null],["2022/RO/018","ETid-1403","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-09-19","day",2000,null,"EUR","Banca Comercială Română SA","Finance, Insurance and Consulting","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_19_09_2022&lang=ro","https://www.enforcementtracker.com/ETid-1403",null,null,null,null,"banca comerciala romana sa",null,null,null,null,null,null,null,null,null],["2022/ES/082","ETid-1391","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-16","day",480,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00050-2022.pdf","https://www.enforcementtracker.com/ETid-1391",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/081","ETid-1392","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-16","day",10000,null,"EUR","SOPHIE ET VOILA, S.L","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00066-2022.pdf","https://www.enforcementtracker.com/ETid-1392",null,null,null,null,"sophie et voila sl",null,null,null,null,null,null,null,null,null],["2022/ES/076","ETid-1400","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-16","day",3000,null,"EUR","MARIELI GABRIELA, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00203-2022.pdf","https://www.enforcementtracker.com/ETid-1400",null,null,null,null,"marieli gabriela sl",null,null,null,null,null,null,null,null,null],["2022/ES/075","ETid-1401","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-16","day",2000,null,"EUR","Agent of the real estate agency BARCELONA DREAM HOUSE AGENCY","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00115-2022.pdf","https://www.enforcementtracker.com/ETid-1401",null,null,null,null,"ES: agent of the real estate agency barcelona dream house agency",null,null,null,null,null,null,null,null,null],["2022/IT/065","ETid-1423","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-09-15","day",100000,null,"EUR","Lazio Region","Health Care","Art. 12, Art. 13, Art. 14, Art. 24, Art. 5(2), Art. 6, Art. 9","Accountability, Data principles, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9810028","https://www.enforcementtracker.com/ETid-1423",null,null,null,null,"IT: lazio region",null,null,null,null,null,null,null,null,null],["2022/IT/060","ETid-1452","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-09-15","day",2000,null,"EUR","Immobiliare Riscostruzione Meloria s.r.l.","Real Estate","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9815745","https://www.enforcementtracker.com/ETid-1452","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9815745","gdprhub",null,null,"immobiliare riscostruzione meloria srl",null,null,null,null,null,null,null,null,null],["2022/IT/059","ETid-1460","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-09-15","day",10000,null,"EUR","Bper Banca S.p.A.","Finance, Insurance and Consulting","Art. 12","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9815947","https://www.enforcementtracker.com/ETid-1460",null,null,null,null,"bper banca spa",null,null,null,null,null,null,null,null,null],["2022/IT/054","ETid-1469","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-09-15","day",3000,null,"EUR","Thiene municipality","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9815665","https://www.enforcementtracker.com/ETid-1469","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9815665","gdprhub",null,null,"IT: thiene municipality",null,null,null,null,null,null,null,null,null],["2022/IT/048","ETid-1513","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-09-15","day",40000,null,"EUR","FCA Italy S.p.A.","Individuals and Private Associations","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9827119","https://www.enforcementtracker.com/ETid-1513","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9827119","gdprhub",null,null,"fca italy spa",null,null,null,null,null,null,null,null,null],["2022/IE/013","DPC (Ireland) - IN-21-3-1","gdprhub","Ireland","IE","DPC (Ireland)","2022-09-14","day",null,null,null,"Airbnb Ireland UC",null,"Art. 12, Art. 15, Art. 17, Art. 4, Art. 5, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2023-01/Airbnb%2520Ireland%2520UC%2520IN-21-3-1%2520Redacted%2520Decision%2520EN.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-21-3-1",null,"gdprhub",null,null,"airbnb ireland uc","Airbnb",null,null,null,null,null,null,null,null],["2022/ES/088","ETid-1381","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-13","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00069-2022.pdf","https://www.enforcementtracker.com/ETid-1381",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/FR/005","ETid-1382","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-09-13","day",250000,null,"EUR","GIE INFOGREFFE","Public Sector and Education","Art. 32, Art. 5(1)(e)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnil.fr/fr/sanction-de-250-000-euros-lencontre-dinfogreffe","https://www.enforcementtracker.com/ETid-1382","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-018","gdprhub",null,null,"FR: gie infogreffe",null,null,null,null,null,null,null,null,null],["2022/ES/087","ETid-1383","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-13","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00150-2022.pdf","https://www.enforcementtracker.com/ETid-1383",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/SE/007","IMY (Sweden) - IMY-2022-1621","gdprhub","Sweden","SE","IMY (Sweden)","2022-09-13","day",null,null,null,null,null,"Art. 4(7), Art. 6(1)(f), Art. 85(1), Art. 85(2), Art. 9","Special categories, Unlawful processing",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2022/beslut-tillsyn-verifiera.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_IMY-2022-1621",null,"gdprhub",null,"Background check database",null,null,null,null,null,null,null,null,null,null],["2022/DK/001","ETid-1412","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2022-09-12","day",6700,null,"EUR","Hørsholm municipality","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/sep/hoersholm-kommune-idoemt-boede-paa-50000-kr","https://www.enforcementtracker.com/ETid-1412",null,null,null,null,"DK: hrsholm municipality",null,null,null,null,null,null,null,null,null],["2022/HU/004","ETid-1815","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-09-12","day",80700,null,"EUR","Coin dealer","Industry and Commerce","Art. 12(1), Art. 13, Art. 6(1), Art. 7(2)","Consent, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://naih.hu/eves-beszamolok?download=648:naih-beszamolo-a-2022-evi-tevekenysegroll","https://www.enforcementtracker.com/ETid-1815",null,null,null,null,"HU: coin dealer",null,null,null,null,null,null,null,null,null],["2022/HU/027","NAIH (Hungary) - NAIH-2501-10/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-09-12","day",73500,"73500","EUR","Magyar Éremkibocsátó Kft.",null,"Art. 12(1), Art. 13, Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=584:erintetti-hozzajarulas-celonkenti-szuksegessege-es-mas-jognyilatkozattol-elvalasztasa","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2501-10/2022",null,"gdprhub",null,null,"magyar eremkibocsato kft",null,null,null,null,null,null,null,null,null],["2022/ES/086","ETid-1384","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-09","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00071-2022.pdf","https://www.enforcementtracker.com/ETid-1384","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202103983","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/RO/020","ETid-1385","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-09-09","day",2000,null,"EUR","SC Raiffeisen Bank SA","Finance, Insurance and Consulting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09.09.2022&lang=ro","https://www.enforcementtracker.com/ETid-1385",null,null,null,null,"raiffeisen bank sa",null,null,null,null,null,null,null,null,null],["2022/ES/085","ETid-1386","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-09","day",180,null,"EUR","EURO DONER KEBAB","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00261-2022.pdf","https://www.enforcementtracker.com/ETid-1386",null,null,null,null,"ES: euro doner kebab",null,null,null,null,null,null,null,null,null],["2022/GR/006","ETid-1454","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-09-09","day",15000,null,"EUR","School","Public Sector and Education","Art. 12, Art. 13, Art. 30, Art. 5(2), Art. 6","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/index.php/el/enimerwtiko/prakseisArxis/epiboli-dioikitikoy-prostimoy-gia-leitoyrgia-systimatos-binteoepitirisis","https://www.enforcementtracker.com/ETid-1454","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_50/2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DK/028","Datatilsynet (Denmark) - 2021-432-0056","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-09-08","day",null,null,null,"Aarhus municipality",null,"Art. 28(3)(a), Art. 36, Art. 36(1), Art. 36(2), Art. 58(2)(d)","DPIA, Processor obligations",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/sep/vedroerende-aarhus-kommunes-behandling-af-personoplysninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-432-0056",null,"gdprhub",null,null,"DK: aarhus municipality",null,null,null,null,null,null,null,null,null],["2022/RO/019","ETid-1393","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-09-08","day",8000,null,"EUR","Realmedia Network SA","Media, Telecoms and Broadcasting","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08_09_2022&lang=ro","https://www.enforcementtracker.com/ETid-1393",null,null,null,null,"realmedia network sa",null,null,null,null,null,null,null,null,null],["2022/IS/008","Persónuvernd (Iceland) - 2020123091","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-09-08","day",null,null,null,"deCode Genetics",null,"Art. 28, Art. 4","Processor obligations",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-islenskrar-erfdargreiningar-ehf.-samkvaemt-logum#","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020123091",null,"gdprhub",null,null,"IS: decode genetics",null,null,null,null,null,null,null,null,null],["2022/ES/223","AEPD (Spain) - 00027-2022","gdprhub","Spain","ES","AEPD (Spain)","2022-09-07","day",null,null,null,null,null,"Art. 24(2)","Accountability",null,"Rejected","https://www.aepd.es/es/documento/ps-00027-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_00027-2022",null,"gdprhub",null,"Private parking lot owner",null,null,null,null,null,null,null,null,null,null],["2022/AT/006","DSB (Austria) - 2022-0.560.569","gdprhub","Austria","AT","DSB (Austria)","2022-09-07","day",null,null,null,null,null,"Art. 51(1), Art. 57(1)(f), Art. 77(1)",null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220907_2022_0_560_569__00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.560.569",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/PL/007","ETid-1405","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-09-07","day",530,null,"EUR","Sułkowice Cultural Center","Individuals and Private Associations",null,null,"Insufficient data processing agreement","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.29.2022","https://www.enforcementtracker.com/ETid-1405","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.29.2022","gdprhub",null,null,"PL: sukowice cultural center",null,null,null,null,null,null,null,null,null],["2022/ES/224","AEPD (Spain) - EXP202202889","gdprhub","Spain","ES","AEPD (Spain)","2022-09-06","day",null,null,null,"Dentoestetic Centro de Salud y Estética Dental SI",null,"Art. 12, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/es/documento/pd-00108-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202889",null,"gdprhub",null,null,"ES: dentoestetic centro de salud y estetica dental si",null,null,null,null,null,null,null,null,null],["2022/DK/030","Datatilsynet (Denmark) - 2021-31-5542","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-09-06","day",null,null,null,"The Conservative People’s Party",null,"Art. 14, Art. 6(1)(f), Art. 9(2)(d), Art. 9(2)(f)","Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/sep/det-konservative-folkeparti-havde-et-lovligt-grundlag-for-at-gennemfoere-advokatundersoegelse","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5542",null,"gdprhub",null,null,"DK: the conservative peoples party",null,null,null,null,null,null,null,null,null],["2022/DK/031","Datatilsynet (Denmark) - 2021-432-0063","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-09-06","day",null,null,null,"The Agency of Family Law",null,"Art. 32(1), Art. 58(2)(b), Art. 58(2)(d)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/sep/alvorlig-kritik-af-familieretshuset","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-432-0063",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/084","ETid-1387","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-06","day",20000,null,"EUR","MUXERS CONCEPT, S.L.","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00178-2022.pdf","https://www.enforcementtracker.com/ETid-1387",null,null,null,null,"muxers concept sl",null,null,null,null,null,null,null,null,null],["2022/GR/009","ETid-1437","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-09-06","day",5000,null,"EUR","EDYTE SA","Industry and Commerce","Art. 29","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2022-09/47_2022%20anonym.pdf","https://www.enforcementtracker.com/ETid-1437",null,null,null,null,"edyte sa",null,null,null,null,null,null,null,null,null],["2022/IE/005","ETid-1373","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2022-09-05","day",405000000,null,"EUR","Meta Platforms, Inc.","Media, Telecoms and Broadcasting","Art. 12(1), Art. 24, Art. 35, Art. 6(1)","Accountability, DPIA, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://edpb.europa.eu/system/files/2022-09/edpb_bindingdecision_20222_ie_sa_instagramchildusers_en.pdf","https://www.enforcementtracker.com/ETid-1373","https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_2/2022_-_%27Instagram%27","gdprhub",null,null,"meta platforms inc","Meta",null,null,null,null,null,null,null,null],["2022/ES/083","ETid-1388","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-04","day",360,null,"EUR","Store owner","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00177-2022.pdf","https://www.enforcementtracker.com/ETid-1388",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/078","ETid-1396","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-04","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00521-2021.pdf","https://www.enforcementtracker.com/ETid-1396",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/AT/013","DSB (Austria) - 2022-0.616.013","gdprhub","Austria","AT","DSB (Austria)","2022-09-01","day",null,null,null,null,null,"Art. 15, Art. 17(1)(a), Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)(a), Art. 8(1)","Consent, Data principles, Data subject rights, Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220901_2022_0_616_013_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.616.013",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/089","ETid-1379","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-01","day",240,null,"EUR","MH VILASECA S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00278-2022.pdf","https://www.enforcementtracker.com/ETid-1379",null,null,null,null,"mh vilaseca sl",null,null,null,null,null,null,null,null,null],["2022/IT/063","ETid-1435","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-09-01","day",4000,null,"EUR","Liceo Statale \"Edoardo Amaldi”","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9811361","https://www.enforcementtracker.com/ETid-1435","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9811361","gdprhub",null,null,"IT: liceo statale edoardo amaldi",null,null,null,null,null,null,null,null,null],["2022/ES/048","ETid-1475","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-09-01","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00134-2022.pdf","https://www.enforcementtracker.com/ETid-1475",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/PL/005","ETid-1567","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-08-31","day",1450,null,"EUR",null,null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/pl/138/2593","https://www.enforcementtracker.com/ETid-1567",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/094","ETid-1372","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-30","day",2000,null,"EUR","Sindicato Intersectorial Trabajadores/as Provincia de Alicante","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00626-2021.pdf","https://www.enforcementtracker.com/ETid-1372",null,null,null,null,"sindicato intersectorial trabajadores as provincia de alicante",null,null,null,null,null,null,null,null,null],["2022/ES/092","ETid-1375","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-30","day",3000,null,"EUR","COLEGIO VILLAEUROPA, S.C.L","Public Sector and Education","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00148-2022.pdf","https://www.enforcementtracker.com/ETid-1375",null,null,null,null,"ES: colegio villaeuropa scl",null,null,null,null,null,null,null,null,null],["2022/ES/090","ETid-1378","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-30","day",1700,null,"EUR","Bazar Pekin","Industry and Commerce","Art. 13, Art. 30","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00141-2022.pdf","https://www.enforcementtracker.com/ETid-1378",null,null,null,null,"ES: bazar pekin",null,null,null,null,null,null,null,null,null],["2022/PL/003","ETid-1569","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-08-30","day",6800,null,"EUR","TIMSHEL Sp. z o.o.","Finance, Insurance and Consulting","Art. 58(1)(e)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/pl/138/2593","https://www.enforcementtracker.com/ETid-1569",null,null,null,null,"timshel spzoo",null,null,null,null,null,null,null,null,null],["2022/DK/036","Datatilsynet (Denmark) - 2019-31-2071","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-08-29","day",null,null,null,"Reto Moto",null,"Art. 15(1), Art. 15(3), Art. 15(4)","Data subject rights",null,"Rejected","https://edpb.europa.eu/system/files/2023-02/dk_2022-08_decisionpublic_redacted.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-31-2071",null,"gdprhub",null,null,"DK: reto moto",null,null,null,null,null,null,null,null,null],["2022/RO/021","ETid-1377","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-08-29","day",1000,null,"EUR","Alpha Bank Romania SA","Finance, Insurance and Consulting","Art. 29, Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_29_08_2022&lang=ro","https://www.enforcementtracker.com/ETid-1377",null,null,null,null,"alpha bank romania sa",null,null,null,null,null,null,null,null,null],["2022/ES/091","ETid-1376","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-28","day",1200,null,"EUR","DIGITECNIA SOLUTIONS, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00346-2022.pdf","https://www.enforcementtracker.com/ETid-1376","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202164","gdprhub",null,null,"digitecnia solutions sl",null,null,null,null,null,null,null,null,null],["2022/ES/080","ETid-1394","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-28","day",48000,null,"EUR","NATURGY ENERGY GROUP, S.A.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00100-2022.pdf","https://www.enforcementtracker.com/ETid-1394","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202105644","gdprhub",null,null,"naturgy energy group sa",null,null,null,null,null,null,null,null,null],["2022/ES/079","ETid-1395","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-28","day",5600,null,"EUR","SOLIVESA MASTER FRANCHISE S.L.","Media, Telecoms and Broadcasting","Art. 28","Data subject rights, Processor obligations","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00186-2022.pdf","https://www.enforcementtracker.com/ETid-1395",null,null,null,null,"solivesa master franchise sl",null,null,null,null,null,null,null,null,null],["2022/ES/235","AEPD (Spain) - EXP202202937","gdprhub","Spain","ES","AEPD (Spain)","2022-08-26","day",null,null,null,"ABANCA CORPORACIÓN BANCARIA, S.A.",null,"Art. 12, Art. 15, Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/documento/pd-00104-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202937",null,"gdprhub",null,null,"abanca corporacion bancaria sa",null,null,null,null,null,null,null,null,null],["2022/ES/225","AEPD (Spain) - EXP202207084","gdprhub","Spain","ES","AEPD (Spain)","2022-08-26","day",null,null,null,null,null,"Art. 2(2)(c)",null,null,"Rejected","https://www.aepd.es/es/documento/ai-00276-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202207084",null,"gdprhub",null,"Businessman",null,null,null,null,null,"person",null,null,null,null],["2022/DK/029","Datatilsynet (Denmark) - 2021-431-0126","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-08-25","day",null,null,null,"KMD A/S",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/aug/alvorlig-kritik-utilsigtet-adgang-til-oplysninger-om-boern","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0126",null,"gdprhub",null,null,"kmd as",null,null,null,null,null,null,null,null,null],["2022/NO/019","Datatilsynet (Norway) - 21/02293","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-08-25","day",null,"200000","NOK","Recover AS",null,"Art. 24, Art. 58(2), Art. 58(2)(d), Art. 58(2)(i), Art. 6(1), Art. 6(1)(f), Art. 83","Accountability, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/99807c5955454e4ca2212da1f7a76281/21_02293-10-vedtak-om-palegg-og-overtredelsesgebyr---kredittvurdering-uten-rettslig-grunnlag---312121_12_2.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/02293",null,"gdprhub",null,null,"recover as",null,200000.0,20747,"day 2022-08-25|9.6400|NOK",null,null,null,null,null],["2022/ES/093","ETid-1374","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-25","day",480,null,"EUR","SERVICIOS PROFESIONALES LA PARADA S.L.","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00151-2022.pdf","https://www.enforcementtracker.com/ETid-1374",null,null,null,null,"servicios profesionales la parada sl",null,null,null,null,null,null,null,null,null],["2022/NO/001","ETid-1380","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2022-08-25","day",20000,null,"EUR","Recover AS","Industry and Commerce","Art. 6(1)(e)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2022/recover-as-far-overtredelsesgebyr/","https://www.enforcementtracker.com/ETid-1380",null,null,null,null,"recover as",null,null,null,null,null,null,null,null,null],["2022/HU/026","NAIH (Hungary) - NAIH-13-10/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-08-25","day",null,null,null,"Óbuda Family Counselling and Child Protection Centre",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=565:hozzaferesi-jog-gyakorlasanak-akadalyozasa-kozfeladatot-ellato-szerv-altal","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-13-10/2022",null,"gdprhub",null,null,"HU: obuda family counselling and child protection centre",null,null,null,null,null,null,null,null,null],["2022/BE/001","ETid-1655","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-08-23","day",2500,null,"EUR","Company","Industry and Commerce","Art. 24(1), Art. 5(1)(d), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://edpb.europa.eu/news/national-news/2022/fine-breaching-obligation-ensure-security-personal-data_en","https://www.enforcementtracker.com/ETid-1655",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/AT/001","ETid-1788","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2022-08-23","day",25000,null,"EUR","Operator of a public toilet",null,"Art. 13, Art. 6(1)(f)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20220823_2022_0_585_764_00/DSBT_20220823_2022_0_585_764_00.html","https://www.enforcementtracker.com/ETid-1788","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.585.764","gdprhub",null,null,"AT: operator of a public toilet",null,null,null,null,null,null,null,null,null],["2022/FI/022","Tietosuojavaltuutetun toimisto (Finland) - 6482/186/2020","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-08-23","day",null,null,null,null,null,"Art. 22, Art. 58(2)(a)","Data subject rights",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221544","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6482/186/2020",null,"gdprhub",null,"Healthcare provider",null,null,null,null,null,null,null,null,null,null],["2022/ES/098","ETid-1364","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-22","day",900,null,"EUR","UNONO NET 3.0, S.L.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00135-2022.pdf","https://www.enforcementtracker.com/ETid-1364",null,null,null,null,"ES: unono net 30sl",null,null,null,null,null,null,null,null,null],["2022/ES/097","ETid-1365","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-22","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00070-2022.pdf","https://www.enforcementtracker.com/ETid-1365",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/RO/023","ETid-1370","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-08-22","day",10000,null,"EUR","Enel Energie Muntenia S.A.","Transportation and Energy","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_22_08_2022&lang=ro","https://www.enforcementtracker.com/ETid-1370",null,null,null,null,"enel energie muntenia sa","Enel",null,null,null,null,null,null,null,null],["2022/FR/006","ETid-1361","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-08-19","day",600000,null,"EUR","ACCOR SA","Accommodation and Hospitality","Art. 12, Art. 13, Art. 15, Art. 21, Art. 32","Data security, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/prospection-commerciale-et-droits-des-personnes-sanction-de-600-000-euros-lencontre-daccor","https://www.enforcementtracker.com/ETid-1361","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-017","gdprhub",null,null,"accor sa",null,null,null,null,null,null,null,null,null],["2022/BE/002","ETid-1438","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-08-19","day",20000,null,"EUR","Medical laboratory","Health Care","Art. 12, Art. 13, Art. 14, Art. 32, Art. 5(1)(f)","Data principles, Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-127-2022.pdf","https://www.enforcementtracker.com/ETid-1438","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_127/2022","gdprhub",null,null,"BE: medical laboratory",null,null,null,null,null,null,null,null,null],["2022/FI/027","Tietosuojavaltuutetun toimisto (Finland) - 5546/163/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-08-19","day",null,null,null,null,null,"Art. 32(1), Art. 32(2), Art. 58(2)(b), Art. 9(1)","Data security, Special categories",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2022/20221563","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_5546/163/2019",null,"gdprhub",null,"Healthcare provider",null,null,null,null,null,null,null,null,null,null],["2022/LV/005","DVI (Latvia) - Cēsu novada Pašvaldības policijai","gdprhub","Latvia","LV","DVI (Latvia)","2022-08-18","day",null,null,null,null,null,"Art. 24(1), Art. 5, Art. 6","Accountability, Data principles, Unlawful processing",null,"Violation found","https://www.dvi.gov.lv/lv/lemumi","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_C%C4%93su_novada_Pa%C5%A1vald%C4%ABbas_policijai",null,"gdprhub",null,"Police office",null,null,null,null,null,null,null,null,null,null],["2022/ES/221","AEPD (Spain) - EXP202202000","gdprhub","Spain","ES","AEPD (Spain)","2022-08-16","day",null,null,null,"Google LLC",null,"Art. 17, Art. 17(3)(b)","Data subject rights",null,"Rejected","https://www.aepd.es/es/documento/pd-00081-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202202000",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/ES/102","ETid-1351","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-16","day",5000,null,"EUR","RODALI GESTIÓN INMOBILIARIA, S.L.","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00618-2021.pdf","https://www.enforcementtracker.com/ETid-1351","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202103039","gdprhub",null,null,"rodali gestion inmobiliaria sl",null,null,null,null,null,null,null,null,null],["2022/ES/103","ETid-1341","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-12","day",180,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00124-2022.pdf","https://www.enforcementtracker.com/ETid-1341",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DK/002","ETid-1330","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2022-08-11","day",6700,null,"EUR","Lolland municipiality","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/aug/lolland-kommune-indstilles-til-boede","https://www.enforcementtracker.com/ETid-1330","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_Lolland_Kommune","gdprhub",null,null,"DK: lolland municipiality",null,null,null,null,null,null,null,null,null],["2022/HU/011","ETid-1493","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-08-11","day",197000,null,"EUR","AMPLIFON Hungary Trade and Service Provider LLC","Industry and Commerce","Art. 12(1), Art. 14, Art. 5(1)(b), Art. 6(1)","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=573:kozvetlen-uzletszerzessel-kapcsolatos-adatkezeles-jogszerusege","https://www.enforcementtracker.com/ETid-1493",null,null,null,null,"amplifon hungary trade and service provider llc",null,null,null,null,null,null,null,null,null],["2022/HU/031","NAIH (Hungary) - NAIH-5802-9/2022.","gdprhub","Hungary","HU","NAIH (Hungary)","2022-08-11","day",200000,"200000","EUR","Amplifon Magyarország Kft.",null,"Art. 12(1), Art. 14, Art. 5(1)(a), Art. 5(1)(b), Art. 6(1)(a)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=573:kozvetlen-uzletszerzessel-kapcsolatos-adatkezeles-jogszerusege","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-5802-9/2022.",null,"gdprhub",null,null,"amplifon magyarorszag kft",null,null,null,null,null,null,null,null,null],["2022/DE/055","BlnBDI (Berlin) - 631.457.4 521.14765.10","gdprhub","Germany","DE","BlnBDI (Berlin)","2022-08-09","day",null,null,null,"Healy",null,"Art. 12(3), Art. 15(3), Art. 17(1), Art. 58(2)(b), Art. 6","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://edpb.europa.eu/system/files/2023-02/de_be_2022-08_decisionpublic_redacted.pdf","https://gdprhub.eu/index.php?title=BlnBDI_%28Berlin%29_-_631.457.4_521.14765.10",null,"gdprhub",null,null,"DE: healy",null,null,null,null,null,null,null,null,null],["2022/DK/025","Datatilsynet (Denmark) - 2021-31-5523","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-08-09","day",null,null,null,"TeeShoppen",null,"Art. 17, Art. 21","Data subject rights",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/aug/paabud-og-alvorlig-kritik-af-teeshoppen-for-ikke-at-have-slettet-personoplysninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5523",null,"gdprhub",null,null,"DK: teeshoppen",null,null,null,null,null,null,null,null,null],["2022/RO/025","ETid-1328","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-08-09","day",7000,null,"EUR","CDI Transport Intern și Internațional SRL","Transportation and Energy","Art. 12(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09.08.2022_1&lang=ro","https://www.enforcementtracker.com/ETid-1328",null,null,null,null,"cdi transport intern si international srl",null,null,null,null,null,null,null,null,null],["2022/RO/024","ETid-1331","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-08-09","day",1000,null,"EUR","Wabag Water Services SRL","Employment","Art. 5(1)(a), Art. 5(2), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09.08.2022&lang=ro","https://www.enforcementtracker.com/ETid-1331",null,null,null,null,"wabag water services srl",null,null,null,null,null,null,null,null,null],["2022/HU/030","NAIH (Hungary) - NAIH-6484-2-2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-08-09","day",1200,"1200","EUR","National Health Insurance Fund of Hungary",null,"Art. 12(3), Art. 12(4), Art. 15(1)","Data subject rights, Transparency",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=557:erintetti-jogok-biztositasanak-serelme-a-vakcina-regisztracio-lekerdezes-vakcinareg-neak-gov-hu-kapcsan","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-6484-2-2022",null,"gdprhub",null,null,"HU: national health insurance fund of hungary",null,null,null,null,null,null,null,null,null],["2022/DK/026","Datatilsynet (Denmark) - 2020-431-0115","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-08-08","day",null,null,null,"Fitness World A/S",null,"Art. 32(1), Art. 6(1)(f)","Data security, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/aug/tv-overvaagning-af-medarbejdere-levede-op-til-gdpr","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-431-0115",null,"gdprhub",null,null,"fitness world as",null,null,null,null,null,null,null,null,null],["2022/ES/107","ETid-1329","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-08","day",600,null,"EUR","Restaurant owner","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00617-2021.pdf","https://www.enforcementtracker.com/ETid-1329",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/106","ETid-1332","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-08","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00118-2022.pdf","https://www.enforcementtracker.com/ETid-1332",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/HU/015","ETid-1406","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-08-08","day",735,null,"EUR","Company","Industry and Commerce","Art. 5(2), Art. 6(1)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=554:hangfelvetel-keszitese-szerelesi-munkak-soran","https://www.enforcementtracker.com/ETid-1406",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/GR/008","ETid-1439","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-08-08","day",5000,null,"EUR","IDIKA SA","Industry and Commerce","Art. 25, Art. 5(1)(e)","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2022-08/41_2022%20anonym.pdf","https://www.enforcementtracker.com/ETid-1439",null,null,null,null,"idika sa",null,null,null,null,null,null,null,null,null],["2022/HU/025","NAIH (Hungary) - NAIH-2801-17-2022 (NAIH-8701/2021)","gdprhub","Hungary","HU","NAIH (Hungary)","2022-08-08","day",null,"300000","HUF",null,null,"Art. 13(1), Art. 13(2), Art. 5(1)(b), Art. 5(1)(c), Art. 5(2), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=554:hangfelvetel-keszitese-szerelesi-munkak-soran","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2801-17-2022_%28NAIH-8701/2021%29",null,"gdprhub",null,"Installation company",null,null,300000.0,761,"day 2022-08-08|394.2700|HUF",null,null,null,null,null],["2022/ES/104","ETid-1334","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-05","day",9000,null,"EUR","Prodesspa Decoratius i Pintures , S.L.","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00180-2022.pdf","https://www.enforcementtracker.com/ETid-1334",null,null,null,null,"prodesspa decoratius i pintures sl",null,null,null,null,null,null,null,null,null],["2022/IT/062","ETid-1442","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-08-05","day",20000,null,"EUR","Cosmopol Security S.p.A.","Industry and Commerce","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9811300","https://www.enforcementtracker.com/ETid-1442","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9811300","gdprhub",null,null,"cosmopol security spa",null,null,null,null,null,null,null,null,null],["2022/IT/052","ETid-1483","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-08-05","day",1000,null,"EUR","Colosseo S.r.l.","Industry and Commerce","Art. 12(3), Art. 15, Art. 17, Art. 21, Art. 24, Art. 5(2), Art. 6(1)(a)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9817535","https://www.enforcementtracker.com/ETid-1483","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9817535","gdprhub",null,null,"colosseo srl",null,null,null,null,null,null,null,null,null],["2022/IT/011","ETid-1646","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-08-05","day",1000,null,"EUR","Mister Brick S.a.s.","Industry and Commerce","Art. 12(3), Art. 15, Art. 24, Art. 5(2), Art. 6(1)(a)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9827135","https://www.enforcementtracker.com/ETid-1646",null,null,null,null,"mister brick sas",null,null,null,null,null,null,null,null,null],["2022/DE/054","BayLfD (Bavaria) - 221 C 578/22","gdprhub","Germany","DE","BayLfD (Bavaria)","2022-08-04","day",null,null,null,null,null,"Art. 32(1), Art. 82(1)","Data security",null,null,"https://rewis.io/urteile/urteil/zhw-04-08-2022-211-c-57822/?q=dsgvo","https://gdprhub.eu/index.php?title=BayLfD_%28Bavaria%29_-_221_C_578/22",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/026","ETid-1322","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-08-04","day",2000,null,"EUR","Sephora Cosmetics România SA","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_04_08_2022&lang=ro","https://www.enforcementtracker.com/ETid-1322",null,null,null,null,"sephora cosmetics romania sa",null,null,null,null,null,null,null,null,null],["2022/ES/110","ETid-1323","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-04","day",2000,null,"EUR","JAÉN SENTIDO Y COMÚN",null,"Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00622-2021.pdf","https://www.enforcementtracker.com/ETid-1323",null,null,null,null,"ES: jaen sentido y comun",null,null,null,null,null,null,null,null,null],["2022/ES/105","ETid-1333","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-03","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00086-2022.pdf","https://www.enforcementtracker.com/ETid-1333",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/GR/011","ETid-1362","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-08-03","day",30000,null,"EUR","Private Polyclinic and Diagnostic Centre of Pyle Axiou","Health Care","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-ti-mi-lipsi-katallilon-tehnikon-organotikon-metron","https://www.enforcementtracker.com/ETid-1362","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_36/2022","gdprhub",null,null,"GR: private polyclinic and diagnostic centre of pyle axiou",null,null,null,null,null,null,null,null,null],["2022/ES/111","ETid-1320","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-02","day",42000,null,"EUR","Banco Bilbao Vizcaya Argentaria S.L.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00142-2022.pdf","https://www.enforcementtracker.com/ETid-1320",null,null,null,null,"banco bilbao vizcaya argentaria sl","BBVA",null,null,null,null,null,null,null,null],["2022/NO/002","ETid-1321","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2022-08-02","day",30200,null,"EUR","Krokatjønnvegen 15 AS","Real Estate","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2022/gebyr-til-krokatjonnvegen-15-as/","https://www.enforcementtracker.com/ETid-1321","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02066","gdprhub",null,null,"krokatjnnvegen 15 as",null,null,null,null,null,null,null,null,null],["2022/ES/112","ETid-1319","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-01","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00613-2021.pdf","https://www.enforcementtracker.com/ETid-1319",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/108","ETid-1325","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-08-01","day",9600,null,"EUR","LAST LAP, S.L.","Industry and Commerce","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00105-2022.pdf","https://www.enforcementtracker.com/ETid-1325",null,null,null,null,"last lap sl",null,null,null,null,null,null,null,null,null],["2022/IT/074","ETid-1326","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-08-01","day",26000,null,"EUR","Policoro municipality","Public Sector and Education","Art. 12, Art. 13, Art. 24, Art. 38(6), Art. 5(2)","Accountability, Data principles, Data protection officer, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9794895","https://www.enforcementtracker.com/ETid-1326","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9794895","gdprhub",null,null,"IT: policoro municipality",null,null,null,null,null,null,null,null,null],["2022/ES/109","ETid-1324","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-29","day",3000,null,"EUR","ESTUDIOS EUROPEOS DE POSTGRADO Y EMPRESA, S.L.","Public Sector and Education","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00581-2021.pdf","https://www.enforcementtracker.com/ETid-1324",null,null,null,null,"estudios europeos de postgrado y empresa sl",null,null,null,null,null,null,null,null,null],["2022/DE/049","ETid-1313","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2022-07-28","day",900000,null,"EUR","Hannoversche Volksbank","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://lfd.niedersachsen.de/startseite/infothek/presseinformationen/900-000-euro-bussgeld-gegen-kreditinstitut-wegen-profilbildung-zu-werbezwecken-213925.html","https://www.enforcementtracker.com/ETid-1313",null,null,null,null,"DE: hannoversche volksbank",null,null,null,null,null,null,null,null,null],["2022/IT/069","ETid-1413","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-28","day",2000,null,"EUR","Auto Hi-Fi System S.n.c","Industry and Commerce","Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9809504","https://www.enforcementtracker.com/ETid-1413",null,null,null,null,"auto hi fi system snc",null,null,null,null,null,null,null,null,null],["2022/ES/116","ETid-1311","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-27","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00005-2022.pdf","https://www.enforcementtracker.com/ETid-1311",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2022/BE/029","APD/GBA (Belgium) - 117/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-07-26","day",null,null,null,null,null,"Art. 12(3), Art. 15, Art. 21(2), Art. 21(3), Art. 6(1)","Data subject rights, Transparency, Unlawful processing",null,"Other Outcome","https://www.gegevensbeschermingsautoriteit.be/publications/zonder-gevolg-nr.-117-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_117/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/FR/022","CNIL (France) - Unknown","gdprhub","France","FR","CNIL (France)","2022-07-26","day",null,null,null,null,null,"Art. 17, Art. 56(1), Art. 60","Data subject rights",null,"Other Outcome","https://edpb.europa.eu/system/files/2023-01/fr_2022-07_decisionpublic_redacted_2.pdf","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_Unknown",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/050","ETid-1305","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2022-07-26","day",1100000,null,"EUR","Volkswagen","Industry and Commerce","Art. 13, Art. 28, Art. 30, Art. 35","DPIA, Processor obligations, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://lfd.niedersachsen.de/startseite/infothek/presseinformationen/1-1-millionen-euro-bussgeld-gegen-volkswagen-213835.html","https://www.enforcementtracker.com/ETid-1305",null,null,null,null,"DE: volkswagen",null,null,null,null,null,null,null,null,null],["2022/ES/115","ETid-1312","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-26","day",15000,null,"EUR","TELEFÓNICA MÓVILES ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00017-2022.pdf","https://www.enforcementtracker.com/ETid-1312",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2022/ES/114","ETid-1314","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-26","day",2500,null,"EUR","Homeowners Association","Real Estate","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00486-2021.pdf","https://www.enforcementtracker.com/ETid-1314",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/113","ETid-1315","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-26","day",800,null,"EUR","EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L.","Industry and Commerce","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00290-2021.pdf","https://www.enforcementtracker.com/ETid-1315",null,null,null,null,"efs mantenimiento y servicios tecnicos sl",null,null,null,null,null,null,null,null,null],["2022/SE/006","IMY (Sweden) - DI-2022-2351/2372/2373/2374/2375","gdprhub","Sweden","SE","IMY (Sweden)","2022-07-26","day",null,null,null,"Google LLC",null,"Art. 12(2), Art. 17(1), Art. 21(1)","Data subject rights, Transparency",null,"Violation found","https://gdprhub.eu/images/b/bf/IMY_%28Sweden%29_-_DI-2022-23512372237323742375.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2022-2351/2372/2373/2374/2375",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/HR/016","AZOP (Croatia) - Decision 25-07-2022","gdprhub","Croatia","HR","AZOP (Croatia)","2022-07-25","day",null,"1.200,00","HRK",null,null,null,null,null,null,"https://sudskapraksa.vsrh.hr/decisionText?id=090216ba80d4845a&q=%2522op%25C4%2587a+uredba+o+za%25C5%25A1titi+podataka%2522","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_25-07-2022",null,"gdprhub",null,null,null,null,1200.0,160,"day 2022-07-25|7.5195|HRK",null,null,null,null,null],["2022/GR/028","HDPA (Greece) - 20/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-07-25","day",5000,"5.000","EUR","Mizuno Online Store",null,"Art. 12(3), Art. 17, Art. 21, Art. 83(2)(a)","Data subject rights, Transparency",null,null,"https://www.dpa.gr/sites/default/files/2022-07/20_2022%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_20/2022",null,"gdprhub",null,null,"GR: mizuno online store",null,null,null,null,null,null,null,null,null],["2022/ES/118","ETid-1304","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-22","day",40000,null,"EUR","ESVETEL, S.L.","Media, Telecoms and Broadcasting","Art. 28","Data subject rights, Processor obligations","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00394-2021.pdf","https://www.enforcementtracker.com/ETid-1304",null,null,null,null,"esvetel sl",null,null,null,null,null,null,null,null,null],["2022/ES/117","ETid-1308","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-22","day",500,null,"EUR","CINCON S.C.","Industry and Commerce","Art. 13(2)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00043-2022.pdf","https://www.enforcementtracker.com/ETid-1308",null,null,null,null,"cincon sc",null,null,null,null,null,null,null,null,null],["2022/LU/006","ETid-1657","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-07-22","day",10000,null,"EUR","Company",null,"Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2022/dcision-16fr-2022-sous-forme-anonymise.pdf","https://www.enforcementtracker.com/ETid-1657","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_16FR/2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/056","HBDI (Hesse) - 90.22.73:0051","gdprhub","Germany","DE","HBDI (Hesse)","2022-07-22","day",null,null,null,"paydirekt GmbH",null,"Art. 25(1), Art. 5(1), Art. 9(1)","Accountability, Data principles, Special categories",null,"Violation found","https://gdprhub.eu/images/4/42/2022_Ihre_Eingabe_Nr_C055_Redacted.pdf","https://gdprhub.eu/index.php?title=HBDI_%28Hesse%29_-_90.22.73%3A0051",null,"gdprhub",null,null,"paydirekt gmbh",null,null,null,null,null,null,null,null,null],["2022/HR/012","ETid-1292","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-07-21","day",4000,null,"EUR","Car dealership","Industry and Commerce",null,"Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izrecene-dvije-upravne-novcane-kazne-u-ukupnom-iznosu-218-milijuna-kuna/","https://www.enforcementtracker.com/ETid-1292",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HR/011","ETid-1293","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-07-21","day",285000,null,"EUR","Telecommunications company","Media, Telecoms and Broadcasting","Art. 25(1), Art. 32(1)(b), Art. 32(2)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izrecene-dvije-upravne-novcane-kazne-u-ukupnom-iznosu-218-milijuna-kuna/","https://www.enforcementtracker.com/ETid-1293",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IT/068","ETid-1414","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-21","day",2000,null,"EUR","Global Service s.r.l.","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9810045","https://www.enforcementtracker.com/ETid-1414",null,null,null,null,"global service srl",null,null,null,null,null,null,null,null,null],["2022/IT/067","ETid-1415","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-21","day",10000,null,"EUR","Stay over s.r.l.","Industry and Commerce","Art. 12, Art. 13, Art. 15, Art. 5","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9809466","https://www.enforcementtracker.com/ETid-1415",null,null,null,null,"stay over srl",null,null,null,null,null,null,null,null,null],["2022/IT/066","ETid-1416","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-21","day",3000,null,"EUR","Azienda Socio Sanitaria Territoriale Rhodense","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9809520","https://www.enforcementtracker.com/ETid-1416",null,null,null,null,"IT: azienda socio sanitaria territoriale rhodense",null,null,null,null,null,null,null,null,null],["2022/IT/057","ETid-1463","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-21","day",10000,null,"EUR","Clio S.r.l.","Industry and Commerce","Art. 30(2), Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9811271","https://www.enforcementtracker.com/ETid-1463",null,null,null,null,"clio srl",null,null,null,null,null,null,null,null,null],["2022/IT/056","ETid-1464","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-21","day",5000,null,"EUR","Ginosa municipality","Public Sector and Education","Art. 28, Art. 5(1)(a), Art. 6","Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9811732","https://www.enforcementtracker.com/ETid-1464",null,null,null,null,"IT: ginosa municipality",null,null,null,null,null,null,null,null,null],["2022/IT/055","ETid-1465","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-21","day",20000,null,"EUR","Acqua Novara.VCO S.p.a.","Transportation and Energy","Art. 28, Art. 5(1)(a), Art. 6","Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9813326","https://www.enforcementtracker.com/ETid-1465",null,null,null,null,"acqua novara vco spa",null,null,null,null,null,null,null,null,null],["2022/IT/156","Garante per la protezione dei dati personali (Italy) - 9808698","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-07-21","day",null,null,null,"Fastweb S.p.A.",null,"Art. 13(1)(f), Art. 24, Art. 40, Art. 46, Art. 5(2)","Accountability, Data principles, International transfers, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9808698","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9808698",null,"gdprhub",null,null,"fastweb spa",null,null,null,null,null,null,null,null,null],["2022/GR/035","HDPA (Greece) - 38/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-07-21","day",150000,"150.000","EUR","Vodafone",null,"Art. 4, Art. 5, Art. 51, Art. 55","Data principles",null,"Violation found","https://www.dpa.gr/sites/default/files/2022-12/38_2022%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_38/2022","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_39/2022","gdprhub",null,null,"GR: vodafone","Vodafone",null,null,null,null,null,null,null,null],["2022/FI/020","Tietosuojavaltuutetun toimisto (Finland) - 7587/163/20","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-07-20","day",null,null,null,null,null,"Art. 12(3), Art. 12(4), Art. 17(1)(a)","Data subject rights, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221524","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_7587/163/20",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2022/BE/030","APD/GBA (Belgium) - 115/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-07-19","day",null,null,null,null,null,"Art. 5(1)(c), Art. 6(1), Art. 6(4), Art. 9(2), Art. 9(4)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-115-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_115/2022",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2022/ES/123","ETid-1284","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-19","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00007-2022.pdf","https://www.enforcementtracker.com/ETid-1284",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/122","ETid-1285","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-19","day",5000,null,"EUR","Bar owner","Accommodation and Hospitality","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00580-2021.pdf","https://www.enforcementtracker.com/ETid-1285","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202204515","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/121","ETid-1286","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-19","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00450-2021.pdf","https://www.enforcementtracker.com/ETid-1286",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/120","ETid-1287","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-19","day",4000,null,"EUR","Bookstore employee","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00422-2021.pdf","https://www.enforcementtracker.com/ETid-1287",null,null,null,null,"ES: bookstore employee",null,null,null,null,null,null,null,null,null],["2022/GR/010","ETid-1363","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-07-19","day",20000,null,"EUR","DO VALUE GREECE LOANS & CREDITS CLAIM MANAGEMENT S.A.","Finance, Insurance and Consulting","Art. 12(2), Art. 5(1)(a), Art. 5(2), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-dioikitikoy-prostimoy-gia-paranomi-epexergasia-prosopikon","https://www.enforcementtracker.com/ETid-1363","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_53/2022","gdprhub",null,null,"do value greece loans and credits claim management sa",null,null,null,null,null,null,null,null,null],["2022/ES/119","ETid-1288","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-18","day",56000,null,"EUR","BANKINTER, S.A.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00421-2021.pdf","https://www.enforcementtracker.com/ETid-1288",null,null,null,null,"bankinter sa",null,null,null,null,null,null,null,null,null],["2022/DK/042","Datatilsynet (Denmark) - 2022-441-12449","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-07-15","day",null,null,null,"Salling Group",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jul/alvorlig-kritik-af-salling-group-for-at-opbevare-passwords-i-klartekst","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2022-441-12449",null,"gdprhub",null,null,"DK: salling group",null,null,null,null,null,null,null,null,null],["2022/ES/101","ETid-1355","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-15","day",3600,null,"EUR","ECOZONO Y CULTURA, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00400-2021.pdf","https://www.enforcementtracker.com/ETid-1355",null,null,null,null,"ecozono y cultura sl",null,null,null,null,null,null,null,null,null],["2022/ES/077","ETid-1397","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-15","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00600-2021.pdf","https://www.enforcementtracker.com/ETid-1397",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DK/003","ETid-1270","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2022-07-14","day",67200,null,"EUR","SIRIUS (law firm)","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/jul/sirius-advokater-indstilles-til-boede","https://www.enforcementtracker.com/ETid-1270",null,null,null,null,"DK: sirius",null,null,null,null,null,null,null,null,null],["2022/GR/012","ETid-1268","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-07-13","day",20000000,null,"EUR","Clearview Al Inc.","Industry and Commerce","Art. 12, Art. 14, Art. 15, Art. 27, Art. 5(1)(a), Art. 6, Art. 9","Data principles, Data subject rights, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-stin-etaireia-clearview-ai-inc","https://www.enforcementtracker.com/ETid-1268","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_35/2022","gdprhub",null,null,"clearview al inc","Clearview AI",null,null,null,null,null,null,null,null],["2022/ES/124","ETid-1283","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-13","day",132000,null,"EUR","DKV Seguros y Reaseguros, S.A.E.","Finance, Insurance and Consulting","Art. 32, Art. 33, Art. 5(1)(f)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00080-2022.pdf","https://www.enforcementtracker.com/ETid-1283",null,null,null,null,"ES: dkv seguros y reaseguros sae",null,null,null,null,null,null,null,null,null],["2022/IM/001","ETid-1352","cms_tracker","Isle of Man","IM","Information Commissioner of Isle of Man","2022-07-13","day",202000,null,"EUR","Manx Care Ltd","Health Care","Art. 24, Art. 25, Art. 32, Art. 34, Art. 5(2), Art. 58","Accountability, Data breach, Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.inforights.im/media/2021/manx_care_penalty_notice_13july2022_web.pdf","https://www.enforcementtracker.com/ETid-1352",null,null,null,null,"manx care ltd",null,null,null,null,null,null,null,null,null],["2022/ES/100","ETid-1356","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-12","day",6000,null,"EUR","FREE SUN ENERGY S.L.","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00089-2022.pdf","https://www.enforcementtracker.com/ETid-1356",null,null,null,null,"free sun energy sl",null,null,null,null,null,null,null,null,null],["2022/ES/099","ETid-1357","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-12","day",1600,null,"EUR","JOYPAZAR, S.A.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00094-2022.pdf","https://www.enforcementtracker.com/ETid-1357",null,null,null,null,"joypazar sa",null,null,null,null,null,null,null,null,null],["2022/ES/096","ETid-1366","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-12","day",800,null,"EUR","SMART ELECTRIC SOLUTIONS, S.L.","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00053-2022.pdf","https://www.enforcementtracker.com/ETid-1366",null,null,null,null,"smart electric solutions sl",null,null,null,null,null,null,null,null,null],["2022/HU/028","NAIH (Hungary) - NAIH-1091-10/2022 (NAIH-6936/2021)","gdprhub","Hungary","HU","NAIH (Hungary)","2022-07-11","day",null,"500.000","HUF","Infotv",null,"Art. 12(1), Art. 12(2), Art. 12(3), Art. 12(4), Art. 15(1), Art. 17(1), Art. 5(2), Art. 6(1), Art. 7(1)","Consent, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek/file/590-hirlevekkel-kapcsolatos-adatkezeles","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-1091-10/2022_%28NAIH-6936/2021%29",null,"gdprhub",null,null,"HU: infotv",null,500000.0,1225,"day 2022-07-11|408.2200|HUF",null,null,null,null,null],["2022/HU/012","ETid-1443","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-07-08","day",1500,null,"EUR","Physician","Health Care","Art. 12(2), Art. 13(1), Art. 5(1)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=570:egeszsegugyi-dokumentacio-masolatanak-kiadasa","https://www.enforcementtracker.com/ETid-1443",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LV/004","DVI (Latvia) - SIA “DEPO DIY”","gdprhub","Latvia","LV","DVI (Latvia)","2022-07-07","day",17495,"17,495","EUR","depo-diy",null,"Art. 5, Art. 5(1)(c), Art. 6(1)(a), Art. 6(1)(c), Art. 83(5)","Data principles, Unlawful processing",null,null,"https://www.dvi.gov.lv/lv/media/2024/download","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_%E2%80%9CDEPO_DIY%E2%80%9D",null,"gdprhub",null,null,"LV: depo diy",null,null,null,null,null,null,null,null,null],["2022/DK/024","Datatilsynet (Denmark) - 2021-431-0144","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-07-07","day",null,null,null,"EG Digital Welfare ApS",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jul/datatilsynet-udtaler-kritik-og-giver-to-paabud-til-eg-digital-welfare-aps","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0144",null,"gdprhub",null,null,"eg digital welfare aps",null,null,null,null,null,null,null,null,null],["2022/FR/007","ETid-1318","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-07-07","day",175000,null,"EUR","UBEEQO INTERNATIONAL","Transportation and Energy","Art. 12","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046070924?init=true&page=1&query=%2A&searchField=ALL&tab_selection=cnil","https://www.enforcementtracker.com/ETid-1318",null,null,null,null,"FR: ubeeqo international",null,null,null,null,null,null,null,null,null],["2022/ES/095","ETid-1367","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-07","day",1800,null,"EUR","FINCAS ARENYS SL","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00029-2022.pdf","https://www.enforcementtracker.com/ETid-1367",null,null,null,null,"fincas arenys sl",null,null,null,null,null,null,null,null,null],["2022/RO/022","ETid-1371","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-07-07","day",4000,null,"EUR","E Software Concept SRL","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07_07_2022_02&lang=ro","https://www.enforcementtracker.com/ETid-1371",null,null,null,null,"e software concept srl",null,null,null,null,null,null,null,null,null],["2022/IT/064","ETid-1424","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-07","day",45000,null,"EUR","Senseonics Inc.","Health Care","Art. 12, Art. 13, Art. 27, Art. 6, Art. 7, Art. 9","Consent, Data principles, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9809998","https://www.enforcementtracker.com/ETid-1424",null,null,null,null,"senseonics inc",null,null,null,null,null,null,null,null,null],["2022/IT/061","ETid-1445","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-07-07","day",20000,null,"EUR","Intesa Sanpaolo Vita S.p.a.","Finance, Insurance and Consulting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9809201","https://www.enforcementtracker.com/ETid-1445",null,null,null,null,"intesa sanpaolo vita spa","Intesa Sanpaolo",null,null,null,null,null,null,null,null],["2022/IT/147","Garante per la protezione dei dati personali (Italy) - 9788429","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-07-07","day",null,null,null,"TikTok",null,null,null,null,"Other Outcome","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9788429","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9788429",null,"gdprhub",null,null,"IT: tiktok","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2022/ES/128","ETid-1260","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-06","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00611-2021.pdf","https://www.enforcementtracker.com/ETid-1260",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/ES/126","ETid-1262","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-06","day",3000,null,"EUR","ASOCIACIÓN DE AFICIONADOS Y PEQUEÑOS ACCIONISTAS UNIDAD HERCULANA","Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00609-2021.pdf","https://www.enforcementtracker.com/ETid-1262","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202102088","gdprhub",null,null,"ES: asociacion de aficionados y pequenos accionistas unidad herculana",null,null,null,null,null,null,null,null,null],["2022/PL/009","ETid-1269","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-07-06","day",12450,null,"EUR","Głównego Geodetę Kraju","Public Sector and Education","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.27.2022","https://www.enforcementtracker.com/ETid-1269","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN._5131.27.2022","gdprhub",null,null,"PL: gownego geodete kraju",null,null,null,null,null,null,null,null,null],["2022/PL/008","ETid-1317","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-07-06","day",2120,null,"EUR","University Hospital of the Medical University of Warsaw","Health Care","Art. 33, Art. 34","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.34.2021","https://www.enforcementtracker.com/ETid-1317","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.34.2021","gdprhub",null,null,"PL: university hospital of the medical university of warsaw",null,null,null,null,null,null,null,null,null],["2022/ES/127","ETid-1261","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-05","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00627-2021.pdf","https://www.enforcementtracker.com/ETid-1261",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/HR/018","AZOP (Croatia) - Decision 04-07-2022","gdprhub","Croatia","HR","AZOP (Croatia)","2022-07-04","day",null,null,null,null,null,"Art. 57(1), Art. 58(1), Art. 6(1)","Unlawful processing",null,"Violation found","https://azop.hr/wp-content/uploads/2022/12/Rjesenje_zabrana-snimanja-javne-povrsine.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_04-07-2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/130","ETid-1252","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-01","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00593-2021.pdf","https://www.enforcementtracker.com/ETid-1252",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/125","ETid-1272","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-07-01","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00630-2021.pdf","https://www.enforcementtracker.com/ETid-1272",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/RO/027","ETid-1248","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-06-30","day",2000,null,"EUR","Continental Automotive Romania SRL","Industry and Commerce","Art. 24, Art. 32(1)(d)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_30_06_2022&lang=ro","https://www.enforcementtracker.com/ETid-1248",null,null,null,null,"continental automotive romania srl",null,null,null,null,null,null,null,null,null],["2022/LU/010","ETid-1307","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-06-30","day",1400,null,"EUR","Company",null,"Art. 13, Art. 5(1)(e)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2022/decision-13fr-2022-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1307",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LU/009","ETid-1309","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-06-30","day",1000,null,"EUR","Company",null,"Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2022/decision-15fr-2022-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1309",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LU/008","ETid-1310","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-06-30","day",1000,null,"EUR","Company",null,"Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2022/decision-14fr-2022-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1310",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IT/071","ETid-1389","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-06-30","day",5000,null,"EUR","Federazione Italiana Sommelier, Albergatori e Ristoratori","Individuals and Private Associations","Art. 6(1)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9803345","https://www.enforcementtracker.com/ETid-1389","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9803345","gdprhub",null,null,"IT: federazione italiana sommelier albergatori e ristoratori",null,null,null,null,null,null,null,null,null],["2022/IT/151","Garante per la protezione dei dati personali (Italy) - 9791886","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-06-30","day",null,null,null,"Azienda Ospedaliera Universitaria Integrata di Verona",null,"Art. 35, Art. 36","DPIA",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9791886","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9791886",null,"gdprhub",null,null,"IT: azienda ospedaliera universitaria integrata di verona",null,null,null,null,null,null,null,null,null],["2022/HR/015","AZOP (Croatia) - Decision 29-06-2022 (Center for Social Welfare)","gdprhub","Croatia","HR","AZOP (Croatia)","2022-06-29","day",null,null,null,"Centre for Social Welfare",null,"Art. 5, Art. 6","Data principles, Unlawful processing",null,"Violation found","https://azop.hr/wp-content/uploads/2022/09/RJESENJE-objava-godisnjeg-na-oglasnoj-ploci-centra.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_29-06-2022_%28Center_for_Social_Welfare%29",null,"gdprhub",null,null,"HR: centre for social welfare",null,null,null,null,null,null,null,null,null],["2022/GR/015","ETid-1251","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-06-29","day",3000,null,"EUR","Pediatric psychologist","Health Care","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dpa.gr/sites/default/files/2022-07/28_2022%20anonym.pdf","https://www.enforcementtracker.com/ETid-1251","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_28/2022","gdprhub",null,null,"GR: pediatric psychologist",null,null,null,null,null,null,null,null,null],["2022/IS/007","Persónuvernd (Iceland) - 2020061979","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-06-29","day",null,null,null,"Íslensk erfðagreining",null,"Art. 38, Art. 39","Data protection officer",null,"Violation found","https://www.personuvernd.is/urlausnir/akvordun-um-stodu-personuverndarfulltrua-islenskrar-erfdagreiningar-ehf","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020061979",null,"gdprhub",null,null,"IS: islensk erfagreining",null,null,null,null,null,null,null,null,null],["2022/ES/134","ETid-1245","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-28","day",1000,null,"EUR","Company","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00565-2021.pdf","https://www.enforcementtracker.com/ETid-1245",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/131","ETid-1249","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-28","day",3000,null,"EUR","FLY FUT, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00313-2021.pdf","https://www.enforcementtracker.com/ETid-1249",null,null,null,null,"fly fut sl",null,null,null,null,null,null,null,null,null],["2022/GR/040","HDPA (Greece) - 24/2023","gdprhub","Greece","GR","HDPA (Greece)","2022-06-28","day",null,null,null,"Infinity Pack",null,"Art. 5(1)","Data principles",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/apostoli-proothitikon-minymaton-e-mail-horis-proigoymeni-sygkatathesi","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_24/2023",null,"gdprhub",null,null,"GR: infinity pack",null,null,null,null,null,null,null,null,null],["2022/DK/032","Datatilsynet (Denmark) - 2021-31-5085","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-06-27","day",null,null,null,null,null,"Art. 12(5)(b)","Transparency",null,"Rejected","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jun/virksomhed-var-ikke-forpligtet-til-at-gennemgaa-omfattende-materiale-i-forbindelse-med-en-anmodning-om-indsigt","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5085",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DK/023","Datatilsynet (Denmark) - 2021-441-10244","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-06-27","day",null,null,null,"LB Forsikring A/S",null,"Art. 25(1), Art. 32(1)","Accountability, Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jun/alvorlig-kritik-manglende-overholdelse-af-princippet-om-databeskyttelse-gen-nem-design-hos-lb-forsikring-as","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-441-10244",null,"gdprhub",null,null,"lb forsikring as",null,null,null,null,null,null,null,null,null],["2022/SE/013","IMY (Sweden) - DI-2020-10696","gdprhub","Sweden","SE","IMY (Sweden)","2022-06-27","day",null,null,null,"Nordax Bank AB",null,"Art. 12(3), Art. 12(6), Art. 15, Art. 17, Art. 58(2)(c), Art. 58(2)(d)","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2023-01/se_2022-06_decisionpublic_redacted_1.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-10696",null,"gdprhub",null,null,"nordax bank ab",null,null,null,null,null,null,null,null,null],["2022/ES/135","ETid-1240","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-24","day",180,null,"EUR","Store owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00052-2022.pdf","https://www.enforcementtracker.com/ETid-1240",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/GR/014","ETid-1255","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-06-24","day",2000,null,"EUR","Parliamentary election candidate","Public Sector and Education","Art. 12","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-paranomi-epexergasia-prosopikon-dedomenon-pros-ton","https://www.enforcementtracker.com/ETid-1255",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/133","ETid-1246","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-23","day",30000,null,"EUR","CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00192-2022.pdf","https://www.enforcementtracker.com/ETid-1246","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00192/2022","gdprhub",null,null,"corporacion de radio y television espanola sa",null,null,null,null,null,null,null,null,null],["2022/ES/132","ETid-1247","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-23","day",30000,null,"EUR","RADIO TELEVISION MADRID, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00198-2022.pdf","https://www.enforcementtracker.com/ETid-1247",null,null,null,null,"radio television madrid sa",null,null,null,null,null,null,null,null,null],["2022/FR/008","ETid-1263","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-06-23","day",1000000,null,"EUR","TotalEnergies Electricité et Gaz France","Transportation and Energy","Art. 14, Art. 15, Art. 21","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/prospection-commerciale-et-droits-des-personnes-sanction-de-1-million-deuros-lencontre-de","https://www.enforcementtracker.com/ETid-1263",null,null,null,null,"FR: totalenergies electricite et gaz france",null,null,null,null,null,null,null,null,null],["2022/FI/010","Tietosuojavaltuutetun toimisto (Finland) - 3895/83/22","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-06-23","day",null,null,null,null,null,"Art. 22(1), Art. 58(2)(a), Art. 6(1), Art. 9, Art. 9(3)","Data subject rights, Special categories, Unlawful processing",null,null,"https://finlex.fi/fi/viranomaiset/tsv/2022/20221545","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3895/83/22",null,"gdprhub",null,"Healthcare provider",null,null,null,null,null,null,null,null,null,null],["2022/DK/022","Datatilsynet (Denmark) - 2021-441-9489","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-06-22","day",null,null,null,"Designbysi",null,"Art. 32(1)","Data security",null,null,"https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jun/datatilsynet-har-udtalt-alvorlig-kritik-af-at-designbysi-ikke-har-levet-op-til-kravet-om-fornoedne-sikkerhedsforanstaltninger-i-gdpr","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-441-9489",null,"gdprhub",null,null,"DK: designbysi",null,null,null,null,null,null,null,null,null],["2022/DK/040","Datatilsynet (Denmark) - 2021-442-14071","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-06-22","day",null,null,null,"The Danish Health Data Authority",null,"Art. 32(1), Art. 33(1)","Data breach, Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jun/alvorlig-kritik-af-sundhedsdatastyrelsen-for-utilsigtede-aendringer-i-det-faelles-medicinkort","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-442-14071",null,"gdprhub",null,null,"DK: the danish health data authority",null,null,null,null,null,null,null,null,null],["2022/DK/004","ETid-1241","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2022-06-22","day",134000,null,"EUR","Gyldendal A/S","Media, Telecoms and Broadcasting","Art. 5(1)(e)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/jun/gyldendal-indstilles-til-boede","https://www.enforcementtracker.com/ETid-1241",null,null,null,null,"gyldendal as",null,null,null,null,null,null,null,null,null],["2022/LU/011","ETid-1306","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-06-22","day",3000,null,"EUR","Company","Employment","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2022/decision-12fr-2022-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1306",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/003","ETid-2275","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-22","day",1600,null,"EUR","URQUÍA & BAS, CORREDURÍA DE SEGUROS S.L.","Finance, Insurance and Consulting","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.aepd.es/documento/ps-00035-2022.pdf","https://www.enforcementtracker.com/ETid-2275",null,null,null,null,"urquia and bas correduria de seguros sl",null,null,null,null,null,null,null,null,null],["2022/DK/027","Datatilsynet (Denmark) - 2021-31-5743","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-06-20","day",null,null,null,"Elgiganten A/S",null,"Art. 32(1), Art. 4(12)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jun/datatilsynet-udtaler-alvorlig-kritik-af-elgiganten-as","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5743",null,"gdprhub",null,null,"elgiganten as",null,null,null,null,null,null,null,null,null],["2022/RO/029","ETid-1238","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-06-20","day",1000,null,"EUR","SC Interactions Marketing SRL","Industry and Commerce","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20_06_2022_1&lang=ro","https://www.enforcementtracker.com/ETid-1238",null,null,null,null,"interactions marketing srl",null,null,null,null,null,null,null,null,null],["2022/RO/028","ETid-1239","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-06-20","day",7000,null,"EUR","Asociația de Proprietari Aviației Park","Real Estate","Art. 5(2), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20_06_2022_2&lang=ro","https://www.enforcementtracker.com/ETid-1239",null,null,null,null,"RO: asociatia de proprietari aviatiei park",null,null,null,null,null,null,null,null,null],["2022/GR/013","ETid-1256","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-06-20","day",2000,null,"EUR","WIND Ελλάς Τηλεπικοινωνίες ΑΕΒΕ","Media, Telecoms and Broadcasting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-mi-ikanopoiisi-dikaiomatos-prosbasis-0","https://www.enforcementtracker.com/ETid-1256",null,null,null,null,"GR: wind",null,null,null,null,null,null,null,null,null],["2022/IS/010","Persónuvernd (Iceland) - 2022020332 and 2021112244","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-06-20","day",null,null,null,"Íslandspóstur",null,"Art. 2(1)",null,null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-islandsposts-ohf","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2022020332_and_2021112244",null,"gdprhub",null,null,"IS: islandspostur",null,null,null,null,null,null,null,null,null],["2022/BE/028","APD/GBA (Belgium) - 105/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-06-17","day",null,null,null,"FOD Financiën",null,"Art. 2(1), Art. 4(1), Art. 4(6), Art. 55(3), Art. 57(1)(a), Art. 57(1)(f), Art. 57(1)(v)",null,null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-105-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_105/2022",null,"gdprhub",null,null,"BE: fod financien",null,null,null,null,null,null,null,null,null],["2022/ES/136","ETid-1237","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-17","day",1000,null,"EUR","Company","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00585-2021.pdf","https://www.enforcementtracker.com/ETid-1237",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/027","APD/GBA (Belgium) - 104/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-06-16","day",null,null,null,"De Tijd",null,"Art. 17(1)(c), Art. 17(3)(a), Art. 89","Data subject rights",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-104-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_104/2022",null,"gdprhub",null,null,"BE: de tijd",null,null,null,null,null,null,null,null,null],["2022/BE/003","ETid-1233","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-06-16","day",null,null,"EUR","SA Rossel & Cie","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13, Art. 14, Art. 6(1)(a), Art. 7(1)","Consent, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-103-2022.pdf","https://www.enforcementtracker.com/ETid-1233",null,null,null,null,"sa rossel and cie",null,null,null,null,null,null,null,null,null],["2022/ES/137","ETid-1236","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-16","day",1000,null,"EUR","SCOTCH CORNER BAR","Accommodation and Hospitality","Art. 5(1)(c), Art. 58(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00025-2022.pdf","https://www.enforcementtracker.com/ETid-1236",null,null,null,null,"ES: scotch corner bar",null,null,null,null,null,null,null,null,null],["2022/IT/072","ETid-1369","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-06-16","day",70000,null,"EUR","Unicredit S.p.A.","Employment","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9795350","https://www.enforcementtracker.com/ETid-1369","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9795350","gdprhub",null,null,"unicredit spa","UniCredit",null,null,null,null,null,null,null,null],["2022/IT/070","ETid-1390","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-06-16","day",2000,null,"EUR","Federazione Italiana Nuoto","Individuals and Private Associations","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9803309","https://www.enforcementtracker.com/ETid-1390",null,null,null,null,"IT: federazione italiana nuoto",null,null,null,null,null,null,null,null,null],["2022/IT/053","ETid-1473","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-06-16","day",20000,null,"EUR","Deutsche Bank S.p.A.","Finance, Insurance and Consulting","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9795404","https://www.enforcementtracker.com/ETid-1473","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9795404","gdprhub",null,null,"deutsche bank spa",null,null,null,null,null,null,null,null,null],["2022/IT/150","Garante per la protezione dei dati personali (Italy) - 9793921","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-06-16","day",null,null,null,"Google LLC",null,"Art. 17(1)(c)","Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9793921","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9793921",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/AT/012","DSB (Austria) - DSB-D770.1336","gdprhub","Austria","AT","DSB (Austria)","2022-06-15","day",null,null,null,null,null,"Art. 6(1)(e)","Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220615_2022_0_432_117_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D770.1336",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/030","ETid-1230","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-06-15","day",3000,null,"EUR","S.C. Wine Point S.R.L.","Industry and Commerce","Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15_06_2022&lang=ro","https://www.enforcementtracker.com/ETid-1230",null,null,null,null,"wine point srl",null,null,null,null,null,null,null,null,null],["2022/NO/017","Datatilsynet (Norway) - 21/02455","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-06-14","day",null,null,null,"Shinigami Eyes",null,"Art. 12(2), Art. 14, Art. 3(2)(b), Art. 6(1), Art. 6(1)(f)","Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2022/vedtak-om-forbud-mot-shinigami-eyes-i-norge/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/02455",null,"gdprhub",null,null,"NO: shinigami eyes",null,null,null,null,null,null,null,null,null],["2022/SE/014","IMY (Sweden) - DI-2021-10448,","gdprhub","Sweden","SE","IMY (Sweden)","2022-06-14","day",null,null,null,"Klarna Bank",null,"Art. 15, Art. 58(2)(b)","Data subject rights",null,"Violation found","https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-article-60-final-decisions_en?page=0","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-10448%2C",null,"gdprhub",null,null,"klarna bank ab","Klarna",null,null,null,null,null,null,null,null],["2022/DK/035","Datatilsynet (Denmark) - 2021-442-12980","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-06-13","day",null,null,null,"Danske Bank",null,"Art. 32(1)","Data security",null,null,"https://edpb.europa.eu/system/files/2023-01/dk_2022-06_decisionpublic_redacted.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-442-12980",null,"gdprhub",null,null,"DK: danske bank",null,null,null,null,null,null,null,null,null],["2022/AT/015","DSB (Austria) - 2021-0.643.804","gdprhub","Austria","AT","DSB (Austria)","2022-06-09","day",null,null,null,"Bezirksgericht N",null,"Art. 55(3), Art. 6(1)(c), Art. 6(1)(e)","Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220609_2021_0_643_804_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.643.804",null,"gdprhub",null,null,"AT: bezirksgericht n",null,null,null,null,null,null,null,null,null],["2022/ES/139","ETid-1226","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-09","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00591-2021.pdf","https://www.enforcementtracker.com/ETid-1226",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/138","ETid-1231","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-09","day",10000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00327-2021.pdf","https://www.enforcementtracker.com/ETid-1231",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/GB/003","ETid-1250","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2022-06-09","day",91000,null,"EUR","Tavistock & Portman NHS Foundation Trust","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media/action-weve-taken/mpns/4020812/the-tavistock-portman-nhs-foundation-trust-mpn.pdf","https://www.enforcementtracker.com/ETid-1250",null,null,null,null,"GB: tavistock and portman nhs foundation trust",null,null,null,null,null,null,null,null,null],["2022/IT/073","ETid-1368","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-06-09","day",10000,null,"EUR","Cribis Credit Management s.r.l.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9794913","https://www.enforcementtracker.com/ETid-1368",null,null,null,null,"cribis credit management srl",null,null,null,null,null,null,null,null,null],["2022/IT/145","Garante per la protezione dei dati personali (Italy) - 9782890","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-06-09","day",null,null,null,null,null,"Art. 13(1)(f), Art. 24, Art. 44, Art. 46, Art. 5(1)(a), Art. 5(2)","Accountability, Data principles, International transfers, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9782890","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9782890",null,"gdprhub",null,"Website operator",null,null,null,null,null,null,null,null,null,null],["2022/IT/159","Garante per la protezione dei dati personali (Italy) - 9789037","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-06-09","day",null,null,null,"Il Comune di Brindisi",null,"Art. 4(1), Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(e), Art. 6(2), Art. 6(3)","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9789037","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9789037",null,"gdprhub",null,null,"IT: il comune di brindisi",null,null,null,null,null,null,null,null,null],["2022/IT/149","Garante per la protezione dei dati personali (Italy) - 9789124","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-06-09","day",null,null,null,"Google LLC",null,"Art. 17(1)(c), Art. 21(1)","Data subject rights",null,"Rejected","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9789124","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9789124",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/AT/007","DSB (Austria) - 2022-0.332.606","gdprhub","Austria","AT","DSB (Austria)","2022-06-08","day",null,null,null,null,null,"Art. 2(2)(c), Art. 5(1)(a)","Data principles",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220608_2022_0_332_606_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.332.606",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/031","ETid-1201","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-06-08","day",1500,null,"EUR","Wens Experience SRL","Industry and Commerce","Art. 28(2)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08_06_2022&lang=ro","https://www.enforcementtracker.com/ETid-1201",null,null,null,null,"wens experience srl",null,null,null,null,null,null,null,null,null],["2022/FI/012","Tietosuojavaltuutetun toimisto (Finland) - 3216/452/17","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-06-08","day",null,null,null,"LähiTapiola Keskinäinen Henkivakuutusyhtiö",null,"Art. 25(2), Art. 5(1)(a), Art. 5(1)(c), Art. 58(2)(d), Art. 9, Art. 9(1), Art. 9(2)(a), Art. 9(2)(g)","Accountability, Data principles, Special categories",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2022/20221484","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3216/452/17",null,"gdprhub",null,null,"FI: lahitapiola keskinainen henkivakuutusyhtio",null,null,null,null,null,null,null,null,null],["2022/FI/028","Tietosuojavaltuutetun toimisto (Finland) - 4680/182/18","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-06-08","day",null,null,null,"OP-Henkivakuutus Oy",null,"Art. 58(2)(d), Art. 9, Art. 9(1), Art. 9(2)(a), Art. 9(2)(g)","Special categories",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2022/20221485","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4680/182/18",null,"gdprhub",null,null,"op henkivakuutus oy",null,null,null,null,null,null,null,null,null],["2022/FI/019","Tietosuojavaltuutetun toimisto (Finland) - 7285/183/18","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-06-08","day",null,null,null,null,null,"Art. 25(2), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 7, Art. 9","Accountability, Consent, Data principles, Special categories",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221486","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_7285/183/18",null,"gdprhub",null,"Insurance company",null,null,null,null,null,null,null,null,null,null],["2022/FI/016","Tietosuojavaltuutetun toimisto (Finland) - 8896/152/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-06-08","day",null,null,null,"Oy BMW Suomi Ab",null,"Art. 15, Art. 4(1)","Data subject rights",null,"Rejected","https://finlex.fi/fi/viranomaiset/tsv/2022/20221443","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8896/152/2019",null,"gdprhub",null,null,"oy bmw suomi ab",null,null,null,null,null,null,null,null,null],["2022/PL/011","ETid-1203","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-06-06","day",3500,null,"EUR","Esselmann Technika Pojazdowa Sp. z o.o. Sp. k.","Industry and Commerce","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5110.12.2021","https://www.enforcementtracker.com/ETid-1203",null,null,null,null,"esselmann technika pojazdowa spzoo sp k",null,null,null,null,null,null,null,null,null],["2022/BE/026","APD/GBA (Belgium) - 101/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-06-03","day",20000,"20.000","EUR",null,null,"Art. 32, Art. 33(1), Art. 33(5), Art. 34, Art. 5(1)(f), Art. 5(2)","Data breach, Data principles, Data security",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-101-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_101/2022",null,"gdprhub",null,"Telecommunications provider",null,null,null,null,null,null,null,null,null,null],["2022/RO/032","ETid-1198","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-06-03","day",2000,null,"EUR","Kaufland Romania SCS","Industry and Commerce","Art. 29, Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_03_06_2022&lang=ro","https://www.enforcementtracker.com/ETid-1198",null,null,null,null,"kaufland romania scs",null,null,null,null,null,null,null,null,null],["2022/ES/142","ETid-1199","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-03","day",1000,null,"EUR","Store owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00586-2021.pdf","https://www.enforcementtracker.com/ETid-1199",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/141","ETid-1200","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-03","day",360,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00608-2021.pdf","https://www.enforcementtracker.com/ETid-1200",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/140","ETid-1202","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-03","day",3000,null,"EUR","LODEJU, S.L.","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00393-2021.pdf","https://www.enforcementtracker.com/ETid-1202",null,null,null,null,"lodeju sl",null,null,null,null,null,null,null,null,null],["2022/ES/143","ETid-1195","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-06-01","day",300,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00516-2021.pdf","https://www.enforcementtracker.com/ETid-1195",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/SI/003","IP (Slovenia) - 0612-23/2019/19","gdprhub","Slovenia","SI","IP (Slovenia)","2022-06-01","day",null,null,null,null,null,"Art. 24, Art. 26, Art. 5(2)","Accountability, Data principles",null,"Other Outcome","https://gdprhub.eu/images/8/89/IP_%28Slovenia%29_-_0612-23-2019-19.pdf","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0612-23/2019/19",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/HR/020","AZOP (Croatia) - Decision 31-05-2022","gdprhub","Croatia","HR","AZOP (Croatia)","2022-05-31","day",null,null,null,null,null,"Art. 25, Art. 32","Accountability, Data security",null,"Violation found","https://azop.hr/wp-content/uploads/2022/09/RJESENJE-gubitak-osobnih-podataka.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_31-05-2022",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2022/ES/144","ETid-1194","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-31","day",1600,null,"EUR","CORON ISLAND SLU","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00632-2021.pdf","https://www.enforcementtracker.com/ETid-1194",null,null,null,null,"coron island slu",null,null,null,null,null,null,null,null,null],["2022/PL/010","ETid-1243","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-05-31","day",2100,null,"EUR","Stołeczny Ośrodek dla Osób Nietrzeźwych","Health Care","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.51.2021","https://www.enforcementtracker.com/ETid-1243",null,null,null,null,"PL: stoeczny osrodek dla osob nietrzezwych",null,null,null,null,null,null,null,null,null],["2022/FI/017","Tietosuojavaltuutetun toimisto (Finland) - 6813/171/21","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-05-31","day",null,null,null,"Pohjois-Savon sairaanhoitopiiri",null,"Art. 25(2)","Accountability",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221463","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6813/171/21",null,"gdprhub",null,null,"FI: pohjois savon sairaanhoitopiiri",null,null,null,null,null,null,null,null,null],["2022/RO/053","ANSPDCP (Romania) - Asociația de Proprietari Aviației Park","gdprhub","Romania","RO","ANSPDCP (Romania)","2022-05-27","day",7000,"7000","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(e), Art. 5(2), Art. 58(2)(d)","Data principles",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_20_06_2022_2&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Asocia%C8%9Bia_de_Proprietari_Avia%C8%9Biei_Park",null,"gdprhub",null,"Residential complex management",null,null,null,null,null,null,null,null,null,null],["2022/RO/052","ANSPDCP (Romania) - Fine against Asociația de Proprietari Aviației Park","gdprhub","Romania","RO","ANSPDCP (Romania)","2022-05-27","day",7000,"7000","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(e), Art. 5(2), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_20_06_2022_2&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Asocia%C8%9Bia_de_Proprietari_Avia%C8%9Biei_Park",null,"gdprhub",null,"Building owners association",null,null,null,null,null,null,null,null,null,null],["2022/IT/087","ETid-1257","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",46000,null,"EUR","Azienda Sanitaria Locale Roma","Health Care","Art. 5(1)(c)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9784482","https://www.enforcementtracker.com/ETid-1257",null,null,null,null,"IT: azienda sanitaria locale roma",null,null,null,null,null,null,null,null,null],["2022/IT/086","ETid-1258","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",100000,null,"EUR","Intesa Sanpaolo S.p.A","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9784626","https://www.enforcementtracker.com/ETid-1258","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9784626","gdprhub",null,null,"intesa sanpaolo spa","Intesa Sanpaolo",null,null,null,null,null,null,null,null],["2022/IT/084","ETid-1271","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",2000,null,"EUR","Turkish City","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9790111","https://www.enforcementtracker.com/ETid-1271",null,null,null,null,"IT: turkish city",null,null,null,null,null,null,null,null,null],["2022/IT/082","ETid-1289","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",10000,null,"EUR","Afragola municipality","Employment",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9789899","https://www.enforcementtracker.com/ETid-1289",null,null,null,null,"IT: afragola municipality",null,null,null,null,null,null,null,null,null],["2022/IT/080","ETid-1294","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",16000,null,"EUR","Region of Tuscany","Public Sector and Education","Art. 5(1)(c), Art. 6(1)(c), Art. 6(2), Art. 6(3)(b)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9789564","https://www.enforcementtracker.com/ETid-1294",null,null,null,null,"IT: region of tuscany",null,null,null,null,null,null,null,null,null],["2022/IT/079","ETid-1295","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",4000,null,"EUR","Università Agraria di Nettuno","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9789541","https://www.enforcementtracker.com/ETid-1295",null,null,null,null,"IT: universita agraria di nettuno",null,null,null,null,null,null,null,null,null],["2022/IT/077","ETid-1297","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",70000,null,"EUR","Azienda sanitaria universitaria Friuli Centrale","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9790365","https://www.enforcementtracker.com/ETid-1297",null,null,null,null,"IT: azienda sanitaria universitaria friuli centrale",null,null,null,null,null,null,null,null,null],["2022/IT/076","ETid-1298","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",50000,null,"EUR","Azienda sanitaria universitaria Friuli Occidentale","Health Care","Art. 25, Art. 32, Art. 9","Accountability, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9789972","https://www.enforcementtracker.com/ETid-1298","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9780409","gdprhub",null,null,"IT: azienda sanitaria universitaria friuli occidentale",null,null,null,null,null,null,null,null,null],["2022/IT/017","ETid-1638","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-26","day",2000,null,"EUR","Store owner","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9790111","https://www.enforcementtracker.com/ETid-1638",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IT/143","Garante per la protezione dei dati personali (Italy) - 9775948","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-05-26","day",null,null,null,"Meta Platforms Ireland Limited",null,null,null,null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9775948","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9775948",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/BE/004","ETid-1191","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-05-25","day",50000,null,"EUR","Roularta Media Group","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 14, Art. 24, Art. 5(1)(e), Art. 5(2), Art. 6(1)(a)","Accountability, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/citoyen/enquete-cookies-sur-les-sites-de-presse-roularta-mis-a-lamende","https://www.enforcementtracker.com/ETid-1191","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_85/2022","gdprhub",null,null,"BE: roularta media group",null,null,null,null,null,null,null,null,null],["2022/RO/033","ETid-1180","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-05-24","day",5000,null,"EUR","MED LIFE S.A.","Health Care",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_24_05_2022&lang=ro","https://www.enforcementtracker.com/ETid-1180",null,null,null,null,"med life sa",null,null,null,null,null,null,null,null,null],["2022/ES/129","ETid-1253","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-24","day",42000,null,"EUR","Alquiler Seguro SA","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00036-2022.pdf","https://www.enforcementtracker.com/ETid-1253",null,null,null,null,"alquiler seguro sa",null,null,null,null,null,null,null,null,null],["2022/NO/014","Datatilsynet (Norway) - 21/00872","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-05-23","day",null,"5000000","NOK","NAV (the Norwegian Labour and Welfare Administration)",null,"Art. 5(1)(a), Art. 5(1)(f), Art. 6(1), Art. 6(3)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/92b3164171544950b52f46e9d698d7a2/vedtak-om-overtredelsesgebyr---publisering-av-cv-pa-arbeidsplassen.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/00872",null,"gdprhub",null,null,"NO: nav",null,5000000.0,487710,"day 2022-05-23|10.2520|NOK",null,null,null,null,null],["2022/NO/020","Datatilsynet (Norway) - 21/02873","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-05-22","day",null,null,null,"Zalaris ASA",null,"Art. 12(2), Art. 12(3), Art. 12(5), Art. 15, Art. 15(4), Art. 3(1), Art. 4(16), Art. 4(23), Art. 56(1), Art. 60","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-10/no_2022-05_decisionpublic.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/02873",null,"gdprhub",null,null,"zalaris asa",null,null,null,null,null,null,null,null,null],["2022/IT/088","ETid-1242","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-22","day",3000,null,"EUR","Zito Auto di Gianfranco Zito","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782434","https://www.enforcementtracker.com/ETid-1242",null,null,null,null,"IT: zito auto di gianfranco zito",null,null,null,null,null,null,null,null,null],["2022/IT/083","ETid-1274","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-22","day",7000,null,"EUR","Azienda Socio Sanitaria Territoriale Dei Sette Laghi","Health Care","Art. 32, Art. 5(1)(f), Art. 9","Data principles, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9781947","https://www.enforcementtracker.com/ETid-1274",null,null,null,null,"IT: azienda socio sanitaria territoriale dei sette laghi",null,null,null,null,null,null,null,null,null],["2022/IT/075","ETid-1299","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-22","day",12000,null,"EUR","Comune di Napoli Corpo di Polizia Municipale","Public Sector and Education","Art. 5(1)(a), Art. 6, Art. 88","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9788986","https://www.enforcementtracker.com/ETid-1299",null,null,null,null,"IT: comune di napoli corpo di polizia municipale",null,null,null,null,null,null,null,null,null],["2022/DK/034","Datatilsynet (Denmark) - 2020-7320-1827","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-05-20","day",null,"None","EUR","Trustpilot",null,"Art. 12, Art. 15, Art. 28, Art. 56, Art. 60","Data subject rights, Processor obligations, Transparency",null,"Rejected","https://edpb.europa.eu/system/files/2022-12/dk_2022-05_decisionpublic.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-7320-1827",null,"gdprhub",null,null,"DK: trustpilot",null,null,null,null,null,null,null,null,null],["2022/ES/147","ETid-1182","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-20","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00628-2021.pdf","https://www.enforcementtracker.com/ETid-1182",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/146","ETid-1183","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-20","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00513-2021.pdf","https://www.enforcementtracker.com/ETid-1183",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/145","ETid-1184","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-20","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00542-2021.pdf","https://www.enforcementtracker.com/ETid-1184",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DE/053","BlnBDI (Berlin) - 632.276, 521.11692, 591.616","gdprhub","Germany","DE","BlnBDI (Berlin)","2022-05-19","day",1000,"1000","EUR",null,null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://edpb.europa.eu/system/files/2022-10/de-berlin_2022-05_decisionpublic.pdf","https://gdprhub.eu/index.php?title=BlnBDI_%28Berlin%29_-_632.276%2C_521.11692%2C_591.616",null,"gdprhub",null,"Photographer",null,null,null,null,null,"person",null,null,null,null],["2022/RO/035","ETid-1170","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-05-18","day",5000,null,"EUR","Kredyt Inkaso Investments RO S.A","Finance, Insurance and Consulting","Art. 33, Art. 5, Art. 6, Art. 9","Data breach, Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_18_05_2022&lang=ro","https://www.enforcementtracker.com/ETid-1170","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Kredyt_Inkaso_Investments_RO_SA","gdprhub",null,null,"kredyt inkaso investments ro sa",null,null,null,null,null,null,null,null,null],["2022/ES/150","ETid-1176","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-18","day",10000000,null,"EUR","Google LLC","Media, Telecoms and Broadcasting","Art. 17, Art. 6","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00140-2020.pdf","https://www.enforcementtracker.com/ETid-1176",null,null,null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/ES/149","ETid-1178","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-18","day",600,null,"EUR","SCF ZHU, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00583-2021.pdf","https://www.enforcementtracker.com/ETid-1178",null,null,null,null,"scf zhu sl",null,null,null,null,null,null,null,null,null],["2022/GB/004","ETid-1190","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2022-05-18","day",9000000,null,"EUR","Clearview Al Inc.","Industry and Commerce","Art. 14, Art. 15, Art. 16, Art. 17, Art. 21, Art. 22, Art. 35, Art. 6, Art. 9","DPIA, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2022/05/ico-fines-facial-recognition-database-company-clearview-ai-inc/","https://www.enforcementtracker.com/ETid-1190",null,null,null,null,"clearview al inc","Clearview AI",null,null,null,null,null,null,null,null],["2022/HR/017","AZOP (Croatia) - Decision 17-05-2022","gdprhub","Croatia","HR","AZOP (Croatia)","2022-05-17","day",null,"9.375,00","HRK",null,null,"Art. 6","Unlawful processing",null,null,"https://sudskapraksa.vsrh.hr/decisionText?id=090216ba80d2cc49&q=%2522op%25C4%2587a+uredba+o+za%25C5%25A1titi+podataka%2522","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_17-05-2022",null,"gdprhub",null,"Building co-owners",null,null,9375.0,1246,"day 2022-05-17|7.5245|HRK",null,null,null,null,null],["2022/RO/034","ETid-1171","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-05-17","day",1500,null,"EUR","MAYR MELNHOF PACKAGING ROMANIA S.R.L.","Industry and Commerce","Art. 5(2), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_17_05_2022&lang=ro","https://www.enforcementtracker.com/ETid-1171",null,null,null,null,"mayr melnhof packaging romania srl",null,null,null,null,null,null,null,null,null],["2022/ES/154","ETid-1172","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-17","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00544-2021.pdf","https://www.enforcementtracker.com/ETid-1172",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/153","ETid-1173","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-17","day",8000,null,"EUR","TIGERS MARKET, S.L.","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00061-2022.pdf","https://www.enforcementtracker.com/ETid-1173",null,null,null,null,"tigers market sl",null,null,null,null,null,null,null,null,null],["2022/ES/152","ETid-1174","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-17","day",18000,null,"EUR","RAMONA FILMS, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00098-2022.pdf","https://www.enforcementtracker.com/ETid-1174",null,null,null,null,"ramona films sl",null,null,null,null,null,null,null,null,null],["2022/ES/151","ETid-1175","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-17","day",4000,null,"EUR","INSEKT FOOD S.L.","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00519-2021.pdf","https://www.enforcementtracker.com/ETid-1175",null,null,null,null,"insekt food sl",null,null,null,null,null,null,null,null,null],["2022/ES/148","ETid-1179","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-17","day",42000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00111-2022.pdf","https://www.enforcementtracker.com/ETid-1179",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/GR/041","HDPA (Greece) - 21/2023","gdprhub","Greece","GR","HDPA (Greece)","2022-05-17","day",null,null,null,"ΟΤΕ ΑΕ",null,null,null,null,"Rejected","https://www.dpa.gr/sites/default/files/2023-08/21_2023%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_21/2023",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/SI/002","IP (Slovenia) - 0611-623/2021/10","gdprhub","Slovenia","SI","IP (Slovenia)","2022-05-17","day",null,null,null,null,null,"Art. 12, Art. 13(1), Art. 13(2), Art. 5","Data principles, Transparency",null,"Violation found","https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0611-623/2021/10",null,"gdprhub",null,"COVID-19 test provider",null,null,null,null,null,null,null,null,null,null],["2022/AT/004","DSB (Austria) - 2022-0.296.352","gdprhub","Austria","AT","DSB (Austria)","2022-05-16","day",null,null,null,"Austrian Federal Minister of Finance (BMF)",null,"Art. 45(3), Art. 46(1)","International transfers",null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220516_2022_0_296_352_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.296.352",null,"gdprhub",null,null,"AT: austrian federal minister of finance",null,null,null,null,null,null,null,null,null],["2022/NO/004","ETid-1234","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2022-05-16","day",14500,null,"EUR","Arbeidstilsynet","Public Sector and Education","Art. 6(1)(e)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/ac275106cc11481eaaf0dbd0d011a347/~-13262-20_02875-10-1-hoveddokument-308867_1_2.pdf","https://www.enforcementtracker.com/ETid-1234","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02875-10_%26_20/02875-11","gdprhub",null,null,"NO: arbeidstilsynet",null,null,null,null,null,null,null,null,null],["2022/HU/024","NAIH (Hungary) - NAIH-5361-1/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-05-16","day",null,null,null,"Budapest Bar Association",null,"Art. 12(3), Art. 15(1), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=530:erintetti-kerelem-hataridoben-torteno-teljesitesenek-elmulasztasa","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-5361-1/2022",null,"gdprhub",null,null,"HU: budapest bar association",null,null,null,null,null,null,null,null,null],["2022/ES/155","ETid-1168","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-13","day",170000,null,"EUR","Mercadona S.A.","Industry and Commerce","Art. 12, Art. 15, Art. 6","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00267-2021.pdf","https://www.enforcementtracker.com/ETid-1168",null,null,null,null,"mercadona sa",null,null,null,null,null,null,null,null,null],["2022/SE/009","IMY (Sweden) - DI-2021-6140","gdprhub","Sweden","SE","IMY (Sweden)","2022-05-13","day",null,null,null,null,null,"Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-10/se_2022-05_decisionpublic_0.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-6140",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DK/020","Datatilsynet (Denmark) - 2021-442-13989","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-05-12","day",null,null,null,"Syddansk Universitet",null,"Art. 32(1)","Data security",null,null,"https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/maj/alvorlig-kritik-af-syddansk-universitets-utilstraekkelige-testning-af-softwareopdatering","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-442-13989",null,"gdprhub",null,null,"DK: syddansk universitet",null,null,null,null,null,null,null,null,null],["2022/DK/005","ETid-1161","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2022-05-12","day",13400,null,"EUR","Civilstyrelsen","Public Sector and Education","Art. 32, Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/maj/civilstyrelsen-indstilles-til-boede","https://www.enforcementtracker.com/ETid-1161",null,null,null,null,"DK: civilstyrelsen",null,null,null,null,null,null,null,null,null],["2022/RO/036","ETid-1163","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-05-12","day",1000,null,"EUR","LORIS FUEL SHOP SRL","Industry and Commerce","Art. 29, Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_12_05_2022&lang=ro","https://www.enforcementtracker.com/ETid-1163",null,null,null,null,"loris fuel shop srl",null,null,null,null,null,null,null,null,null],["2022/ES/158","ETid-1164","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-12","day",500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00550-2021.pdf","https://www.enforcementtracker.com/ETid-1164",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/157","ETid-1165","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-12","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00539-2021.pdf","https://www.enforcementtracker.com/ETid-1165",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/IT/085","ETid-1264","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-12","day",20000,null,"EUR","Bazar di Hu Xiaoyan","Industry and Commerce","Art. 13, Art. 5","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9788970","https://www.enforcementtracker.com/ETid-1264",null,null,null,null,"IT: bazar di hu xiaoyan",null,null,null,null,null,null,null,null,null],["2022/IT/081","ETid-1290","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-12","day",6000,null,"EUR","Villabate municipality","Employment","Art. 37(1)(a), Art. 37(7), Art. 38(6), Art. 5(1)(a), Art. 6","Data principles, Data protection officer, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9781242","https://www.enforcementtracker.com/ETid-1290",null,null,null,null,"IT: villabate municipality",null,null,null,null,null,null,null,null,null],["2022/IT/078","ETid-1296","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-05-12","day",2000,null,"EUR","Singh Market","Industry and Commerce","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9789409","https://www.enforcementtracker.com/ETid-1296",null,null,null,null,"IT: singh market",null,null,null,null,null,null,null,null,null],["2022/DK/021","Datatilsynet (Denmark) - 2021-441-9224","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-05-11","day",null,null,null,"3F Østfyn",null,"Art. 32(1), Art. 5(1)(d)","Data principles, Data security",null,null,"https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/maj/datatilsynet-udtaler-alvorlig-kritik-af-3f-oestfyn-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-441-9224",null,"gdprhub",null,null,"DK: 3f stfyn",null,null,null,null,null,null,null,null,null],["2022/ES/159","ETid-1162","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-11","day",600,null,"EUR","Bar owner","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00579-2021.pdf","https://www.enforcementtracker.com/ETid-1162",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/156","ETid-1166","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-11","day",6000,null,"EUR","Homeowners Association","Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00523-2021.pdf","https://www.enforcementtracker.com/ETid-1166",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/SE/010","IMY (Sweden) - DI-2021-10263","gdprhub","Sweden","SE","IMY (Sweden)","2022-05-11","day",null,null,null,"Klarna Bank AB",null,"Art. 15, Art. 15(1)(c), Art. 19, Art. 5(1)(a), Art. 56","Data principles, Data subject rights",null,"Violation found","https://edpb.europa.eu/system/files/2022-10/se_2022-05_decisionpublic.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-10263",null,"gdprhub",null,null,"klarna bank ab","Klarna",null,null,null,null,null,null,null,null],["2022/ES/161","ETid-1156","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-10","day",300,null,"EUR","Store owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00037-2022.pdf","https://www.enforcementtracker.com/ETid-1156",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/162","ETid-1155","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-09","day",1200,null,"EUR","CONTIMAG INVEST, S.L.","Accommodation and Hospitality","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00563-2021.pdf","https://www.enforcementtracker.com/ETid-1155",null,null,null,null,"contimag invest sl",null,null,null,null,null,null,null,null,null],["2022/FI/004","ETid-1254","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2022-05-09","day",85000,null,"EUR","Otavamedia Oy","Media, Telecoms and Broadcasting","Art. 15, Art. 17, Art. 25, Art. 5(1)(c)","Accountability, Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://tietosuoja.fi/-/otavamedialle-seuraamusmaksu-puutteista-tietosuojaoikeuksien-toteutuksessa","https://www.enforcementtracker.com/ETid-1254","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6097/161/21","gdprhub",null,null,"otavamedia oy",null,null,null,null,null,null,null,null,null],["2022/FI/009","Tietosuojavaltuutetun toimisto (Finland) - 1788/152/22","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-05-05","day",null,null,null,"Police University College",null,"Art. 15(3), Art. 15(4), Art. 58(2)(c)","Data subject rights",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221423","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_1788/152/22",null,"gdprhub",null,null,"FI: police university college",null,null,null,null,null,null,null,null,null],["2022/BE/055","APD/GBA (Belgium) - 51/2023","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-05-04","day",null,null,null,null,null,"Art. 13(1)(a), Art. 13(1)(b), Art. 37(7), Art. 5(1)(b), Art. 5(1)(c)","Data principles, Data protection officer, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/bevel-nr.-51-2023.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_51/2023",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2022/RO/037","ETid-1148","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-05-04","day",4000,null,"EUR","Concordia Capital IFN S.A.","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_04_05_2022&lang=ro","https://www.enforcementtracker.com/ETid-1148",null,null,null,null,"concordia capital ifn sa",null,null,null,null,null,null,null,null,null],["2022/BE/005","ETid-1151","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-05-04","day",10000,null,"EUR","Nationale Maatschappij der Belgische Spoorwegen","Transportation and Energy","Art. 12(2), Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-71-2022.pdf","https://www.enforcementtracker.com/ETid-1151","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_71/2022","gdprhub",null,null,"BE: nationale maatschappij der belgische spoorwegen",null,null,null,null,null,null,null,null,null],["2022/BG/002","ETid-1832","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2022-05-04","day",500000,null,"EUR","Bulgarian Post EAD","Transportation and Energy","Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cpdp.bg/userfiles/file/Annual%20Reports/Annual%20report_2022_CPDP.pdf","https://www.enforcementtracker.com/ETid-1832",null,null,null,null,"BG: bulgarian post ead",null,null,null,null,null,null,null,null,null],["2022/FI/008","Tietosuojavaltuutetun toimisto (Finland) - 4300/182/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-05-04","day",null,null,null,"Supreme Court of Finland",null,"Art. 2(2)(d), Art. 55(3), Art. 6(1)(c)","Unlawful processing",null,"Other Outcome","https://finlex.fi/fi/viranomaiset/tsv/2022/20221384","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4300/182/2019",null,"gdprhub",null,null,"FI: supreme court of finland",null,null,null,null,null,null,null,null,null],["2022/RO/038","ETid-1145","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-05-03","day",4000,null,"EUR","Megareduceri TV S.R.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_03_05_2022&lang=ro","https://www.enforcementtracker.com/ETid-1145",null,null,null,null,"megareduceri tv srl",null,null,null,null,null,null,null,null,null],["2022/ES/164","ETid-1152","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-05-03","day",5000,null,"EUR","MISTORE CANARIAS, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00534-2021.pdf","https://www.enforcementtracker.com/ETid-1152",null,null,null,null,"mistore canarias sl",null,null,null,null,null,null,null,null,null],["2022/IS/002","ETid-1154","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2022-05-03","day",36000,null,"EUR","City of Reykjavík","Public Sector and Education","Art. 32, Art. 5, Art. 6","Data principles, Data security, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.personuvernd.is/urlausnir/notkun-seesaw-nemendakerfisins-i-grunnskolum-reykjavikur-sektarakvordun-1","https://www.enforcementtracker.com/ETid-1154",null,null,null,null,"IS: city of reykjavik",null,null,null,null,null,null,null,null,null],["2022/IS/001","ETid-1428","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2022-05-03","day",10600,null,"EUR","HEI – Medical Travel","Health Care",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.personuvernd.is/urlausnir/vinnsla-a-personuupplysingum-og-afgreidsla-adgangsbeidni-hja-hei-medical-travel-sektarakvordun-1","https://www.enforcementtracker.com/ETid-1428",null,null,null,null,"IS: hei medical travel",null,null,null,null,null,null,null,null,null],["2022/BE/021","APD/GBA (Belgium) - 62/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-04-29","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 30, Art. 33(1)","Data breach, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-62-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_62/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/167","ETid-1143","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-29","day",4200,null,"EUR","CLÍNICA DENTAL SAN FRANCISCO, S.L.","Health Care","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00078-2022.pdf","https://www.enforcementtracker.com/ETid-1143",null,null,null,null,"clinica dental san francisco sl",null,null,null,null,null,null,null,null,null],["2022/ES/166","ETid-1144","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-29","day",16000,null,"EUR","LABORATORIOS GONZÁLEZ, S.L.","Health Care","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00323-2021.pdf","https://www.enforcementtracker.com/ETid-1144",null,null,null,null,"laboratorios gonzalez sl",null,null,null,null,null,null,null,null,null],["2022/FI/005","ETid-1189","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2022-04-29","day",8300,null,"EUR","Telemarketing company","Media, Telecoms and Broadcasting","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://finlex.fi/fi/viranomaiset/tsv/2022/20221403","https://www.enforcementtracker.com/ETid-1189","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_10587/161/21","gdprhub",null,null,"FI: telemarketing company",null,null,null,null,null,null,null,null,null],["2022/GR/034","HDPA (Greece) - 24/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-04-29","day",35000,"35.000","EUR",null,null,"Art. 15, Art. 2, Art. 32, Art. 5(1)(a), Art. 5(1)(f)","Data principles, Data security, Data subject rights",null,"Violation found","https://www.dpa.gr/sites/default/files/2022-05/24_2022_anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_24/2022",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2022/ES/165","ETid-1147","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-28","day",1500,null,"EUR","CAFFE VECCHIO, S.L.","Employment","Art. 5(1)(f), Art. 6(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00395-2021.pdf","https://www.enforcementtracker.com/ETid-1147",null,null,null,null,"caffe vecchio sl",null,null,null,null,null,null,null,null,null],["2022/ES/163","ETid-1153","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-28","day",15000,null,"EUR","MEDEROS MOVITEN, S.L.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00261-2021.pdf","https://www.enforcementtracker.com/ETid-1153",null,null,null,null,"mederos moviten sl",null,null,null,null,null,null,null,null,null],["2022/ES/160","ETid-1157","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-28","day",40000,null,"EUR","Working Capital Management España, S.L.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00496-2021.pdf","https://www.enforcementtracker.com/ETid-1157",null,null,null,null,"working capital management espana sl",null,null,null,null,null,null,null,null,null],["2022/IT/097","ETid-1193","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",1000,null,"EUR","Educationest s.r.l.","Employment",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9776444","https://www.enforcementtracker.com/ETid-1193","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9776444","gdprhub",null,null,"educationest srl",null,null,null,null,null,null,null,null,null],["2022/IT/096","ETid-1196","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",10000,null,"EUR","Italian Ministry of Defense","Public Sector and Education","Art. 10, Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9776406","https://www.enforcementtracker.com/ETid-1196",null,null,null,null,"IT: italian ministry of defense",null,null,null,null,null,null,null,null,null],["2022/IT/095","ETid-1197","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",50000,null,"EUR","Istituto Nazionale Assicurazione Infortuni sul Lavoro","Public Sector and Education","Art. 32, Art. 6(1)(e), Art. 9(2)(g)","Data security, Special categories, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9771184","https://www.enforcementtracker.com/ETid-1197",null,null,null,null,"IT: istituto nazionale assicurazione infortuni sul lavoro",null,null,null,null,null,null,null,null,null],["2022/IT/094","ETid-1204","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",2500,null,"EUR","\"Isabella Gonzaga\" high school","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9777200","https://www.enforcementtracker.com/ETid-1204",null,null,null,null,"IT: isabella gonzaga high school",null,null,null,null,null,null,null,null,null],["2022/IT/093","ETid-1223","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",2000,null,"EUR","Comune di Partanna","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9777127","https://www.enforcementtracker.com/ETid-1223",null,null,null,null,"IT: comune di partanna",null,null,null,null,null,null,null,null,null],["2022/IT/092","ETid-1227","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",2000,null,"EUR","Ekss s.r.l.","Accommodation and Hospitality","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9779082","https://www.enforcementtracker.com/ETid-1227",null,null,null,null,"ekss srl",null,null,null,null,null,null,null,null,null],["2022/IT/091","ETid-1228","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",40000,null,"EUR","Il Sole 24 Ore S.p.a.","Media, Telecoms and Broadcasting","Art. 12, Art. 5, Art. 9","Data principles, Data subject rights, Special categories, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9779098","https://www.enforcementtracker.com/ETid-1228",null,null,null,null,"il sole 24 ore spa",null,null,null,null,null,null,null,null,null],["2022/IT/090","ETid-1232","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",20000,null,"EUR","Nos s.r.l.s.","Industry and Commerce","Art. 13, Art. 14, Art. 5(1)(a), Art. 6, Art. 7","Consent, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9779025","https://www.enforcementtracker.com/ETid-1232",null,null,null,null,"nos srls",null,null,null,null,null,null,null,null,null],["2022/IT/089","ETid-1235","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",70000,null,"EUR","Ospedale San Raffaele s.r.l.","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9779057","https://www.enforcementtracker.com/ETid-1235","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9779057","gdprhub",null,null,"ospedale san raffaele srl",null,null,null,null,null,null,null,null,null],["2022/IT/014","ETid-1641","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",3000,null,"EUR","Comune di Monte Sant'Angelo","Public Sector and Education","Art. 17, Art. 5(1)(a), Art. 6(1)(e)","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9778996","https://www.enforcementtracker.com/ETid-1641","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9778996","gdprhub",null,null,"IT: comune di monte sant angelo",null,null,null,null,null,null,null,null,null],["2022/IT/013","ETid-1643","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",1500,null,"EUR","Direzione Didattica Statale 1° Circolo-Eboli","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9777156","https://www.enforcementtracker.com/ETid-1643",null,null,null,null,"IT: direzione didattica statale 1 circolo eboli",null,null,null,null,null,null,null,null,null],["2022/IT/007","ETid-1667","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",200000,null,"EUR","Amiu S.p.A.","Industry and Commerce","Art. 28, Art. 37, Art. 5, Art. 6","Data principles, Data protection officer, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9777996","https://www.enforcementtracker.com/ETid-1667","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9777996","gdprhub",null,null,"amiu spa",null,null,null,null,null,null,null,null,null],["2022/IT/006","ETid-1668","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-28","day",150000,null,"EUR","Tarento municipality","Public Sector and Education","Art. 12, Art. 13, Art. 14, Art. 28, Art. 35, Art. 5","DPIA, Data principles, Processor obligations, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9777974","https://www.enforcementtracker.com/ETid-1668",null,null,null,null,"IT: tarento municipality",null,null,null,null,null,null,null,null,null],["2022/IT/140","Garante per la protezione dei dati personali (Italy) - 9779098","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-04-28","day",40000,"40,000","EUR","Il Sole 24 Ore S.p.a.",null,"Art. 12, Art. 5, Art. 9(1)","Data principles, Special categories, Transparency",null,"Violation found","https://www.garanteprivacy.it/pdf?p_p_id=PdfUtil&p_p_lifecycle=2&p_p_state=normal&p_p_mode=view&p_p_resource_id=%252Foffering%252FprintPDF&p_p_cacheability=cacheLevelPage&_PdfUtil_articleId=9779098","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9779098",null,"gdprhub",null,null,"il sole 24 ore spa",null,null,null,null,null,null,null,null,null],["2022/ES/232","AEPD (Spain) - PS-00371-2021","gdprhub","Spain","ES","AEPD (Spain)","2022-04-27","day",null,null,null,"HERTZ DE ESPAÑA, S.L.",null,"Art. 32, Art. 5(1)(f), Art. 58(2)(d), Art. 60, Art. 83(2), Art. 83(4)(a), Art. 83(5)(a)","Data principles, Data security",null,"Violation found","https://www.aepd.es/documento/ps-00371-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00371-2021",null,"gdprhub",null,null,"hertz de espana sl",null,null,null,null,null,null,null,null,null],["2022/DK/017","Datatilsynet (Denmark) - 2021-431-0151","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-04-27","day",null,null,null,"Joannahuset",null,"Art. 32","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/apr/krisecenters-anmodning-om-personnummer-via-sms-gav-i-en-helt-saerlig-og-konkret-situation-ikke-anledning-til-kritik","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0151",null,"gdprhub",null,null,"DK: joannahuset",null,null,null,null,null,null,null,null,null],["2022/ES/169","ETid-1141","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-27","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00451-2021.pdf","https://www.enforcementtracker.com/ETid-1141",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/ES/218","AEPD (Spain) - PS/00132/2022","gdprhub","Spain","ES","AEPD (Spain)","2022-04-26","day",1800,"1,800","EUR",null,null,"Art. 13, Art. 6(1)","Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/es/informes-y-resoluciones/resoluciones?search_api_fulltext=PS-00132-2022","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00132/2022",null,"gdprhub",null,"Owner of a commercial website",null,null,null,null,null,null,null,null,null,null],["2022/DK/018","Datatilsynet (Denmark) - 2021-423-0235","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-04-26","day",null,null,null,"Gladsaxe Kommune",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/apr/tilsyn-med-gladsaxe-kommunes-rettighedsstyring-i-et-af-kommunens-systemer","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-423-0235",null,"gdprhub",null,null,"DK: gladsaxe kommune",null,null,null,null,null,null,null,null,null],["2022/NO/011","Datatilsynet (Norway) - 21/03656","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-04-26","day",null,"None","EUR","Mowi ASA",null,"Art. 12, Art. 12(2), Art. 14, Art. 14(5)(a), Art. 14(5)(c), Art. 15, Art. 55(1), Art. 56(1)","Data subject rights, Transparency",null,"Violation found","https://www.datatilsynet.no/contentassets/f3cc434bd86349c0a9286261080ba6e5/~-21_03656-12reprimand-and-compliance-order---mowi-asa-298724_1_1.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/03656",null,"gdprhub",null,null,"mowi asa",null,null,null,null,null,null,null,null,null],["2022/IT/105","ETid-1158","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-26","day",1000,null,"EUR","ASST di Lodi","Health Care","Art. 32, Art. 5(1)(f), Art. 9","Data principles, Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9763968","https://www.enforcementtracker.com/ETid-1158",null,null,null,null,"IT: asst di lodi",null,null,null,null,null,null,null,null,null],["2022/ES/170","ETid-1140","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-23","day",1200,null,"EUR","MOVALIA TRASLADOS, S.L.U.","Industry and Commerce","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00533-2021.pdf","https://www.enforcementtracker.com/ETid-1140",null,null,null,null,"movalia traslados slu",null,null,null,null,null,null,null,null,null],["2022/ES/222","AEPD (Spain) - EXP202203606","gdprhub","Spain","ES","AEPD (Spain)","2022-04-22","day",null,null,null,"Securitas Direct España, S.A",null,"Art. 17(1)(a), Art. 17(2), Art. 55(1)","Data subject rights",null,null,"https://www.aepd.es/es/documento/pd-00130-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202203606",null,"gdprhub",null,null,"securitas direct espana sa",null,null,null,null,null,null,null,null,null],["2022/BE/025","APD/GBA (Belgium) - 84-2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-04-22","day",5000,"5000","EUR",null,null,"Art. 13, Art. 14, Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(d), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-84-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_84-2022",null,"gdprhub",null,"Website provider",null,null,null,null,null,null,null,null,null,null],["2022/ES/168","ETid-1142","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-22","day",5600,null,"EUR","Physician","Health Care","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00199-2021.pdf","https://www.enforcementtracker.com/ETid-1142",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HU/003","ETid-1822","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-04-22","day",8000,null,"EUR","Political party","Individuals and Private Associations","Art. 32(2), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://naih.hu/eves-beszamolok?download=648:naih-beszamolo-a-2022-evi-tevekenysegroll","https://www.enforcementtracker.com/ETid-1822",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DK/019","Datatilsynet (Denmark) - 2020-442-8099","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-04-21","day",null,null,null,"Finanstilsynet",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/apr/datatilsynet-udtaler-alvorlig-kritik-af-finanstilsynets-behandling-af-personoplysninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-442-8099",null,"gdprhub",null,null,"DK: finanstilsynet",null,null,null,null,null,null,null,null,null],["2022/BE/043","APD/GBA (Belgium) - 57/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-04-19","day",null,null,null,"Controllers: Mr. Y1 and Mr. Y2",null,null,null,null,"Rejected","https://www.autoriteprotectiondonnees.be/publications/classement-sans-suite-n-57-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_57/2022",null,"gdprhub",null,null,"BE: controllers mr y1 and mr y2",null,null,null,null,null,null,null,null,null],["2022/ES/171","ETid-1139","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-19","day",600,null,"EUR","DOOR2DOOR SPAIN, S.L.","Transportation and Energy","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00008-2022.pdf","https://www.enforcementtracker.com/ETid-1139",null,null,null,null,"door2door spain sl",null,null,null,null,null,null,null,null,null],["2022/RO/039","ETid-1126","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-04-18","day",1000,null,"EUR","IKEA România S.R.L.","Industry and Commerce","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_18_04_2022&lang=ro","https://www.enforcementtracker.com/ETid-1126",null,null,null,null,"ikea romania sa",null,null,null,null,null,null,null,null,null],["2022/ES/176","ETid-1128","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-18","day",1800,null,"EUR","FLORAQUEEN FLOWERING THE WORLD S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00019-2022.pdf","https://www.enforcementtracker.com/ETid-1128",null,null,null,null,"floraqueen flowering the world sl",null,null,null,null,null,null,null,null,null],["2022/ES/173","ETid-1134","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-18","day",9000,null,"EUR","JIMBO NETWORKS, S.L.","Industry and Commerce","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00482-2021.pdf","https://www.enforcementtracker.com/ETid-1134",null,null,null,null,"jimbo networks sl",null,null,null,null,null,null,null,null,null],["2022/ES/172","ETid-1135","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-18","day",1800,null,"EUR","Website operator","Industry and Commerce","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00603-2021.pdf","https://www.enforcementtracker.com/ETid-1135","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00603/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/FR/009","ETid-1136","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2022-04-15","day",1500000,null,"EUR","DEDALUS BIOLOGIE","Health Care","Art. 28, Art. 29, Art. 32","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnil.fr/fr/fuite-de-donnees-de-sante-sanction-de-15-million-deuros-lencontre-de-la-societe-dedalus-biologie","https://www.enforcementtracker.com/ETid-1136","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2022-009","gdprhub",null,null,"FR: dedalus biologie",null,null,null,null,null,null,null,null,null],["2022/ES/174","ETid-1130","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-13","day",8000,null,"EUR","RAMONA FILMS, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00483-2021.pdf","https://www.enforcementtracker.com/ETid-1130","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00483/2021","gdprhub",null,null,"ramona films sl",null,null,null,null,null,null,null,null,null],["2022/ES/177","ETid-1125","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-12","day",500,null,"EUR","Homeowners Association","Real Estate","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00043-2021.pdf","https://www.enforcementtracker.com/ETid-1125",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/175","ETid-1129","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-04-11","day",150000,null,"EUR","BASER COMERCIALIZADORA DE REFERENCIA, S.A.","Transportation and Energy","Art. 32, Art. 6","Data security, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00476-2021.pdf","https://www.enforcementtracker.com/ETid-1129",null,null,null,null,"baser comercializadora de referencia sa",null,null,null,null,null,null,null,null,null],["2022/AT/003","DSB (Austria) - 2021-0.187.619","gdprhub","Austria","AT","DSB (Austria)","2022-04-07","day",null,null,null,null,null,"Art. 17(1)(d), Art. 17(3)(a), Art. 6(1)(f)","Data subject rights, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210407_2021_0_187_619_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.187.619",null,"gdprhub",null,"Operator of a search engine",null,null,null,null,null,null,null,null,null,null],["2022/RO/040","ETid-1120","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-04-07","day",500,null,"EUR","Property owners' association","Real Estate",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_07_04_2022&lang=ro","https://www.enforcementtracker.com/ETid-1120","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Owners_Association_from_Str._Soporului_17%2C_Cluj-Napoca_Municipality","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/NL/006","ETid-1124","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2022-04-07","day",3700000,null,"EUR","Dutch Tax and Customs Administration","Public Sector and Education","Art. 32(1), Art. 35(2), Art. 6(1)","DPIA, Data principles, Data security, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://autoriteitpersoonsgegevens.nl/nl/nieuws/boete-belastingdienst-voor-zwarte-lijst-fsv","https://www.enforcementtracker.com/ETid-1124",null,null,null,null,"NL: dutch tax and customs administration",null,null,null,null,null,null,null,null,null],["2022/IT/104","ETid-1159","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",40000,null,"EUR","Azienda ospedaliera di Perugia","Health Care","Art. 13, Art. 14, Art. 25, Art. 30, Art. 32, Art. 35","Accountability, DPIA, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9768363","https://www.enforcementtracker.com/ETid-1159",null,null,null,null,"IT: azienda ospedaliera di perugia",null,null,null,null,null,null,null,null,null],["2022/IT/103","ETid-1160","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",40000,null,"EUR","ISWEB S.p.A.","Industry and Commerce","Art. 28","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9768387","https://www.enforcementtracker.com/ETid-1160",null,null,null,null,"isweb spa",null,null,null,null,null,null,null,null,null],["2022/IT/101","ETid-1185","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",50000,null,"EUR","Palumbo Superyacht Ancona s.r.l.","Employment","Art. 12(3), Art. 13, Art. 15","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9771545","https://www.enforcementtracker.com/ETid-1185","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9771545","gdprhub",null,null,"palumbo superyacht ancona srl",null,null,null,null,null,null,null,null,null],["2022/IT/100","ETid-1186","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",20000,null,"EUR","Made in Italy s.r.l.s.","Industry and Commerce","Art. 15, Art. 17, Art. 21, Art. 6, Art. 7","Consent, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9771529","https://www.enforcementtracker.com/ETid-1186",null,null,null,null,"made in italy srls",null,null,null,null,null,null,null,null,null],["2022/IT/099","ETid-1187","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",10000,null,"EUR","Findomestic Banca spa","Finance, Insurance and Consulting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9771122","https://www.enforcementtracker.com/ETid-1187",null,null,null,null,"findomestic banca spa",null,null,null,null,null,null,null,null,null],["2022/IT/098","ETid-1192","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",10000,null,"EUR","E-Mac Professional s.r.l.","Industry and Commerce","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9774680","https://www.enforcementtracker.com/ETid-1192",null,null,null,null,"e mac professional srl",null,null,null,null,null,null,null,null,null],["2022/IT/012","ETid-1644","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",15000,null,"EUR","Rebirth s.r.l.","Accommodation and Hospitality","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9768440","https://www.enforcementtracker.com/ETid-1644",null,null,null,null,"rebirth srl",null,null,null,null,null,null,null,null,null],["2022/IT/010","ETid-1648","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-04-07","day",10000,null,"EUR","Tecnomed Trento s.r.l.","Health Care","Art. 13, Art. 29, Art. 32","Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9823195","https://www.enforcementtracker.com/ETid-1648",null,null,null,null,"tecnomed trento srl",null,null,null,null,null,null,null,null,null],["2022/IT/142","Garante per la protezione dei dati personali (Italy) - 9773950","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-04-07","day",20000,"20,000","EUR","Comune di Orte and an unnamed citizen",null,"Art. 12(1), Art. 13, Art. 24, Art. 25, Art. 37(7), Art. 5(1)(a), Art. 5(1)(e)","Accountability, Data principles, Data protection officer, Transparency",null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9773950","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9773950",null,"gdprhub",null,null,"IT: comune di orte and an unnamed citizen",null,null,null,null,null,null,null,null,null],["2022/DK/006","ETid-1114","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2022-04-05","day",1300000,null,"EUR","Danske Bank","Finance, Insurance and Consulting","Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/apr/danske-bank-indstilles-til-boede","https://www.enforcementtracker.com/ETid-1114","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_Danske_Bank","gdprhub",null,null,"DK: danske bank",null,null,null,null,null,null,null,null,null],["2022/IE/006","ETid-1115","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2022-04-05","day",463000,null,"EUR","Bank of Ireland","Finance, Insurance and Consulting","Art. 32, Art. 33, Art. 34","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.independent.ie/business/technology/bank-of-ireland-fined-over-errors-reporting-details-of-47000-customers-loans-41522333.html#:~:text=Bank%20of%20Ireland%20has%20been,have%20affected%20their%20credit%20ratings","https://www.enforcementtracker.com/ETid-1115",null,null,null,null,"IE: bank of ireland",null,null,null,null,null,null,null,null,null],["2022/BE/009","ETid-1116","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-04-04","day",200000,null,"EUR","Brussels Airport Zaventem","Transportation and Energy","Art. 12, Art. 13(1)(c), Art. 13(2)(e), Art. 5(1)(c), Art. 6(1)(e), Art. 9(2)(g)","Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-48-2022.pdf","https://www.enforcementtracker.com/ETid-1116","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_48/2022","gdprhub",null,null,"BE: brussels airport zaventem",null,null,null,null,null,null,null,null,null],["2022/BE/008","ETid-1117","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-04-04","day",100000,null,"EUR","Brussels Airport Charleroi","Transportation and Energy","Art. 12(1), Art. 13(1)(c), Art. 13(2)(e), Art. 6(1)(c), Art. 6(3), Art. 9(2)(i)","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-47-2022.pdf","https://www.enforcementtracker.com/ETid-1117","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_47/2022","gdprhub",null,null,"BE: brussels airport charleroi",null,null,null,null,null,null,null,null,null],["2022/BE/007","ETid-1118","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-04-04","day",20000,null,"EUR","Ambuce Rescue Team","Industry and Commerce","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/citoyen/controles-de-temperature-lapd-met-les-aeroports-de-zaventem-et-charleroi-a-lamende","https://www.enforcementtracker.com/ETid-1118",null,null,null,null,"BE: ambuce rescue team",null,null,null,null,null,null,null,null,null],["2022/GR/017","ETid-1132","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-04-04","day",10000,null,"EUR","Piraeus Bank","Finance, Insurance and Consulting","Art. 33, Art. 34, Art. 5(1)(f)","Data breach, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-synehizomeno-peristatiko-parabiasis-prosopikon","https://www.enforcementtracker.com/ETid-1132","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_6/2022","gdprhub",null,null,"GR: piraeus bank",null,null,null,null,null,null,null,null,null],["2022/GR/016","ETid-1137","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-04-04","day",5000,null,"EUR","Mayor","Employment","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-diabibasi-dedomenon-prosopikoy-haraktira-pros","https://www.enforcementtracker.com/ETid-1137",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/006","ETid-1121","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-04-01","day",7500,null,"EUR","Company","Employment","Art. 15, Art. 17, Art. 18, Art. 21, Art. 28, Art. 5(1)(a), Art. 6(1)(f)","Data principles, Data subject rights, Processor obligations, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-46-2022.pdf","https://www.enforcementtracker.com/ETid-1121","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_46/2022","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/IT/136","Garante per la protezione dei dati personali (Italy) - 9759779","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-04-01","day",null,"None","EUR","G.O.L. Impresa Sociale S.r.l.",null,"Art. 58(2)(f), Art. 85, Art. 9","Special categories",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9759779","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9759779",null,"gdprhub",null,null,"gol impresa sociale srl",null,null,null,null,null,null,null,null,null],["2022/SE/011","IMY (Sweden) - DI-2020-10547","gdprhub","Sweden","SE","IMY (Sweden)","2022-04-01","day",null,null,null,null,null,"Art. 12(3), Art. 21, Art. 58(2)(b), Art. 6(1)","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://edpb.europa.eu/system/files/2022-10/se_2022-04_decisionpublic.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-10547",null,"gdprhub",null,"Newspaper subscription service",null,null,null,null,null,null,null,null,null,null],["2022/DK/016","Datatilsynet (Denmark) - 2021-32-2438","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-03-31","day",null,"None","EUR",null,null,"Art. 12(5)(b), Art. 15","Data subject rights, Transparency",null,"Rejected","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/mar/tidligere-arbejdsgiver-kunne-afvise-at-efterkomme-anmodning-om-indsigt","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-32-2438",null,"gdprhub",null,"Former employer",null,null,null,null,null,null,null,null,null,null],["2022/HU/017","ETid-1169","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-03-29","day",1300,null,"EUR","Workshop","Industry and Commerce","Art. 6(1)(f)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=521:munkahelyi-kameras-megfigyeles-jogalapjanak-es-arrol-valo-tajekoztatasnak-jogszerusege","https://www.enforcementtracker.com/ETid-1169",null,null,null,null,"HU: workshop",null,null,null,null,null,null,null,null,null],["2022/SE/012","IMY (Sweden) - DI-2021-4664","gdprhub","Sweden","SE","IMY (Sweden)","2022-03-29","day",null,null,null,"Ellos Group AB",null,"Art. 32(1), Art. 5(1)(f), Art. 58(2)(b)","Data principles, Data security",null,"Violation found","https://edpb.europa.eu/system/files/2022-10/se_2022-03_decisionpublic.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-4664",null,"gdprhub",null,null,"ellos group ab",null,null,null,null,null,null,null,null,null],["2022/HU/022","NAIH (Hungary) - NAIH-1006-3/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-03-29","day",null,"500,000","HUF",null,null,"Art. 13(1), Art. 13(2), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(f)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=521:munkahelyi-kameras-megfigyeles-jogalapjanak-es-arrol-valo-tajekoztatasnak-jogszerusege","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-1006-3/2022",null,"gdprhub",null,"Car repair shop",null,null,500000.0,1352,"day 2022-03-29|369.8000|HUF",null,null,null,null,null],["2022/RO/041","ETid-1111","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-03-28","day",2000,null,"EUR","Condor SA","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_28_03_2022&lang=ro","https://www.enforcementtracker.com/ETid-1111",null,null,null,null,"condor sa",null,null,null,null,null,null,null,null,null],["2022/SE/001","ETid-1112","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2022-03-28","day",720000,null,"EUR","Klarna Bank AB","Finance, Insurance and Consulting","Art. 12(1), Art. 13(2)(f), Art. 14(2)(g), Art. 5(1)(a), Art. 5(2)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.imy.se/nyheter/sanktionsavgift-mot-klarna-efter-granskning/","https://www.enforcementtracker.com/ETid-1112",null,null,null,null,"klarna bank ab","Klarna",null,null,null,null,null,null,null,null],["2022/SE/005","IMY (Sweden) - DI-2019-4062","gdprhub","Sweden","SE","IMY (Sweden)","2022-03-28","day",null,"7500000","SEK","Klarna Bank AB",null,"Art. 12(1), Art. 13(1)(c), Art. 13(1)(e), Art. 13(1)(f), Art. 13(2)(a), Art. 13(2)(b), Art. 13(2)(f), Art. 14(2)(g), Art. 5(1)(a), Art. 5(2)","Data principles, Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2022/beslut-tillsyn-klarna.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2019-4062",null,"gdprhub",null,null,"klarna bank ab","Klarna",7500000.0,719597,"day 2022-03-28|10.4225|SEK",null,null,null,null,null],["2022/BE/044","APD/GBA (Belgium) - 42/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-03-25","day",null,null,null,"Federal Public Service Finance",null,"Art. 15, Art. 6(1)(f)","Data subject rights, Unlawful processing",null,"Rejected","https://www.autoriteprotectiondonnees.be/publications/classement-sans-suite-n-42-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_42/2022",null,"gdprhub",null,null,"BE: federal public service finance",null,null,null,null,null,null,null,null,null],["2022/DK/007","ETid-1106","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2022-03-25","day",6700,null,"EUR","Danish National Genome Center","Health Care","Art. 36","DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2022/mar/nationalt-genom-center-indstilles-til-boede","https://www.enforcementtracker.com/ETid-1106",null,null,null,null,"DK: danish national genome center",null,null,null,null,null,null,null,null,null],["2022/RO/042","ETid-1110","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-03-25","day",2000,null,"EUR","Kaufland Romania SCS","Industry and Commerce","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_25_03_2022_1&lang=ro","https://www.enforcementtracker.com/ETid-1110",null,null,null,null,"kaufland romania scs",null,null,null,null,null,null,null,null,null],["2022/IT/106","ETid-1150","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-03-24","day",10000,null,"EUR","Brav s.r.l.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9767635","https://www.enforcementtracker.com/ETid-1150",null,null,null,null,"brav srl",null,null,null,null,null,null,null,null,null],["2022/IT/137","Garante per la protezione dei dati personali (Italy) - 9771142","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-03-24","day",4240000,"4.240.000","EUR","Uber B.V.",null,null,null,null,"Violation found","https://garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9771142","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9771142",null,"gdprhub",null,null,"uber bv","Uber",null,null,null,null,null,null,null,null],["2022/PL/004","ETid-1568","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-03-23","day",490,null,"EUR",null,null,"Art. 31, Art. 58(1)(e)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/pl/138/2593https://www.uodo.gov.pl/decyzje/DKE.561.18.2021","https://www.enforcementtracker.com/ETid-1568",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/FI/007","Tietosuojavaltuutetun toimisto (Finland) - 2437/161/22","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-03-23","day",null,"None","EUR","Finnish Ministry of Foreign Affairs",null,"Art. 33, Art. 34, Art. 58(2)(b)","Data breach",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221363","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_2437/161/22",null,"gdprhub",null,null,"FI: finnish ministry of foreign affairs",null,null,null,null,null,null,null,null,null],["2022/CY/014","ETid-1108","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022-03-22","day",4000,null,"EUR","English School Cyprus","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/A6CFBF507FD03C3CC225880F004565E1/$file/ΑΠΟΦΑΣΗ%20Αγγλική%20Σχολή%2022-03-2022.pdf","https://www.enforcementtracker.com/ETid-1108",null,null,null,null,"CY: english school cyprus",null,null,null,null,null,null,null,null,null],["2022/CY/013","ETid-1109","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022-03-21","day",5000,null,"EUR","English School staff union (ESSA)","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/A6CFBF507FD03C3CC225880F004565E1/$file/ΑΠΟΦΑΣΗ%20ESSA%2021-03-2022.pdf","https://www.enforcementtracker.com/ETid-1109",null,null,null,null,"CY: english school staff union",null,null,null,null,null,null,null,null,null],["2022/BE/016","APD/GBA (Belgium) - 41/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-03-18","day",null,"None","EUR",null,null,"Art. 5(1)(c), Art. 5(1)(e), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Rejected","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-41-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_41/2022",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2022/DK/014","Datatilsynet (Denmark) - 2021-32-2132","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-03-18","day",null,"None","EUR","A Danish municipality (redacted)",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/mar/datatilsynet-udtaler-alvorlig-kritik-af-en-kommune-for-at-videregive-unoedvendige-oplysninger-om-en-ansat","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-32-2132",null,"gdprhub",null,null,"DK: a danish municipality",null,null,null,null,null,null,null,null,null],["2022/SE/008","IMY (Sweden) - DI-2021-10488","gdprhub","Sweden","SE","IMY (Sweden)","2022-03-18","day",null,null,null,"Klarna Bank AB",null,"Art. 12(3), Art. 17, Art. 58(2)(b)","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-09/se_2022-03_decisionpublic.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-10488",null,"gdprhub",null,null,"klarna bank ab","Klarna",null,null,null,null,null,null,null,null],["2022/FI/021","Tietosuojavaltuutetun toimisto (Finland) - 8979/162/21","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-03-18","day",null,null,null,"City of Oulu",null,"Art. 10, Art. 4(2), Art. 58(2)(b), Art. 6(1)","Special categories, Unlawful processing",null,"Violation found","https://www.finlex.fi/fi/viranomaiset/tsv/2022/20221323","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8979/162/21",null,"gdprhub",null,null,"FI: city of oulu",null,null,null,null,null,null,null,null,null],["2022/BE/015","APD/GBA (Belgium) - 39/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-03-17","day",null,"None","EUR",null,null,"Art. 12(3), Art. 17(1)","Data subject rights, Transparency",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-39-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_39/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DK/015","Datatilsynet (Denmark) - 2021-431-0145","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-03-17","day",null,"None","EUR","FysioDanmark",null,"Art. 4(11), Art. 6, Art. 7, Art. 9","Consent, Special categories, Unlawful processing",null,"Other Outcome","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/mar/datatilsynet-har-truffet-afgoerelse-i-en-sag-om-brugen-af-et-system-til-ansigtsgenkendelse","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0145",null,"gdprhub",null,null,"DK: fysiodanmark",null,null,null,null,null,null,null,null,null],["2022/NO/015","Datatilsynet (Norway) - 20/02368","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-03-15","day",null,"100000","NOK","Redacted",null,"Art. 13, Art. 21, Art. 24, Art. 6(1)(f)","Accountability, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2022/gebyr-for-automatisk-videresending-av-e-post/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02368",null,"gdprhub",null,null,null,null,100000.0,10153,"day 2022-03-15|9.8490|NOK",null,null,null,null,null],["2022/IE/007","ETid-1094","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2022-03-15","day",17000000,null,"EUR","Meta Platforms Ireland Limited","Media, Telecoms and Broadcasting","Art. 24(1), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-meta-facebook-inquiry","https://www.enforcementtracker.com/ETid-1094","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_Meta_Platforms","gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2022/NO/005","ETid-1181","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2022-03-15","day",9700,null,"EUR","Company","Employment","Art. 13, Art. 21, Art. 6(1)","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/08439c79981a499f86fd9faebac1855d/20-02368-8-sladdet-versjon.pdf","https://www.enforcementtracker.com/ETid-1181",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/IE/010","DPC (Ireland) - DPC Case Reference: IN-19-9-5","gdprhub","Ireland","IE","DPC (Ireland)","2022-03-14","day",463000,"463,000","EUR","Bank of Ireland",null,"Art. 32, Art. 33, Art. 34, Art. 4(12)","Data breach, Data security",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2022-04/Final%20Decision%20in%20Inquiry%20IN-19-9-5%20%2831.03.2022%29.pdf","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_DPC_Case_Reference%3A_IN-19-9-5",null,"gdprhub",null,null,"IE: bank of ireland",null,null,null,null,null,null,null,null,null],["2022/IS/006","Persónuvernd (Iceland) - 2020031451","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-03-14","day",null,"None","EUR",null,null,"Art. 24, Art. 25, Art. 32, Art. 5(1)(f), Art. 6, Art. 9","Accountability, Data principles, Data security, Special categories, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-grunnskola-a-vidkvaemum-personuupplysingum-um-barn-ekki-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020031451",null,"gdprhub",null,"Primary school",null,null,null,null,null,null,null,null,null,null],["2022/BE/014","APD/GBA (Belgium) - 32/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-03-10","day",null,"None","EUR",null,null,"Art. 14, Art. 15, Art. 21, Art. 5(1)(c), Art. 5(1)(e), Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/ordonnance-n-32-2022.pdf?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=de","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_32/2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/BE/017","APD/GBA (Belgium) - 33/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-03-10","day",null,"None","EUR","Y1 and Y2",null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 24, Art. 25, Art. 32, Art. 33, Art. 5(1)(f), Art. 5(2), Art. 58(2)(a), Art. 58(2)(c)","Accountability, Data breach, Data principles, Data security, Data subject rights, Transparency",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/ordonnance-n-33-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_33/2022",null,"gdprhub",null,null,"BE: y1 and y2",null,null,null,null,null,null,null,null,null],["2022/RO/043","ETid-1096","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-03-10","day",2000,null,"EUR","Operatorul Briza Land S.R.L.","Industry and Commerce","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_10_03_2022_3&lang=ro","https://www.enforcementtracker.com/ETid-1096","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Briza_Land_SRL","gdprhub",null,null,"operatorul briza land srl",null,null,null,null,null,null,null,null,null],["2022/IT/109","ETid-1127","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-03-10","day",10000,null,"EUR","Azienda USL Toscana Centro","Health Care","Art. 32, Art. 9","Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9762945","https://www.enforcementtracker.com/ETid-1127","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9762945","gdprhub",null,null,"IT: azienda usl toscana centro",null,null,null,null,null,null,null,null,null],["2022/IT/108","ETid-1131","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-03-10","day",6000,null,"EUR","Azienda sanitaria provinciale di Caltanissetta","Health Care","Art. 12, Art. 15, Art. 37, Art. 5, Art. 6","Data principles, Data protection officer, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9763051","https://www.enforcementtracker.com/ETid-1131",null,null,null,null,"IT: azienda sanitaria provinciale di caltanissetta",null,null,null,null,null,null,null,null,null],["2022/IT/107","ETid-1133","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-03-10","day",8000,null,"EUR","Agenzia Regionale per la Tutela dell'Ambiente dell'Abruzzo","Employment","Art. 10, Art. 6","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9761383","https://www.enforcementtracker.com/ETid-1133","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9761383","gdprhub",null,null,"IT: agenzia regionale per la tutela dell ambiente dell abruzzo",null,null,null,null,null,null,null,null,null],["2022/IT/102","ETid-1177","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-03-10","day",10000,null,"EUR","Alfa Shipyard s.r.l.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9771574","https://www.enforcementtracker.com/ETid-1177",null,null,null,null,"alfa shipyard srl",null,null,null,null,null,null,null,null,null],["2022/GB/005","ETid-1188","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2022-03-10","day",115000,null,"EUR","Tuckers Solicitors LLP","Finance, Insurance and Consulting","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://ico.org.uk/media/action-weve-taken/mpns/4019746/tuckers-mpn-20220228.pdf","https://www.enforcementtracker.com/ETid-1188","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Tuckers_Solicitors_LLP","gdprhub",null,null,"GB: tuckers solicitors llp",null,null,null,null,null,null,null,null,null],["2022/EE/003","AKI (Estonia) - EDPBI:ee:OSS:d:2022:343","gdprhub","Estonia","EE","AKI (Estonia)","2022-03-09","day",null,null,null,null,null,"Art. 17(1)(c), Art. 5(1)(e), Art. 58(2)(b), Art. 60, Art. 7(2)","Consent, Data principles, Data subject rights",null,"Violation found","https://edpb.europa.eu/system/files/2022-09/ee_2022-03_decisionpublic.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_EDPBI%3Aee%3AOSS%3Ad%3A2022%3A343",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/GR/019","ETid-1107","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-03-09","day",2000,null,"EUR","Employer","Employment","Art. 13, Art. 5(1)(a), Art. 5(2)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-dioikitikoy-prostimoy-se-ergodotria-gia-mi-ikanopoiisi","https://www.enforcementtracker.com/ETid-1107",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/GR/018","ETid-1113","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-03-09","day",2000,null,"EUR","Foreign language school","Employment","Art. 13, Art. 5(1)(a), Art. 5(2)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://edpb.europa.eu/news/national-news/2022/greek-sa-fine-imposed-employer-failure-satisfy-right-object-and-unlawful_en","https://www.enforcementtracker.com/ETid-1113",null,null,null,null,"GR: foreign language school",null,null,null,null,null,null,null,null,null],["2022/GR/025","HDPA (Greece) - 12/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-03-09","day",2000,"2000","EUR",null,null,"Art. 13, Art. 5(1)(a), Art. 5(2)","Data principles, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2022-03/12_2022anonym_0.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_12/2022",null,"gdprhub",null,"Private school",null,null,null,null,null,null,null,null,null,null],["2022/HR/014","ETid-1092","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-03-08","day",124245,null,"EUR",null,"Transportation and Energy","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://azop.hr/izrecene-upravne-novcane-kazne-u-ukupnom-iznosu-od-1-6-milijuna-kuna/","https://www.enforcementtracker.com/ETid-1092",null,null,null,"Energy company",null,null,null,null,null,null,null,null,null,null],["2022/HR/013","ETid-1093","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2022-03-08","day",89250,null,"EUR",null,"Industry and Commerce","Art. 32(2), Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izrecene-upravne-novcane-kazne-u-ukupnom-iznosu-od-1-6-milijuna-kuna/","https://www.enforcementtracker.com/ETid-1093",null,null,null,"Retail company",null,null,null,null,null,null,null,null,null,null],["2022/IS/003","ETid-1097","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2022-03-08","day",7000,null,"EUR","Hörpu tónlistar- og ráðstefnuhúss ohf.","Industry and Commerce","Art. 5(1)(c), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/sofnun-personuupplysinga-vegna-kaupa-a-adgongumida-a-vidburd-i-horpu-sektarakvordun","https://www.enforcementtracker.com/ETid-1097","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020010611","gdprhub",null,null,"IS: horpu tonlistar og rastefnuhuss ohf",null,null,null,null,null,null,null,null,null],["2022/IS/005","Persónuvernd (Iceland) - 2020112830","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2022-03-08","day",null,"None","EUR","Reykjavík University",null,"Art. 13, Art. 32, Art. 5(1)(a), Art. 6(1)(f)","Data principles, Data security, Transparency, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/rafraen-yfirseta-profa-haskolans-i-reykjavik-ekki-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020112830",null,"gdprhub",null,null,"IS: reykjavik university",null,null,null,null,null,null,null,null,null],["2022/ES/236","DBEB/AVPD (Basque Country) - CN21-012","gdprhub","Spain","ES","DBEB/AVPD (Basque Country)","2022-03-07","day",null,null,null,null,null,"Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(e)","Data principles, Unlawful processing",null,null,"https://www.avpd.euskadi.eus/contenidos/dictamen_avpd/d22_005/es_def/adjuntos/CN21-012_DIC_D22-005.pdf","https://gdprhub.eu/index.php?title=DBEB/AVPD_%28Basque_Country%29_-_CN21-012",null,"gdprhub",null,"Local police force",null,null,null,null,null,null,null,null,null,null],["2022/GB/010","ICO (UK) - Royal Mail Group Limited","gdprhub","United Kingdom","GB","ICO (UK)","2022-03-07","day",null,"20,000","GBP","Royal Mail Group Limited",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4019745/royal-mail-group-mpn-20220307.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Royal_Mail_Group_Limited",null,"gdprhub",null,null,"royal mail group ltd",null,20000.0,24206,"day 2022-03-07|0.8263|GBP",null,null,null,null,null],["2022/DK/013","Datatilsynet (Denmark) - 2021-431-0138","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-03-04","day",null,"None","EUR","e-Boks",null,"Art. 32(1), Art. 4(12)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/mar/e-boks-faar-kritik-for-ikke-at-have-passende-sikkerhed","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0138",null,"gdprhub",null,null,"DK: e boks",null,null,null,null,null,null,null,null,null],["2022/DK/012","Datatilsynet (Denmark) - 2021-442-12425","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-03-04","day",null,"None","EUR","Danish Agency for Digitisation",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/mar/digitaliseringsstyrelsen-faar-kritik-for-ikke-at-have-haft-passende-sikkerhed","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-442-12425",null,"gdprhub",null,null,"DK: danish agency for digitisation",null,null,null,null,null,null,null,null,null],["2022/NO/003","ETid-1259","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2022-03-04","day",195000,null,"EUR","Norwegian Parliament","Public Sector and Education","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2022/overtredelsesgebyr-til-stortinget/","https://www.enforcementtracker.com/ETid-1259",null,null,null,null,"NO: norwegian parliament",null,null,null,null,null,null,null,null,null],["2022/MT/006","IDPC (Malta) - EDPBI:MT:OSS:D:2022:341","gdprhub","Malta","MT","IDPC (Malta)","2022-03-04","day",null,null,null,null,null,"Art. 12(2), Art. 15, Art. 58(2)(b), Art. 58(2)(d), Art. 61","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-09/mt_2022-03decisionpublic.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_EDPBI%3AMT%3AOSS%3AD%3A2022%3A341",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/051","ETid-1103","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022-03-03","day",1900000,null,"EUR","BREBAU GmbH","Real Estate","Art. 5(1), Art. 6(1), Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datenschutz.bremen.de/sixcms/media.php/13/Pressemitteilung%20LfDI%20Bremen.pdf","https://www.enforcementtracker.com/ETid-1103","https://gdprhub.eu/index.php?title=LfDI_%28Bremen%29_-_03/2022","gdprhub",null,null,"brebau gmbh",null,null,null,null,null,null,null,null,null],["2022/DK/011","Datatilsynet (Denmark) - 2021-423-0236","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-03-02","day",null,"None","EUR","Høje-Taastrup Municipality",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/mar/tilsyn-med-hoeje-taastrup-kommunes-adgangsrettigheder-i-filsystemer#_ftn3","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-423-0236",null,"gdprhub",null,null,"DK: hje taastrup municipality",null,null,null,null,null,null,null,null,null],["2022/HU/018","ETid-1138","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-03-02","day",13500,null,"EUR","Company","Industry and Commerce","Art. 12(2), Art. 17(1)(b), Art. 5(2), Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=513:szemelyes-adatok-nyilvanossagra-hozatala-online-tudakozoban","https://www.enforcementtracker.com/ETid-1138",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HU/019","NAIH (Hungary) - NAIH-175-12/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-03-02","day",null,"6,000,000","HUF",null,null,"Art. 13, Art. 5(1)(a), Art. 5(1)(b), Art. 5(2), Art. 6(1)(a), Art. 9(1), Art. 9(2)(a)","Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://naih.hu//hatarozatok-vegzesek?download=503:kozos-nevezo-2018-part-es-dr-godeny-gyorgy-alairasgyujteshez-kapcsolodo-adatkezelesenek-jogszerusege","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-175-12/2022",null,"gdprhub",null,"Organisation and its chair",null,null,6000000.0,15694,"day 2022-03-02|382.3100|HUF",null,null,null,null,null],["2022/HU/020","NAIH (Hungary) - NAIH-180-16/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2022-03-02","day",null,"5000000","HUF",null,null,"Art. 12(2), Art. 5(2), Art. 6(1), Art. 84(2)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=513:szemelyes-adatok-nyilvanossagra-hozatala-online-tudakozoban","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-180-16/2022",null,"gdprhub",null,"Telecom operator",null,null,5000000.0,13078,"day 2022-03-02|382.3100|HUF",null,null,null,null,null],["2022/AT/011","DSB (Austria) - 2022-0.021.739","gdprhub","Austria","AT","DSB (Austria)","2022-03-01","day",null,null,null,null,null,"Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220301_2022_0_021_739_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.021.739",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/MT/007","IDPC (Malta) - CDP/IMI/LSA/17/2022","gdprhub","Malta","MT","IDPC (Malta)","2022-02-28","day",null,null,null,null,null,"Art. 12(1), Art. 12(3), Art. 17(1), Art. 17(3), Art. 56, Art. 60","Data subject rights, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-09/mt_2022-03_decisionpublic.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_CDP/IMI/LSA/17/2022",null,"gdprhub",null,"Investment services provider",null,null,null,null,null,null,null,null,null,null],["2022/NO/013","Datatilsynet (Norway) - 21/01164","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-02-24","day",null,"300000","NOK","Elit Elektro AS",null,"Art. 13, Art. 21, Art. 24, Art. 24(2), Art. 6(1)(f)","Accountability, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/01164",null,"gdprhub",null,null,"elit elektro as",null,300000.0,29739,"day 2022-02-24|10.0878|NOK",null,null,null,null,null],["2022/NL/007","ETid-1119","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2022-02-24","day",565000,null,"EUR","Dutch Foreign Ministry","Public Sector and Education","Art. 13(1)(e), Art. 32(1)","Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/nl/nieuws/boete-voor-buitenlandse-zaken-visumaanvragen-slecht-beveiligd-en-informatie-over-delen","https://www.enforcementtracker.com/ETid-1119","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_24.02.2022","gdprhub",null,null,"NL: dutch foreign ministry",null,null,null,null,null,null,null,null,null],["2022/ES/179","ETid-1087","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-23","day",1200,null,"EUR","FRUTAS Y VERDURAS LOS CAMPEONES, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00558-2021.pdf","https://www.enforcementtracker.com/ETid-1087",null,null,null,null,"frutas y verduras los campeones sl",null,null,null,null,null,null,null,null,null],["2022/ES/178","ETid-1090","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-23","day",1500,null,"EUR","WORLDWIDE CLASSIC CARS NETWORK S.L.","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00545-2021.pdf","https://www.enforcementtracker.com/ETid-1090",null,null,null,null,"worldwide classic cars network sl",null,null,null,null,null,null,null,null,null],["2022/IT/186","Garante per la protezione dei dati personali (Italy) - 9868646","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-02-23","day",null,null,null,"Bank of Italy",null,"Art. 5(1)(a), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9868646","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9868646",null,"gdprhub",null,null,"IT: bank of italy",null,null,null,null,null,null,null,null,null],["2022/RO/045","ETid-1082","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-02-22","day",1000,null,"EUR","Civil law firm \"Sabou, Burz & Cuc\"","Finance, Insurance and Consulting","Art. 5(2), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_22_02_2022_2&lang=ro","https://www.enforcementtracker.com/ETid-1082",null,null,null,null,"RO: civil law firm sabou burz and cuc",null,null,null,null,null,null,null,null,null],["2022/RO/044","ETid-1083","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-02-22","day",3000,null,"EUR","IAMSAT Muntenia SA","Employment","Art. 12, Art. 13, Art. 21","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_22_02_2022_1&lang=ro","https://www.enforcementtracker.com/ETid-1083",null,null,null,null,"iamsat muntenia sa",null,null,null,null,null,null,null,null,null],["2022/ES/181","ETid-1084","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-22","day",1000,null,"EUR","MALAGATROM, S.L.U.","Industry and Commerce","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00551-2021.pdf","https://www.enforcementtracker.com/ETid-1084",null,null,null,null,"malagatrom slu",null,null,null,null,null,null,null,null,null],["2022/ES/180","ETid-1086","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-22","day",3000,null,"EUR","Hotel operator","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00488-2021.pdf","https://www.enforcementtracker.com/ETid-1086",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/183","ETid-1080","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-21","day",1500,null,"EUR","RESTATURANTE FUENTEBRO, S.C.","Accommodation and Hospitality","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00463-2021.pdf","https://www.enforcementtracker.com/ETid-1080",null,null,null,null,"restaturante fuentebro sc",null,null,null,null,null,null,null,null,null],["2022/ES/182","ETid-1081","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-21","day",1000,null,"EUR","Store owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00517-2021.pdf","https://www.enforcementtracker.com/ETid-1081",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/EE/002","AKI (Estonia) - 18.02.2022","gdprhub","Estonia","EE","AKI (Estonia)","2022-02-18","day",null,null,null,null,null,"Art. 12(6), Art. 5(1), Art. 5(1)(a), Art. 60","Data principles, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-09/ee_2022-02_decisionpublic.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_18.02.2022",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/DK/009","Datatilsynet (Denmark) - 2020-442-8862","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-02-18","day",null,"None","EUR","Capital Region of Denmark",null,"Art. 32(1), Art. 33(3), Art. 34(2), Art. 58(2)(a), Art. 58(2)(d)","Data breach, Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/feb/alvorlig-kritik-paabud-og-advarsel-til-region-hovedstaden-efter-to-sikkerhedsbrud-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-442-8862",null,"gdprhub",null,null,"DK: capital region of denmark",null,null,null,null,null,null,null,null,null],["2022/ES/184","ETid-1079","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-18","day",2500,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00408-2021.pdf","https://www.enforcementtracker.com/ETid-1079",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2022/ES/185","ETid-1074","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-16","day",6000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)(a)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00432-2021.pdf","https://www.enforcementtracker.com/ETid-1074",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/GR/020","ETid-1077","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-02-15","day",30000,null,"EUR","ΛΙΜΕΝΟΣ ΗΡΑΚΛΕΙΟΥ Α.Ε.","Individuals and Private Associations","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2022-02/61_2021anonym.pdf","https://www.enforcementtracker.com/ETid-1077",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/AT/009","DSB (Austria) - 2022-0.083.310","gdprhub","Austria","AT","DSB (Austria)","2022-02-14","day",null,null,null,"Federal Minister of Finances",null,"Art. 2(2)(a), Art. 5(1)(b), Art. 58(2)(f), Art. 6(1)(c)","Data principles, Unlawful processing",null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220214_2022_0_083_310_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2022-0.083.310",null,"gdprhub",null,null,"AT: federal minister of finances",null,null,null,null,null,null,null,null,null],["2022/ES/187","ETid-1071","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-14","day",1600,null,"EUR","RECLAMADOR, S.L.","Finance, Insurance and Consulting","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00540-2021.pdf","https://www.enforcementtracker.com/ETid-1071",null,null,null,null,"reclamador sl",null,null,null,null,null,null,null,null,null],["2022/GB/013","ICO (UK) - The Money Hive Limited","gdprhub","United Kingdom","GB","ICO (UK)","2022-02-14","day",null,"50,000","GBP","The Money Hive Limited",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4019615/money-hive-mpn-20220214.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_The_Money_Hive_Limited",null,"gdprhub",null,null,"the money hive ltd",null,50000.0,59723,"day 2022-02-14|0.8372|GBP",null,null,null,null,null],["2022/ES/186","ETid-1073","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-11","day",2000000,null,"EUR","Amazon Road Transport Spain S.L.","Transportation and Energy","Art. 10, Art. 6(1)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00267-2020.pdf","https://www.enforcementtracker.com/ETid-1073",null,null,null,null,"amazon road transport spain sl","Amazon",null,null,null,null,null,null,null,null],["2022/HU/023","NAIH (Hungary) - NAIH-2727-2/2022.","gdprhub","Hungary","HU","NAIH (Hungary)","2022-02-11","day",null,"10000000","HUF",null,null,"Art. 12(1), Art. 12(4), Art. 13, Art. 15(3), Art. 5(1)(a), Art. 5(1)(b), Art. 5(2)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=524:koveteleskezelessel-osszefuggo-jogalap-nelkuli-adatkezeles-es-erintetti-kerelem-nem-megfelelo-teljesitese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2727-2/2022.",null,"gdprhub",null,"Debt management company",null,null,10000000.0,28298,"day 2022-02-11|353.3800|HUF",null,null,null,null,null],["2022/FR/010","CNIL (France) - Google Analytics (no case number)","gdprhub","France","FR","CNIL (France)","2022-02-10","day",null,"None","EUR","Google Analytics",null,"Art. 4(22), Art. 4(23)(b), Art. 4(7), Art. 44, Art. 45","International transfers",null,"Violation found","https://www.cnil.fr/sites/default/files/atoms/files/med_google_analytics_anonymisee.pdf","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_Google_Analytics_%28no_case_number%29",null,"gdprhub",null,null,"FR: google analytics","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/IT/117","ETid-1095","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",10000,null,"EUR","Costampress S.p.A.","Employment","Art. 12, Art. 13, Art. 5(1)(a)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9751137","https://www.enforcementtracker.com/ETid-1095","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9751137","gdprhub",null,null,"costampress spa",null,null,null,null,null,null,null,null,null],["2022/IT/116","ETid-1098","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",20000000,null,"EUR","Clearview Al Inc.","Industry and Commerce","Art. 12, Art. 13, Art. 14, Art. 15, Art. 27, Art. 6, Art. 9","Data principles, Data subject rights, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9751362","https://www.enforcementtracker.com/ETid-1098","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9751362","gdprhub",null,null,"clearview al inc","Clearview AI",null,null,null,null,null,null,null,null],["2022/IT/115","ETid-1099","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",3500,null,"EUR","Azienda socio sanitaria territoriale Melegnano e della Martesana","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9754355","https://www.enforcementtracker.com/ETid-1099","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9754355","gdprhub",null,null,"IT: azienda socio sanitaria territoriale melegnano e della martesana",null,null,null,null,null,null,null,null,null],["2022/IT/114","ETid-1100","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",10000,null,"EUR","Region of Tuscany","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9751498","https://www.enforcementtracker.com/ETid-1100",null,null,null,null,"IT: region of tuscany",null,null,null,null,null,null,null,null,null],["2022/IT/113","ETid-1101","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",10000,null,"EUR","Scanshare S.r.l.","Public Sector and Education","Art. 28(2), Art. 32","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9754332","https://www.enforcementtracker.com/ETid-1101","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9754332","gdprhub",null,null,"scanshare srl",null,null,null,null,null,null,null,null,null],["2022/IT/112","ETid-1102","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",2000,null,"EUR","Comune di Guidizzolo","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9751549","https://www.enforcementtracker.com/ETid-1102",null,null,null,null,"IT: comune di guidizzolo",null,null,null,null,null,null,null,null,null],["2022/IT/111","ETid-1122","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",5000,null,"EUR","Arte del vivere S.r.l.","Individuals and Private Associations","Art. 12, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9756853","https://www.enforcementtracker.com/ETid-1122","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9756853","gdprhub",null,null,"arte del vivere srl",null,null,null,null,null,null,null,null,null],["2022/IT/110","ETid-1123","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-02-10","day",1500,null,"EUR","Studio Colli Aniene Verderocca S.r.l.","Industry and Commerce","Art. 12(3), Art. 14, Art. 15, Art. 17, Art. 21","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9756869","https://www.enforcementtracker.com/ETid-1123","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9756869","gdprhub",null,null,"studio colli aniene verderocca srl",null,null,null,null,null,null,null,null,null],["2022/HU/016","ETid-1244","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022-02-08","day",634000,null,"EUR","Budapest Bank Zrt.","Finance, Insurance and Consulting","Art. 12(1), Art. 13, Art. 14, Art. 24(1)","Accountability, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=517:mesterseges-intelligencia-alkalmazasanak-adatvedelmi-kerdesei","https://www.enforcementtracker.com/ETid-1244","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-85-3/2022","gdprhub",null,null,"budapest bank zrt",null,null,null,null,null,null,null,null,null],["2022/ES/190","ETid-1060","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-07","day",1000,null,"EUR","Cafe operator","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00494-2021.pdf","https://www.enforcementtracker.com/ETid-1060",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/188","ETid-1062","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-07","day",10000,null,"EUR","PINTODIS, S.L.","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00337-2021.pdf","https://www.enforcementtracker.com/ETid-1062",null,null,null,null,"pintodis sl",null,null,null,null,null,null,null,null,null],["2022/GB/009","ICO (UK) - Tempcover Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2022-02-07","day",null,"85,000","GBP","Tempcover Ltd",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4019583/tempcover-ltd-mpn-7-february-2022.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Tempcover_Ltd",null,"gdprhub",null,null,"tempcover ltd",null,85000.0,100372,"day 2022-02-07|0.8468|GBP",null,null,null,null,null],["2022/AT/005","DSB (Austria) - 2021-0.347.702","gdprhub","Austria","AT","DSB (Austria)","2022-02-04","day",null,null,null,null,null,"Art. 6(1)(f), Art. 9(2)(f)","Special categories, Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20220204_2021_0_347_702_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.347.702",null,"gdprhub",null,"Law firm",null,null,null,null,null,null,null,null,null,null],["2022/ES/197","ETid-1052","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-04","day",900,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00460-2021.pdf","https://www.enforcementtracker.com/ETid-1052",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2022/ES/196","ETid-1053","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-04","day",300000,null,"EUR","SEGURCAIXA ADESLAS, S.A. DE SEGUROS Y REASEGUROS","Finance, Insurance and Consulting","Art. 17, Art. 28, Art. 6","Data subject rights, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00322-2021.pdf","https://www.enforcementtracker.com/ETid-1053",null,null,null,null,"segurcaixa adeslas sa de seguros y reaseguros",null,null,null,null,null,null,null,null,null],["2022/ES/189","ETid-1061","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-04","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)(a)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00505-2021.pdf","https://www.enforcementtracker.com/ETid-1061",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/CY/011","ETid-1266","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022-02-04","day",10000,null,"EUR","Εκδοτικού Οίκου Δίας","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/1978BD92BBEDDA44C225887F002107BD?OpenDocument","https://www.enforcementtracker.com/ETid-1266",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DK/008","Datatilsynet (Denmark) - 2021-31-4751","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-02-03","day",null,"None","EUR","TV 2",null,"Art. 12, Art. 14, Art. 6(1)(c), Art. 6(1)(f), Art. 9(2)(b), Art. 9(2)(f)","Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/feb/alvorlig-kritik-af-tv-2-og-norrbom-vinding","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-4751",null,"gdprhub",null,null,"DK: tv 2",null,null,null,null,null,null,null,null,null],["2022/NO/012","Datatilsynet (Norway) - 21/03177","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-02-02","day",null,"300000","NOK","Lillestrøm municipality",null,"Art. 32(1)(b), Art. 5, Art. 6","Data principles, Data security, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2022/gebyr-til-lillestrom-kommune/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/03177",null,"gdprhub",null,null,"NO: lillestrm municipality",null,300000.0,30233,"day 2022-02-02|9.9228|NOK",null,null,null,null,null],["2022/ES/198","ETid-1047","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-02","day",2000,null,"EUR","ASESORES DE SEGURIDAD PRIVADA, S.L.","Finance, Insurance and Consulting","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00221-2021.pdf","https://www.enforcementtracker.com/ETid-1047",null,null,null,null,"asesores de seguridad privada sl",null,null,null,null,null,null,null,null,null],["2022/BE/010","ETid-1051","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-02-02","day",null,null,"EUR","IAB Europe","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13, Art. 14, Art. 24(1), Art. 30, Art. 31, Art. 37, Art. 5(1)(a), Art. 5(2), Art. 6(1)","Accountability, Data principles, Data protection officer, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotectionauthority.be/iab-europe-held-responsible-for-a-mechanism-that-infringes-the-gdpr","https://www.enforcementtracker.com/ETid-1051",null,null,null,null,"BE: iab europe",null,null,null,null,null,null,null,null,null],["2022/NO/006","ETid-1149","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2022-02-02","day",30000,null,"EUR","Lillestrøm Municipality","Public Sector and Education","Art. 32(1)(b), Art. 5, Art. 6","Data principles, Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/425ef2f0fb5e4af3ac8e0cd97da648b8/vedtak-om-overtredelsesgebyr---melding-om-avvik---lillestrom-kommune-sentraladministrasjonen.pdf","https://www.enforcementtracker.com/ETid-1149",null,null,null,null,"NO: lillestrm municipality",null,null,null,null,null,null,null,null,null],["2022/LU/012","ETid-1167","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2022-02-02","day",1000,null,"EUR","Café owner","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2022/decision-3fr-2022-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1167",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/FI/006","Tietosuojavaltuutetun toimisto (Finland) - 2245/163/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-02-02","day",null,"None","EUR","Company X",null,"Art. 25, Art. 25(2), Art. 5(1)(c)","Accountability, Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221283","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_2245/163/2019",null,"gdprhub",null,null,"FI: company x",null,null,null,null,null,null,null,null,null],["2022/RO/046","ETid-1018","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-02-01","day",1000,null,"EUR","SC Grupex 2000 SRL","Health Care","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_01_02_2022_2&lang=ro","https://www.enforcementtracker.com/ETid-1018","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_SC_Grupex_2000_SRL","gdprhub",null,null,"grupex 2000 srl",null,null,null,null,null,null,null,null,null],["2022/ES/195","ETid-1055","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-01","day",3940000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(f), Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00001-2021.pdf","https://www.enforcementtracker.com/ETid-1055",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/ES/194","ETid-1056","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-01","day",70000,null,"EUR","ORANGE ESPAÑA VIRTUAL, S.L.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00046-2021.pdf","https://www.enforcementtracker.com/ETid-1056",null,null,null,null,"orange espana virtual sl","Orange",null,null,null,null,null,null,null,null],["2022/ES/193","ETid-1057","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-01","day",700000,null,"EUR","Orange Espagne S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00022-2021.pdf","https://www.enforcementtracker.com/ETid-1057",null,null,null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2022/ES/192","ETid-1058","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-01","day",200000,null,"EUR","XFERA MÓVILES, S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00027-2021.pdf","https://www.enforcementtracker.com/ETid-1058",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2022/ES/191","ETid-1059","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-02-01","day",900000,null,"EUR","TELEFÓNICA MÓVILES ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00021-2021.pdf","https://www.enforcementtracker.com/ETid-1059",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2022/NO/007","ETid-1070","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2022-02-01","day",5000,null,"EUR","Etterforsker1 Gruppen AS","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/81543616aa3049f8be77b0b3ab66d353/vedtak-om-palegg-og-overtredelsesgebyr---etterforsker1.pdf","https://www.enforcementtracker.com/ETid-1070","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/02504","gdprhub",null,null,"etterforsker1 gruppen as",null,null,null,null,null,null,null,null,null],["2022/DK/010","Datatilsynet (Denmark) - 2021-31-5439","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2022-01-31","day",null,"None","EUR","DBA",null,"Art. 17(1)(a), Art. 17(1)(c), Art. 21(1), Art. 6(1)(d), Art. 6(1)(f)","Data subject rights, Unlawful processing",null,"Rejected","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2022/jan/dba-var-berettiget-til-at-afslaa-en-anmodning-om-sletning","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-31-5439",null,"gdprhub",null,null,"DK: dba",null,null,null,null,null,null,null,null,null],["2022/ES/201","ETid-1019","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-31","day",1500,null,"EUR","Property Owner Community","Real Estate","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00458-2021.pdf","https://www.enforcementtracker.com/ETid-1019",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/200","ETid-1020","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-31","day",5000,null,"EUR","Cyrana España General S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00535-2021.pdf","https://www.enforcementtracker.com/ETid-1020",null,null,null,null,"cyrana espana general sl",null,null,null,null,null,null,null,null,null],["2022/ES/199","ETid-1021","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-31","day",5000,null,"EUR","INCOPROSOL, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00469-2021.pdf","https://www.enforcementtracker.com/ETid-1021",null,null,null,null,"incoprosol sl",null,null,null,null,null,null,null,null,null],["2022/GB/008","ICO (UK) - Home2sense Limited","gdprhub","United Kingdom","GB","ICO (UK)","2022-01-31","day",null,"200000","GBP","Home2sense Limited",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4019530/home2sense-mpn-20220202.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Home2sense_Limited",null,"gdprhub",null,null,"home2sense ltd",null,200000.0,240520,"day 2022-01-31|0.8315|GBP",null,null,null,null,null],["2022/DE/052","BfDI (Germany) - 24-191 II","gdprhub","Germany","DE","BfDI (Germany)","2022-01-27","day",null,"None","EUR","Deusche Telekom AG",null,"Art. 15, Art. 20, Art. 95","Data subject rights",null,"Violation found",null,"https://gdprhub.eu/index.php?title=BfDI_%28Germany%29_-_24-191_II",null,"gdprhub",null,null,"deusche telekom ag",null,null,null,null,null,null,null,null,null],["2022/BE/012","ETid-1022","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-01-27","day",1200,null,"EUR","Researcher","Individuals and Private Associations","Art. 12, Art. 14, Art. 32, Art. 6(1), Art. 9","Data principles, Data security, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-13-2022.pdf","https://www.enforcementtracker.com/ETid-1022",null,null,null,null,"BE: researcher",null,null,null,null,null,null,null,null,null],["2022/BE/011","ETid-1023","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2022-01-27","day",2800,null,"EUR","EU DisinfoLab","Individuals and Private Associations","Art. 12, Art. 14, Art. 30, Art. 32, Art. 35, Art. 6(1), Art. 9","DPIA, Data principles, Data security, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-13-2022.pdf","https://www.enforcementtracker.com/ETid-1023",null,null,null,null,"BE: eu disinfolab",null,null,null,null,null,null,null,null,null],["2022/GR/022","ETid-1024","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-01-27","day",6000000,null,"EUR","Cosmote Mobile Telecommunications S.A.","Media, Telecoms and Broadcasting","Art. 13, Art. 14, Art. 25(1), Art. 26, Art. 28, Art. 35(7), Art. 5(1)(a), Art. 5(2)","Accountability, DPIA, Data principles, Data security, Processor obligations, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2022-01/4_2022%20anonym%20%282%29_0.pdf","https://www.enforcementtracker.com/ETid-1024",null,null,null,null,"cosmote mobile telecommunications sa",null,null,null,null,null,null,null,null,null],["2022/GR/021","ETid-1025","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-01-27","day",3200000,null,"EUR","OTE Group","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2022-01/4_2022%20anonym%20%282%29_0.pdf","https://www.enforcementtracker.com/ETid-1025",null,null,null,null,"GR: ote group",null,null,null,null,null,null,null,null,null],["2022/IT/119","ETid-1076","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-01-27","day",2000,null,"EUR","Private club \"Ruian\"","Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9746047","https://www.enforcementtracker.com/ETid-1076",null,null,null,null,"IT: private club ruian",null,null,null,null,null,null,null,null,null],["2022/IT/118","ETid-1078","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-01-27","day",40000,null,"EUR","T.S.M. s.r.l.","Industry and Commerce","Art. 13, Art. 15, Art. 21","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9746068","https://www.enforcementtracker.com/ETid-1078","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9746068","gdprhub",null,null,"IT: tsmsrl",null,null,null,null,null,null,null,null,null],["2022/IT/126","Garante per la protezione dei dati personali (Italy) - 9747505","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2022-01-27","day",null,"None","EUR","Google",null,"Art. 5(1)(e)","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9747505","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9747505",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2022/SE/003","ETid-1013","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2022-01-26","day",28500,null,"EUR","Uppsala regional board","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2022/beslut-regionstyrelsen-region-uppsala.pdf","https://www.enforcementtracker.com/ETid-1013",null,null,null,null,"SE: uppsala regional board",null,null,null,null,null,null,null,null,null],["2022/SE/002","ETid-1014","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2022-01-26","day",152000,null,"EUR","Uppsala hospital board","Health Care","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2022/beslut-sjukhusstyrelsen-region-uppsala.pdf","https://www.enforcementtracker.com/ETid-1014","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2021-5595","gdprhub",null,null,"SE: uppsala hospital board",null,null,null,null,null,null,null,null,null],["2022/IE/003","ETid-1519","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2022-01-26","day",5000,null,"EUR","Slane Credit Union Ltd.","Finance, Insurance and Consulting","Art. 24, Art. 30(1), Art. 32(1), Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2022-03/Final%20Decision%20in%20Inquiry%20IN-19-7-5_Slane%20Credit%20Union.pdf","https://www.enforcementtracker.com/ETid-1519",null,null,null,null,"slane credit union ltd",null,null,null,null,null,null,null,null,null],["2022/HR/019","AZOP (Croatia) - Decision 24-01-2022","gdprhub","Croatia","HR","AZOP (Croatia)","2022-01-24","day",null,null,null,"Center for Social Welfare",null,"Art. 4, Art. 5, Art. 6","Data principles, Unlawful processing",null,"Rejected","https://azop.hr/wp-content/uploads/2023/08/24012022_Otkrivanje-osobnih-podataka-trecoj-osobi.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_24-01-2022",null,"gdprhub",null,null,"HR: center for social welfare",null,null,null,null,null,null,null,null,null],["2022/IE/008","DPC (Ireland) - IN-20-4-7","gdprhub","Ireland","IE","DPC (Ireland)","2022-01-24","day",null,"None","EUR","Personal Injuries Assessment Board",null,"Art. 32","Data security",null,"Violation found","https://www.dataprotection.ie/en/dpc-guidance/law/decisions/personal-injuries-assessment-board-january-2022","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-20-4-7",null,"gdprhub",null,null,"IE: personal injuries assessment board",null,null,null,null,null,null,null,null,null],["2022/BE/013","APD/GBA (Belgium) - 11/2022","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-01-21","day",null,"None","EUR",null,null,"Art. 12, Art. 13, Art. 4(1), Art. 4(11), Art. 5(1)(a), Art. 7","Consent, Data principles, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-11-2022.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_11/2022",null,"gdprhub",null,"Website owner",null,null,null,null,null,null,null,null,null,null],["2022/ES/203","ETid-1007","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-21","day",2000,null,"EUR","Website operator","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00431-2021.pdf","https://www.enforcementtracker.com/ETid-1007",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/202","ETid-1008","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-21","day",1200,null,"EUR","Property Owner Community","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00518-2021.pdf","https://www.enforcementtracker.com/ETid-1008",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/RO/047","ETid-1006","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2022-01-20","day",3000,null,"EUR","Kaufland România SCS","Industry and Commerce","Art. 15(3)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_20_01_2022&lang=ro","https://www.enforcementtracker.com/ETid-1006",null,null,null,null,"kaufland romania scs",null,null,null,null,null,null,null,null,null],["2022/EE/001","AKI (Estonia) - 2.1.-1/21/129","gdprhub","Estonia","EE","AKI (Estonia)","2022-01-19","day",null,null,null,null,null,"Art. 12, Art. 13, Art. 14, Art. 15, Art. 6","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://edpb.europa.eu/system/files/2022-04/ee_2022-01_decisionpublic_redacted.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-1/21/129",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/PL/014","ETid-1085","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-01-19","day",117000,null,"EUR","Santander Bank Polska S. A.","Finance, Insurance and Consulting","Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/pl/138/2303","https://www.enforcementtracker.com/ETid-1085",null,null,null,null,"santander bank polska sa","Santander",null,null,null,null,null,null,null,null],["2022/PL/013","ETid-1104","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-01-19","day",1000000,null,"EUR","Fortum Marketing and Sales Polska S.A.","Transportation and Energy","Art. 24(1), Art. 25(1), Art. 28(1), Art. 5(1)(f)","Accountability, Data principles, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/pl/138/2389","https://www.enforcementtracker.com/ETid-1104",null,null,null,null,"fortum marketing and sales polska sa",null,null,null,null,null,null,null,null,null],["2022/PL/012","ETid-1105","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2022-01-19","day",53000,null,"EUR","PIKA Sp. z o.o.","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5130.2215.2020","https://www.enforcementtracker.com/ETid-1105","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5130.2215.2020","gdprhub",null,null,"pika spzoo",null,null,null,null,null,null,null,null,null],["2022/PL/015","UODO (Poland) - DKN.5131.33.2021","gdprhub","Poland","PL","UODO (Poland)","2022-01-19","day",null,"545.748","PLN",null,null,"Art. 34(1), Art. 34(2), Art. 34(4), Art. 57(1)(a), Art. 57(1)(h), Art. 58(2)(e), Art. 58(2)(i), Art. 83(1), Art. 83(2), Art. 83(4)(a)","Data breach",null,"Violation found","https://www.uodo.gov.pl/decyzje/DKN.5131.33.2021","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.33.2021",null,"gdprhub",null,"Bank",null,null,545748.0,120663,"day 2022-01-19|4.5229|PLN",null,null,null,null,null],["2022/ES/205","ETid-1002","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-18","day",15000,null,"EUR","GARLEX SOLUTIONS, S.L.","Transportation and Energy","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00375-2021.pdf","https://www.enforcementtracker.com/ETid-1002",null,null,null,null,"garlex solutions sl",null,null,null,null,null,null,null,null,null],["2022/ES/209","ETid-997","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-18","day",56000,null,"EUR","VODAFONE ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00501-2021.pdf","https://www.enforcementtracker.com/ETid-997",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2022/GB/007","ICO (UK) - Energy Suite Limited","gdprhub","United Kingdom","GB","ICO (UK)","2022-01-18","day",null,"2000","GBP","Energy Suite",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4019417/energy-suite-limited-mpn-20220118.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Energy_Suite_Limited",null,"gdprhub",null,null,"GB: energy suite",null,2000.0,2390,"day 2022-01-18|0.8367|GBP",null,null,null,null,null],["2022/SI/001","IP (Slovenia) - 0611-608/2021/9","gdprhub","Slovenia","SI","IP (Slovenia)","2022-01-18","day",null,"None","EUR",null,null,"Art. 13(1), Art. 13(2), Art. 4(1), Art. 4(15), Art. 4(2), Art. 5(1), Art. 9(1), Art. 9(2)","Data principles, Special categories, Transparency",null,"Violation found","https://www.ip-rs.si/fileadmin/user_upload/zip/Ponovna_uporaba/2022/Januar/Januar%2525202022%252520-%252520Odlocbe%252520ZIN.zip%09","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0611-608/2021/9",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2022/ES/213","AEPD (Spain) - E/03624/2021","gdprhub","Spain","ES","AEPD (Spain)","2022-01-17","day",null,"None","EUR","GRINDR LLC",null,"Art. 12, Art. 13, Art. 22, Art. 5(1)(a), Art. 6(1)(a), Art. 61, Art. 7, Art. 9(1)","Consent, Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/e-03624-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/03624/2021",null,"gdprhub",null,null,"grindr llc",null,null,null,null,null,null,null,null,null],["2022/BE/023","APD/GBA (Belgium) - XX/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2022-01-17","day",null,null,null,"Redacted",null,"Art. 17(1), Art. 58(2)(c), Art. 60","Data subject rights",null,"Violation found","https://edpb.europa.eu/system/files/2022-04/be_2022-01_decisionpublic.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_XX/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/206","ETid-1000","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-17","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00409-2021.pdf","https://www.enforcementtracker.com/ETid-1000",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/MT/004","ETid-996","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2022-01-17","day",65000,null,"EUR","C-Planet (IT Solutions) Limited","Industry and Commerce","Art. 14, Art. 32, Art. 33, Art. 34, Art. 5(1)(f), Art. 6(1)","Data breach, Data principles, Data security, Transparency, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/idpc-publications/idpc-issues-decision-on-cplanet-data-breach/","https://www.enforcementtracker.com/ETid-996","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_CDP/DBN/31/2020","gdprhub",null,null,"MT: c planet",null,null,null,null,null,null,null,null,null],["2022/ES/207","ETid-999","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-17","day",2000,null,"EUR","MEETING PUERTO C.B.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00433-2021.pdf","https://www.enforcementtracker.com/ETid-999",null,null,null,null,"ES: meeting puerto cb",null,null,null,null,null,null,null,null,null],["2022/ES/204","ETid-1004","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-14","day",2400,null,"EUR","PHARMA TALENTS, S.L.U.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00490-2021.pdf","https://www.enforcementtracker.com/ETid-1004",null,null,null,null,"pharma talents slu",null,null,null,null,null,null,null,null,null],["2022/NL/008","ETid-1089","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2022-01-14","day",525000,null,"EUR","DPG Media Magazines B.V.","Media, Telecoms and Broadcasting","Art. 12(2)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boetebesluit_dpg.pdf","https://www.enforcementtracker.com/ETid-1089","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_14.01.2022","gdprhub",null,null,"dpg media magazines bv",null,null,null,null,null,null,null,null,null],["2022/AT/002","ETid-988","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2022-01-14","day",8000000,null,"EUR","REWE International AG","Industry and Commerce",null,null,"Unknown","Fine issued","https://noe.orf.at/stories/3138575/","https://www.enforcementtracker.com/ETid-988",null,null,null,null,"rewe international ag",null,null,null,null,null,null,null,null,null],["2022/ES/208","ETid-998","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-14","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00356-2021.pdf","https://www.enforcementtracker.com/ETid-998",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/NO/009","Datatilsynet (Norway) - 20/03500","gdprhub","Norway","NO","Datatilsynet (Norway)","2022-01-13","day",null,"2,000,000","NOK","The Norwegian Parliament (Stortinget)",null,"Art. 32(1)(b), Art. 32(1)(d), Art. 5(1)(f), Art. 5(2)","Data principles, Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/338d64f46fbb436aa61b0fc4d7b794da/stortinget-vedtak.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/03500",null,"gdprhub",null,null,"NO: the norwegian parliament",null,2000000.0,201343,"day 2022-01-13|9.9333|NOK",null,null,null,null,null],["2022/IT/124","ETid-1065","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-01-13","day",7500,null,"EUR","Azienda Sanitaria Locale Frosinone","Health Care","Art. 12, Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9742959","https://www.enforcementtracker.com/ETid-1065",null,null,null,null,"IT: azienda sanitaria locale frosinone",null,null,null,null,null,null,null,null,null],["2022/IT/123","ETid-1067","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-01-13","day",4000,null,"EUR","Medicina & Lavoro s.r.l.","Health Care","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9744655","https://www.enforcementtracker.com/ETid-1067","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9744655","gdprhub",null,null,"medicina and lavoro srl",null,null,null,null,null,null,null,null,null],["2022/IT/122","ETid-1068","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-01-13","day",14000,null,"EUR","Azienda sanitaria unica regionale Marche","Health Care","Art. 32, Art. 35, Art. 5(1)(f)","DPIA, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9744496","https://www.enforcementtracker.com/ETid-1068",null,null,null,null,"IT: azienda sanitaria unica regionale marche",null,null,null,null,null,null,null,null,null],["2022/IT/121","ETid-1072","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-01-13","day",1000,null,"EUR","Villa Masi Residenza per anziani","Health Care","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9745262","https://www.enforcementtracker.com/ETid-1072",null,null,null,null,"IT: villa masi residenza per anziani",null,null,null,null,null,null,null,null,null],["2022/IT/120","ETid-1075","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2022-01-13","day",1000,null,"EUR","A.S.L. Napoli 1 Centro","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9745807","https://www.enforcementtracker.com/ETid-1075",null,null,null,null,"IT: asl napoli 1 centro",null,null,null,null,null,null,null,null,null],["2022/ES/210","ETid-989","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-13","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00224-2021.pdf","https://www.enforcementtracker.com/ETid-989",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/GR/024","HDPA (Greece) - 2/2022","gdprhub","Greece","GR","HDPA (Greece)","2022-01-13","day",null,"None","EUR","Ministry of National Defence",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.dpa.gr/sites/default/files/2022-01/2_2022%2520anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_2/2022",null,"gdprhub",null,null,"GR: ministry of national defence",null,null,null,null,null,null,null,null,null],["2022/FI/014","Tietosuojavaltuutetun toimisto (Finland) - 7635/162/21","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2022-01-13","day",null,"None","EUR","Social and Health Services in Kymenlaakso (Kymsote)",null,"Art. 10, Art. 6(1)(e), Art. 6(2)","Special categories, Unlawful processing",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2022/20221263","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_7635/162/21",null,"gdprhub",null,null,"FI: social and health services in kymenlaakso",null,null,null,null,null,null,null,null,null],["2022/GB/006","ICO (UK) - The Ministry of Justice","gdprhub","United Kingdom","GB","ICO (UK)","2022-01-12","day",null,"None","EUR","Ministry of Justice",null,"Art. 15","Data subject rights",null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/the-ministry-of-justice/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_The_Ministry_of_Justice",null,"gdprhub",null,null,"GB: ministry of justice",null,null,null,null,null,null,null,null,null],["2022/ES/212","ETid-982","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-11","day",3000,null,"EUR","Property Owner Community","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00448-2021.pdf","https://www.enforcementtracker.com/ETid-982",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/ES/211","ETid-983","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2022-01-11","day",9000,null,"EUR","EDUCANDO JUNTOS SL","Employment","Art. 17, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00119-2021.pdf","https://www.enforcementtracker.com/ETid-983",null,null,null,null,"educando juntos sl",null,null,null,null,null,null,null,null,null],["2022/EU/001","EDPS - 2020-1013","gdprhub","European Union","EU","EDPS","2022-01-05","day",null,"None","EUR",null,null,"Art. 13, Art. 6","Transparency, Unlawful processing",null,"Violation found","https://noyb.eu/sites/default/files/2022-01/Case%202020-1013%20-%20EDPS%20Decision_bk.pdf","https://gdprhub.eu/index.php?title=EDPS_-_2020-1013",null,"gdprhub",null,"European Parliament",null,null,null,null,null,null,null,null,null,null],["2022/GR/023","ETid-981","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2022-01-05","day",1000,null,"EUR","Εγνατία Οδός Α.Ε.","Industry and Commerce","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2022-01/1_2022%20anonym.pdf","https://www.enforcementtracker.com/ETid-981",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/CY/012","ETid-1265","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",2000,null,"EUR","Oroklini Municipal Council","Public Sector and Education","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/1978BD92BBEDDA44C225887F002107BD?OpenDocument","https://www.enforcementtracker.com/ETid-1265",null,null,null,null,"CY: oroklini municipal council",null,null,null,null,null,null,null,null,null],["2022/CY/010","ETid-1267","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",1500,null,"EUR","Physician","Health Care","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/1978BD92BBEDDA44C225887F002107BD?OpenDocument","https://www.enforcementtracker.com/ETid-1267",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/CY/009","ETid-1273","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",5000,null,"EUR","Cyprus Judo Federation","Individuals and Private Associations","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/1978BD92BBEDDA44C225887F002107BD?OpenDocument","https://www.enforcementtracker.com/ETid-1273",null,null,null,null,"CY: cyprus judo federation",null,null,null,null,null,null,null,null,null],["2022/CY/008","ETid-1618","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",6000,null,"EUR","Hermes Airport Ltd.","Transportation and Energy","Art. 24, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1618",null,null,null,null,"hermes airport ltd",null,null,null,null,null,null,null,null,null],["2022/CY/007","ETid-1619","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",5000,null,"EUR","DW Dynamic Works LIMITED","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1619",null,null,null,null,"dw dynamic works ltd",null,null,null,null,null,null,null,null,null],["2022/CY/006","ETid-1620","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",3500,null,"EUR","Universal Life Insurance Public Co Ltd.","Finance, Insurance and Consulting","Art. 24(1), Art. 28(1)","Accountability, Processor obligations","Insufficient data processing agreement","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1620",null,null,null,null,"universal life insurance public co ltd",null,null,null,null,null,null,null,null,null],["2022/CY/005","ETid-1621","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",3750,null,"EUR","PRINTAFORM Ltd.","Industry and Commerce","Art. 28(3), Art. 32(1)","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1621",null,null,null,null,"printaform ltd",null,null,null,null,null,null,null,null,null],["2022/CY/004","ETid-1622","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",17000,null,"EUR","Bank of Cyprus Public Company Ltd.","Finance, Insurance and Consulting","Art. 24(1), Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1622",null,null,null,null,"bank of cyprus public company ltd",null,null,null,null,null,null,null,null,null],["2022/CY/003","ETid-1623","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",5000,null,"EUR","Cyprus Electricity Authority","Transportation and Energy","Art. 24(1), Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1623",null,null,null,null,"CY: cyprus electricity authority",null,null,null,null,null,null,null,null,null],["2022/CY/002","ETid-1624","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",5000,null,"EUR","Cypriot Ministry of Defense","Public Sector and Education","Art. 24, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1624",null,null,null,null,"CY: cypriot ministry of defense",null,null,null,null,null,null,null,null,null],["2022/CY/001","ETid-1625","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2022","year",7500,null,"EUR","DW Dynamic Works LIMITED","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/0F1B99C0D69F7754C22588FB0043AB18?OpenDocument","https://www.enforcementtracker.com/ETid-1625",null,null,null,null,"dw dynamic works ltd",null,null,null,null,null,null,null,null,null],["2022/DE/045","ETid-1649","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2022","year",6500,null,"EUR","Pharmacy","Health Care","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2023/02/TB_38_Datenschutz-2022_V1-.pdf","https://www.enforcementtracker.com/ETid-1649",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/044","ETid-1650","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2022","year",20000,null,"EUR","Company","Employment",null,null,"Unknown","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2023/02/TB_38_Datenschutz-2022_V1-.pdf","https://www.enforcementtracker.com/ETid-1650",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/043","ETid-1651","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2022","year",500,null,"EUR","Restaurant","Accommodation and Hospitality",null,null,"Unknown","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2023/02/TB_38_Datenschutz-2022_V1-.pdf","https://www.enforcementtracker.com/ETid-1651",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/042","ETid-1652","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2022","year",null,null,"EUR","Debt collection company","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2023/02/TB_38_Datenschutz-2022_V1-.pdf","https://www.enforcementtracker.com/ETid-1652",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/041","ETid-1717","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Physician","Health Care","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1717",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/040","ETid-1718","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Company",null,"Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1718",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/039","ETid-1719","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Physician","Health Care","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1719",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/038","ETid-1720","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Physician","Health Care","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1720",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/037","ETid-1721","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1721",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DE/036","ETid-1722","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1722",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DE/035","ETid-1723","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Company","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1723",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/034","ETid-1724","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Company","Employment","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1724",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/033","ETid-1725","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Company","Employment","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1725",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/032","ETid-1726","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Company",null,"Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1726",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/031","ETid-1727","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Company",null,"Art. 12, Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1727",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/030","ETid-1728","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Medical care center","Health Care",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1728",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/029","ETid-1729","cms_tracker","Germany","DE","Data Protection Authority of Bremen","2022","year",null,null,"EUR","Supermarket","Industry and Commerce",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/bremen/832-5-tb-dsgvo-lfd-bremen-2022-o-drs-nr-vom-24-03-2023/file","https://www.enforcementtracker.com/ETid-1729",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/028","ETid-1741","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2022","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/833-31-tb-lfd-hamburg-2022-o-drs-nr-vom-27-03-2023/file","https://www.enforcementtracker.com/ETid-1741",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DE/027","ETid-1742","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2022","year",null,null,"EUR","Logistics company","Transportation and Energy","Art. 32, Art. 32(1), Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/833-31-tb-lfd-hamburg-2022-o-drs-nr-vom-27-03-2023/file","https://www.enforcementtracker.com/ETid-1742",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/026","ETid-1743","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2022","year",1000,null,"EUR","Physician","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/833-31-tb-lfd-hamburg-2022-o-drs-nr-vom-27-03-2023/file","https://www.enforcementtracker.com/ETid-1743",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/025","ETid-1744","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2022","year",1000,null,"EUR","Covid-19 test center","Health Care","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/833-31-tb-lfd-hamburg-2022-o-drs-nr-vom-27-03-2023/file","https://www.enforcementtracker.com/ETid-1744",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/024","ETid-1745","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2022","year",2700,null,"EUR","Covid-19 test center","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/833-31-tb-lfd-hamburg-2022-o-drs-nr-vom-27-03-2023/file","https://www.enforcementtracker.com/ETid-1745",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/023","ETid-1750","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2022","year",1400,null,"EUR","Covid-19 test center","Health Care","Art. 6(1)(c)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/833-31-tb-lfd-hamburg-2022-o-drs-nr-vom-27-03-2023/file","https://www.enforcementtracker.com/ETid-1750",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/CZ/002","ETid-1760","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2022","year",3400,null,"EUR","Company","Transportation and Energy",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=56846","https://www.enforcementtracker.com/ETid-1760",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/022","ETid-1779","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2022","year",16400,null,"EUR","Covid-19 test center","Health Care","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/838-51-tb-lfd-hessen-2022-20-9575-vom-18-04-2023/file","https://www.enforcementtracker.com/ETid-1779",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/021","ETid-1780","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2022","year",1800,null,"EUR","Covid-19 test center","Health Care","Art. 6(1)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/838-51-tb-lfd-hessen-2022-20-9575-vom-18-04-2023/file","https://www.enforcementtracker.com/ETid-1780",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/020","ETid-1781","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2022","year",7380,null,"EUR","Police officer","Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/838-51-tb-lfd-hessen-2022-20-9575-vom-18-04-2023/file","https://www.enforcementtracker.com/ETid-1781",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/019","ETid-1782","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2022","year",300,null,"EUR","Police officer","Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/838-51-tb-lfd-hessen-2022-20-9575-vom-18-04-2023/file","https://www.enforcementtracker.com/ETid-1782",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/018","ETid-1783","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2022","year",800,null,"EUR","Police officer","Individuals and Private Associations",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/838-51-tb-lfd-hessen-2022-20-9575-vom-18-04-2023/file","https://www.enforcementtracker.com/ETid-1783",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/017","ETid-1794","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2022","year",null,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 28(3), Art. 32","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/835-24-tb-lfd-brandenburg-2022-o-drs-nr-vom-17-04-2023/file","https://www.enforcementtracker.com/ETid-1794",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/016","ETid-1795","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2022","year",null,null,"EUR","Restaurant operator","Accommodation and Hospitality","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/835-24-tb-lfd-brandenburg-2022-o-drs-nr-vom-17-04-2023/file","https://www.enforcementtracker.com/ETid-1795",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/015","ETid-1796","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2022","year",null,null,"EUR","Operator of a swimming pool",null,"Art. 6(1)(c)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/835-24-tb-lfd-brandenburg-2022-o-drs-nr-vom-17-04-2023/file","https://www.enforcementtracker.com/ETid-1796",null,null,null,null,"DE: operator of a swimming pool",null,null,null,null,null,null,null,null,null],["2022/DE/014","ETid-1797","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2022","year",null,null,"EUR","Aid organization","Individuals and Private Associations","Art. 28(3), Art. 32","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/835-24-tb-lfd-brandenburg-2022-o-drs-nr-vom-17-04-2023/file","https://www.enforcementtracker.com/ETid-1797",null,null,null,null,"DE: aid organization",null,null,null,null,null,null,null,null,null],["2022/HU/007","ETid-1812","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022","year",80700,null,"EUR","Beauty salon","Industry and Commerce",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu/eves-beszamolok?download=648:naih-beszamolo-a-2022-evi-tevekenysegroll","https://www.enforcementtracker.com/ETid-1812",null,null,null,null,"HU: beauty salon",null,null,null,null,null,null,null,null,null],["2022/HU/006","ETid-1813","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022","year",1600,null,"EUR","Physician","Health Care","Art. 12(2), Art. 13(1), Art. 5(1)(a)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://naih.hu/eves-beszamolok?download=648:naih-beszamolo-a-2022-evi-tevekenysegroll","https://www.enforcementtracker.com/ETid-1813",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HU/005","ETid-1814","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022","year",1300,null,"EUR","Website operator",null,"Art. 31, Art. 5(1)(a)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://naih.hu/eves-beszamolok?download=648:naih-beszamolo-a-2022-evi-tevekenysegroll","https://www.enforcementtracker.com/ETid-1814",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HU/002","ETid-1823","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022","year",1400,null,"EUR","Dentist","Health Care",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://naih.hu/eves-beszamolok?download=648:naih-beszamolo-a-2022-evi-tevekenysegroll","https://www.enforcementtracker.com/ETid-1823",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/HU/001","ETid-1825","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2022","year",2700,null,"EUR","Credit institution","Finance, Insurance and Consulting","Art. 5(2), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=626:koveteleservenyesitesi-celu-adatkezeles-es-ahhoz-kapcsolodo-erdekmerlegeles-tovabba-adadttovabbitasok-jogszerusegenek-kerdese","https://www.enforcementtracker.com/ETid-1825",null,null,null,null,"HU: credit institution",null,null,null,null,null,null,null,null,null],["2022/BG/003","ETid-1831","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2022","year",12800,null,"EUR","Political party","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/userfiles/file/Annual%20Reports/Annual%20report_2022_CPDP.pdf","https://www.enforcementtracker.com/ETid-1831",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/BG/001","ETid-1833","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2022","year",5000,null,"EUR","Trucking company","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/userfiles/file/Annual%20Reports/Annual%20report_2022_CPDP.pdf","https://www.enforcementtracker.com/ETid-1833",null,null,null,null,"BG: trucking company",null,null,null,null,null,null,null,null,null],["2022/MT/003","ETid-1834","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2022","year",2500,null,"EUR",null,null,"Art. 24(2), Art. 32(1)(b), Art. 32(4)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1834",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/MT/002","ETid-1835","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2022","year",250000,null,"EUR",null,null,null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1835",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/013","ETid-1866","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2022","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/841-tb-lfd-berlin-2022-o-drs-nr-vom-22-05-2023/file","https://www.enforcementtracker.com/ETid-1866",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DE/012","ETid-1867","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2022","year",null,null,"EUR","Restaurant operator","Accommodation and Hospitality","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/841-tb-lfd-berlin-2022-o-drs-nr-vom-22-05-2023/file","https://www.enforcementtracker.com/ETid-1867",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/011","ETid-1868","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2022","year",null,null,"EUR","Sports photography company","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/841-tb-lfd-berlin-2022-o-drs-nr-vom-22-05-2023/file","https://www.enforcementtracker.com/ETid-1868",null,null,null,null,"DE: sports photography company",null,null,null,null,null,null,null,null,null],["2022/DE/010","ETid-1870","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2022","year",2001000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/840-23-tb-lfd-sachsen-o-drs-nr-vom16-05-2023/file","https://www.enforcementtracker.com/ETid-1870",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/009","ETid-1885","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2022","year",50000,null,"EUR","Company",null,"Art. 15, Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/842-28-tb-lfd-niedersachen-2022-o-ds-nr-vom-15-06-2023/file","https://www.enforcementtracker.com/ETid-1885",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/008","ETid-1886","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2022","year",8900,null,"EUR","Company",null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/842-28-tb-lfd-niedersachen-2022-o-ds-nr-vom-15-06-2023/file","https://www.enforcementtracker.com/ETid-1886",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/007","ETid-1887","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2022","year",500,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/842-28-tb-lfd-niedersachen-2022-o-ds-nr-vom-15-06-2023/file","https://www.enforcementtracker.com/ETid-1887",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2022/DE/006","ETid-1888","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2022","year",null,null,"EUR","Job center employee","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/841-tb-lfd-berlin-2022-o-drs-nr-vom-22-05-2023/file","https://www.enforcementtracker.com/ETid-1888",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/005","ETid-1889","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2022","year",null,null,"EUR","Job center employee","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/841-tb-lfd-berlin-2022-o-drs-nr-vom-22-05-2023/file","https://www.enforcementtracker.com/ETid-1889",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/004","ETid-1890","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2022","year",null,null,"EUR","Credit agency","Finance, Insurance and Consulting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/841-tb-lfd-berlin-2022-o-drs-nr-vom-22-05-2023/file","https://www.enforcementtracker.com/ETid-1890",null,null,null,null,"DE: credit agency",null,null,null,null,null,null,null,null,null],["2022/LV/003","ETid-1901","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2022","year",null,null,"EUR",null,null,"Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dvi.gov.lv/lv/media/2202/download?attachment","https://www.enforcementtracker.com/ETid-1901",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LV/002","ETid-1902","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2022","year",null,null,"EUR",null,null,"Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dvi.gov.lv/lv/media/2202/download?attachment","https://www.enforcementtracker.com/ETid-1902",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/LV/001","ETid-1906","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2022","year",null,null,"EUR","Company","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dvi.gov.lv/lv/media/2202/download?attachment","https://www.enforcementtracker.com/ETid-1906",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/003","ETid-1907","cms_tracker","Germany","DE","Data Protection Authority of Nordrhein-Westfalen","2022","year",null,null,"EUR","Physician","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/nordrhein-westfalen/landesdatenschutzbeauftragter-4/844-28-tb-lfd-nrw-2022-o-drs-nr-vom-22-06-2023/file","https://www.enforcementtracker.com/ETid-1907",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/MT/001","ETid-1911","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2022","year",65000,null,"EUR",null,null,"Art. 32(1), Art. 33(1), Art. 34(1), Art. 5(1)(f), Art. 6(1)","Data breach, Data principles, Data security, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://idpc.org.mt/decisions//","https://www.enforcementtracker.com/ETid-1911",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2022/DE/002","ETid-1974","cms_tracker","Germany","DE","Data Protection Authority of Thüringen","2022","year",null,null,"EUR","Data protection officer",null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/thueringen/landesdatenschutzbeauftragter-9/849-5-tb-dsgvo-lfd-thueringen-2022-o-ds-nr-vom-27-07-2023/file","https://www.enforcementtracker.com/ETid-1974",null,null,null,null,"DE: data protection officer",null,null,null,null,null,null,null,null,null],["2022/DE/001","ETid-1975","cms_tracker","Germany","DE","Data Protection Authority of Thüringen","2022","year",null,null,"EUR",null,null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/thueringen/landesdatenschutzbeauftragter-9/849-5-tb-dsgvo-lfd-thueringen-2022-o-ds-nr-vom-27-07-2023/file","https://www.enforcementtracker.com/ETid-1975",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/HR/007","AZOP (Croatia) - Decision 29-06-2022 (bank)","gdprhub","Croatia","HR","AZOP (Croatia)","2021-12-31","day",null,null,null,null,null,"Art. 13, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing",null,"Violation found","https://azop.hr/wp-content/uploads/2022/09/Prekomjerna-obrada-osobnih-podataka-od-strane-banke.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_29-06-2022_%28bank%29",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2021/FR/025","CNIL (France) - SAN-2021-023","gdprhub","France","FR","CNIL (France)","2021-12-31","day",150000000,"150,000,000","EUR","Google LLC",null,"Art. 56",null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840062?fonds=CNIL&page=1&pageSize=10&query=*&searchField=ALL&searchType=ALL&tab_selection=all&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-023",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2021/FR/027","CNIL (France) - SAN-2021-024","gdprhub","France","FR","CNIL (France)","2021-12-31","day",60000000,"60,000,000","EUR","Facebook Ireland Limited",null,null,null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532?init=true&page=1&query=*&searchField=ALL&tab_selection=cnil","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-024",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2021/FR/003","ETid-978","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-12-31","day",90000000,null,"EUR","Google LLC","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532","https://www.enforcementtracker.com/ETid-978",null,null,null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2021/FR/002","ETid-979","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-12-31","day",60000000,null,"EUR","Google Ireland Ltd.","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532","https://www.enforcementtracker.com/ETid-979",null,null,null,null,"google ireland ltd","Google (Alphabet)",null,null,null,null,null,null,null,null],["2021/FR/001","ETid-980","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-12-31","day",60000000,null,"EUR","Facebook Ireland Ltd.","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044840532","https://www.enforcementtracker.com/ETid-980",null,null,null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2021/GR/003","ETid-985","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-12-31","day",25000,null,"EUR","PLUS REAL ADVERTISEMENT","Industry and Commerce","Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dpa.gr/sites/default/files/2022-01/57_2021anonym.pdf","https://www.enforcementtracker.com/ETid-985","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_57/2021","gdprhub",null,null,"GR: plus real advertisement",null,null,null,null,null,null,null,null,null],["2021/GR/002","ETid-986","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-12-31","day",30000,null,"EUR","INFO COMMUNICATION SERVICES","Industry and Commerce","Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dpa.gr/sites/default/files/2022-01/56_2021anonym.pdf","https://www.enforcementtracker.com/ETid-986","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_56/2021","gdprhub",null,null,"GR: info communication services",null,null,null,null,null,null,null,null,null],["2021/HR/005","AZOP (Croatia) - Decision 30-12-2021","gdprhub","Croatia","HR","AZOP (Croatia)","2021-12-30","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Rejected","https://azop.hr/wp-content/uploads/2022/01/Rjesenje-objava-osobnih-podataka-u-medijima.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_30-12-2021",null,"gdprhub",null,"Newspaper",null,null,null,null,null,null,null,null,null,null],["2021/FR/029","CNIL (France) - SAN-2021-022","gdprhub","France","FR","CNIL (France)","2021-12-30","day",120000,"120000","EUR",null,null,"Art. 13(2), Art. 5(1), Art. 60","Data principles, Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-02/fr_2021-12_decisionpublic.pdf","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-022",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2021/GR/001","ETid-990","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-12-29","day",75000,null,"EUR","Greek Ministry of Tourism","Public Sector and Education","Art. 13, Art. 32, Art. 33, Art. 37","Data breach, Data protection officer, Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/peristatiko-parabiasis-dedomenon-prosopikoy-haraktira-apo-ypoyrgeio","https://www.enforcementtracker.com/ETid-990",null,null,null,null,"GR: greek ministry of tourism",null,null,null,null,null,null,null,null,null],["2021/ES/003","ETid-969","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-28","day",2000,null,"EUR","VENTANAS MAKE YOURSELF, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00404-2021.pdf","https://www.enforcementtracker.com/ETid-969",null,null,null,null,"ventanas make yourself sl",null,null,null,null,null,null,null,null,null],["2021/ES/002","ETid-970","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-28","day",6000,null,"EUR","REAL CLUB NÁUTICO DE RIBADEO","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00493-2020.pdf","https://www.enforcementtracker.com/ETid-970",null,null,null,null,"ES: real club nautico de ribadeo",null,null,null,null,null,null,null,null,null],["2021/FR/005","ETid-971","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-12-28","day",180000,null,"EUR","SLIMPAY","Finance, Insurance and Consulting","Art. 28, Art. 32, Art. 34","Data breach, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnil.fr/fr/node/121960","https://www.enforcementtracker.com/ETid-971","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-020","gdprhub",null,null,"FR: slimpay",null,null,null,null,null,null,null,null,null],["2021/FR/004","ETid-972","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-12-28","day",300000,null,"EUR","FREE MOBILE","Media, Telecoms and Broadcasting","Art. 12, Art. 15, Art. 21, Art. 25, Art. 32","Accountability, Data security, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnil.fr/fr/node/121974","https://www.enforcementtracker.com/ETid-972","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-021","gdprhub",null,null,"FR: free mobile","Free (Iliad)",null,null,null,null,null,null,null,null],["2021/ES/001","ETid-973","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-28","day",2000,null,"EUR","Call shop manager","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00390-2021.pdf","https://www.enforcementtracker.com/ETid-973",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/FI/001","ETid-1088","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2021-12-26","day",5000,null,"EUR","Medical clinic","Health Care","Art. 25, Art. 5(1)(a)","Accountability, Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://tietosuoja.fi/-/laakariklinikalle-seuraamusmaksu-puutteista-rekisteroidyn-oikeuksien-toteutuksessa","https://www.enforcementtracker.com/ETid-1088","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8493/161/21","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/008","ETid-964","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-23","day",1500,null,"EUR","LA OFICINA BAR","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00389-2021.pdf","https://www.enforcementtracker.com/ETid-964",null,null,null,null,"ES: la oficina bar",null,null,null,null,null,null,null,null,null],["2021/AT/019","DSB (Austria) - 2021-0.586.257","gdprhub","Austria","AT","DSB (Austria)","2021-12-22","day",null,"None","EUR","Austrian website provider (data exporter and respondent #1) and Google LLC (data importer and respondent #2)",null,"Art. 4(1), Art. 4(2), Art. 4(7), Art. 4(8), Art. 44, Art. 46(1), Art. 46(2)(c), Art. 5, Art. 51(1), Art. 57(1)(d), Art. 57(1)(f), Art. 77(1), Art. 80(1), Art. 93(2)","Data principles, International transfers",null,"Violation found","https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_DE_bk.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.586.257",null,"gdprhub",null,null,"austrian website provider and google llc",null,null,null,null,null,null,null,null,null],["2021/DK/016","Datatilsynet (Denmark) - 2019-431-0031","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-12-22","day",null,"None","EUR","Det Konservative Folkeparti (The Conservative People's Party)",null,"Art. 14(1), Art. 14(2), Art. 6(1)(f)","Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/dec/kritik-af-det-konservative-folkepartis-manglende-opfyldelse-af-oplysningspligten","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-431-0031",null,"gdprhub",null,null,"DK: det konservative folkeparti",null,null,null,null,null,null,null,null,null],["2021/ES/006","ETid-966","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-22","day",5000,null,"EUR","Sfam España General s.l.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00536-2021.pdf","https://www.enforcementtracker.com/ETid-966",null,null,null,null,"sfam espana general sl",null,null,null,null,null,null,null,null,null],["2021/ES/005","ETid-967","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-22","day",5000,null,"EUR","HUBSIDE IBÉRICA S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00537-2021.pdf","https://www.enforcementtracker.com/ETid-967",null,null,null,null,"hubside iberica sl",null,null,null,null,null,null,null,null,null],["2021/ES/010","ETid-962","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-21","day",2000,null,"EUR","FUNDACION ESPANOLA DE MEDICINA ESTETICA Y LONGEVIDAD","Individuals and Private Associations","Art. 13, Art. 7","Consent, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00416-2021.pdf","https://www.enforcementtracker.com/ETid-962",null,null,null,null,"ES: fundacion espanola de medicina estetica y longevidad",null,null,null,null,null,null,null,null,null],["2021/ES/007","ETid-965","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-21","day",6000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00204-2021.pdf","https://www.enforcementtracker.com/ETid-965",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/PT/001","ETid-995","cms_tracker","Portugal","PT","Portuguese Data Protection Authority (CNPD)","2021-12-21","day",1250000,null,"EUR","Lisbon City Council","Public Sector and Education","Art. 35(3), Art. 6, Art. 9(1)(a)","DPIA, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cnpd.pt/comunicacao-publica/noticias/cnpd-aplica-sancao-ao-municipio-de-lisboa/","https://www.enforcementtracker.com/ETid-995","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2021/1569","gdprhub",null,null,"PT: lisbon city council",null,null,null,null,null,null,null,null,null],["2021/IT/011","ETid-1054","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-17","day",10000,null,"EUR","ASL Latina","Health Care","Art. 5(1)(f), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9742435","https://www.enforcementtracker.com/ETid-1054",null,null,null,null,"IT: asl latina",null,null,null,null,null,null,null,null,null],["2021/ES/012","ETid-958","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-17","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00350-2021.pdf","https://www.enforcementtracker.com/ETid-958",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/011","ETid-959","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-17","day",2000,null,"EUR","Online retailer","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00300-2021.pdf","https://www.enforcementtracker.com/ETid-959",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/002","ETid-960","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-12-17","day",3900,null,"EUR","T. Stene Transport AS","Transportation and Energy",null,null,"Unknown","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/gebyr-og-palegg-om-a-etablere-rutiner-etter-urettmessig-kredittvurdering/","https://www.enforcementtracker.com/ETid-960",null,null,null,null,"t stene transport as",null,null,null,null,null,null,null,null,null],["2021/ES/009","ETid-963","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-17","day",4000,null,"EUR","CLUB DEPORTIVO RITMO DE ANDALUCÍA","Individuals and Private Associations","Art. 13, Art. 7","Consent, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00468-2021.pdf","https://www.enforcementtracker.com/ETid-963",null,null,null,null,"ES: club deportivo ritmo de andalucia",null,null,null,null,null,null,null,null,null],["2021/AT/021","DSB (Austria) - 2021-0.816.492","gdprhub","Austria","AT","DSB (Austria)","2021-12-16","day",null,null,null,null,null,"Art. 12(1), Art. 12(3), Art. 15, Art. 9(1)","Data subject rights, Special categories, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20211216_2021_0_816_492_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.816.492",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/IT/017","ETid-1005","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-16","day",26513877,null,"EUR","Enel Energia S.p.A","Transportation and Energy","Art. 12, Art. 13, Art. 21, Art. 24, Art. 25(1), Art. 30, Art. 31, Art. 5(2), Art. 6(1)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9735672","https://www.enforcementtracker.com/ETid-1005","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9735672","gdprhub",null,null,"enel energia spa","Enel",null,null,null,null,null,null,null,null],["2021/FI/003","ETid-1011","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2021-12-16","day",6500,null,"EUR","Travel agency","Industry and Commerce","Art. 17, Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","https://tietosuoja.fi/-/matkatoimistolle-seuraamusmaksu-tietosuojalainsaadannon-rikkomisesta","https://www.enforcementtracker.com/ETid-1011","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4282/161/21","gdprhub",null,null,"FI: travel agency",null,null,null,null,null,null,null,null,null],["2021/FI/002","ETid-1012","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2021-12-16","day",52000,null,"EUR","Motor insurance center","Finance, Insurance and Consulting","Art. 25(2)","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","https://tietosuoja.fi/-/liikennevakuutuskeskukselle-seuraamusmaksu-tarpeettoman-laajasta-potilastietojen-keraamisesta","https://www.enforcementtracker.com/ETid-1012","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4431/161/21","gdprhub",null,null,"FI: motor insurance center",null,null,null,null,null,null,null,null,null],["2021/IT/015","ETid-1015","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-16","day",10000,null,"EUR","Centro di Medicina preventiva s.r.l.","Health Care","Art. 25, Art. 32, Art. 37, Art. 5","Accountability, Data principles, Data protection officer, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9739609","https://www.enforcementtracker.com/ETid-1015",null,null,null,null,"centro di medicina preventiva srl",null,null,null,null,null,null,null,null,null],["2021/IT/014","ETid-1016","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-16","day",20000,null,"EUR","Corradi s.r.l.","Employment","Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9739653","https://www.enforcementtracker.com/ETid-1016",null,null,null,null,"corradi srl",null,null,null,null,null,null,null,null,null],["2021/IT/010","ETid-1063","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-16","day",100000,null,"EUR","Ubi Banca spa","Finance, Insurance and Consulting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9742468","https://www.enforcementtracker.com/ETid-1063",null,null,null,null,"ubi banca spa",null,null,null,null,null,null,null,null,null],["2021/IT/009","ETid-1064","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-16","day",20000,null,"EUR","FCA Italy s.p.a.","Industry and Commerce","Art. 12","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9742908","https://www.enforcementtracker.com/ETid-1064",null,null,null,null,"fca italy spa",null,null,null,null,null,null,null,null,null],["2021/IT/008","ETid-1066","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-16","day",1000,null,"EUR","Università Telematica Internazionale Uninettuno","Public Sector and Education","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9742923","https://www.enforcementtracker.com/ETid-1066",null,null,null,null,"IT: universita telematica internazionale uninettuno",null,null,null,null,null,null,null,null,null],["2021/ES/014","ETid-953","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-16","day",1200,null,"EUR",null,"Individuals and Private Associations","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00294-2021.pdf","https://www.enforcementtracker.com/ETid-953",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DK/002","ETid-954","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-12-16","day",13450,null,"EUR","Municipality of Frederiksberg","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/dec/frederiksberg-kommune-indstilles-til-boede","https://www.enforcementtracker.com/ETid-954",null,null,null,null,"DK: municipality of frederiksberg",null,null,null,null,null,null,null,null,null],["2021/ES/004","ETid-968","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-16","day",60000,null,"EUR","Banco Bilbao Vizcaya Argentaria S.A.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00427-2021.pdf","https://www.enforcementtracker.com/ETid-968",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2021/BE/001","ETid-994","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2021-12-16","day",75000,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 38(6)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-141-2021.pdf","https://www.enforcementtracker.com/ETid-994",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/GB/023","ICO (UK) - Northern Gas & Power Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2021-12-15","day",null,"75000","GBP","Northern Gas & Power Ltd",null,null,null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/northern-gas-power-ltd-mpn/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Northern_Gas_%26_Power_Ltd",null,"gdprhub",null,null,"northern gas and power ltd",null,75000.0,88256,"day 2021-12-15|0.8498|GBP",null,null,null,null,null],["2021/ES/013","ETid-956","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-14","day",50000,null,"EUR","IZA OBRAS Y PROMOCIONES, S.A.","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00324-2021.pdf","https://www.enforcementtracker.com/ETid-956",null,null,null,null,"iza obras y promociones sa",null,null,null,null,null,null,null,null,null],["2021/NO/053","Datatilsynet (Norway) - 20/04401","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-12-13","day",null,"200.000","NOK","Elektro & Automasjon Systemer AS",null,"Art. 24, Art. 6(1)","Accountability, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/5857c008ccfb4bec816c8a69fa8bd4ad/vedtak-om-overtredelsesgebyr--elektro--automasjon-systemer-as.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/04401",null,"gdprhub",null,null,"elektro and automasjon systemer as",null,200000.0,19685,"day 2021-12-13|10.1598|NOK",null,null,null,null,null],["2021/RO/002","ETid-949","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-12-13","day",2000,null,"EUR","SC Nobiotic Pharma SRL","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_13_12_2021&lang=ro","https://www.enforcementtracker.com/ETid-949","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_SC_Nobiotic_Pharma_SRL","gdprhub",null,null,"nobiotic pharma srl",null,null,null,null,null,null,null,null,null],["2021/NO/003","ETid-950","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-12-13","day",6300000,null,"EUR","Grindr LLC","Media, Telecoms and Broadcasting","Art. 6(1), Art. 9(1)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/8ad827efefcb489ab1c7ba129609edb5/administrative-fine---grindr-llc.pdf","https://www.enforcementtracker.com/ETid-950","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02136","gdprhub",null,null,"grindr llc",null,null,null,null,null,null,null,null,null],["2021/NO/001","ETid-974","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-12-13","day",20000,null,"EUR","Elektro & Automasjon Systemer AS","Industry and Commerce","Art. 6(1)(f)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2022/gebyr-til-elektro--automasjon-systemer-as/","https://www.enforcementtracker.com/ETid-974",null,null,null,null,"elektro and automasjon systemer as",null,null,null,null,null,null,null,null,null],["2021/IE/001","ETid-1009","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2021-12-09","day",110000,null,"EUR","Limerick City and County Council","Public Sector and Education","Art. 13, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2022-01/Limerick%20Council%20Decision%20Summary%20EN.pdf,","https://www.enforcementtracker.com/ETid-1009","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_DPC_Case_Reference%3A_03/SIU/2018","gdprhub",null,null,"IE: limerick city and county council",null,null,null,null,null,null,null,null,null],["2021/PL/002","ETid-984","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-12-09","day",10000,null,"EUR","Warsaw University of Technology","Public Sector and Education","Art. 24(1), Art. 25(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5130.2559.2020","https://www.enforcementtracker.com/ETid-984",null,null,null,null,"PL: warsaw university of technology",null,null,null,null,null,null,null,null,null],["2021/PL/030","UODO (Poland) - DKN.5130.2559.2020","gdprhub","Poland","PL","UODO (Poland)","2021-12-09","day",null,"45,000","PLN",null,null,"Art. 24(1), Art. 25(1), Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security",null,"Violation found","https://www.uodo.gov.pl/decyzje/DKN.5130.2559.2020%20","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5130.2559.2020",null,"gdprhub",null,"Public university",null,null,45000.0,9773,"day 2021-12-09|4.6045|PLN",null,null,null,null,null],["2021/BE/002","ETid-947","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2021-12-08","day",10000,null,"EUR",null,null,"Art. 12(3), Art. 15, Art. 17(1)(c), Art. 21(2)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-137-2021.pdf","https://www.enforcementtracker.com/ETid-947","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_137/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/GR/004","ETid-957","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-12-08","day",30000,null,"EUR","One Way Private Company","Media, Telecoms and Broadcasting","Art. 28(3)(c)","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dpa.gr/sites/default/files/2021-12/52_2021anonym.pdf","https://www.enforcementtracker.com/ETid-957",null,null,null,null,"GR: one way private company",null,null,null,null,null,null,null,null,null],["2021/ES/015","ETid-945","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-07","day",24000,null,"EUR","NBQ Technology, S.A.U.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00487-2021.pdf","https://www.enforcementtracker.com/ETid-945",null,null,null,null,"nbq technology sau",null,null,null,null,null,null,null,null,null],["2021/FI/004","ETid-952","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2021-12-07","day",608000,null,"EUR","Psykoterapiakeskus Vastaamo","Health Care","Art. 33(1), Art. 34(1), Art. 5(1)(f)","Data breach, Data principles","Non-compliance with general data processing principles","Fine issued","https://finlex.fi/fi/viranomaiset/tsv/2021/20211183","https://www.enforcementtracker.com/ETid-952","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_1150/161/2021","gdprhub",null,null,"FI: psykoterapiakeskus vastaamo",null,null,null,null,null,null,null,null,null],["2021/FR/022","CNIL (France) - 20019819","gdprhub","France","FR","CNIL (France)","2021-12-06","day",null,null,null,null,null,"Art. 12, Art. 13","Transparency",null,"Violation found","https://edpb.europa.eu/system/files/2022-03/fr_2021-12_decisionpublic.pdf","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_20019819",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/054","Datatilsynet (Norway) - 20/03046","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-12-06","day",null,"5000000","NOK","Trumf",null,"Art. 32, Art. 33(1), Art. 33(5)","Data breach, Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/918bdbdce8a740d2a5e9b65334d82c52/20_03046-17-vedtak-om-overtredelsesgebyr---trumf-as_sladdet.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/03046",null,"gdprhub",null,null,"NO: trumf",null,5000000.0,485706,"day 2021-12-06|10.2943|NOK",null,null,null,null,null],["2021/RO/001","ETid-977","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-12-06","day",6000,null,"EUR","Telekom Romania Communications SA","Media, Telecoms and Broadcasting","Art. 17, Art. 5(2)","Data principles, Data subject rights","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_06_12_2021_2&lang=ro","https://www.enforcementtracker.com/ETid-977","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Telekom_Rom%C3%A2nia_Communications_SA_4","gdprhub",null,null,"telekom romania communications sa",null,null,null,null,null,null,null,null,null],["2021/GB/032","ICO (UK) - Virgin Media Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-12-06","day",null,"50,000","GBP","Virgin Media Limited",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4019153/virgin-media-limited-monetary-penalty-notice.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Virgin_Media_Limited",null,"gdprhub",null,null,"virgin media ltd",null,50000.0,58735,"day 2021-12-06|0.8513|GBP",null,null,null,null,null],["2021/HU/001","ETid-1017","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-12-03","day",843,null,"EUR","Lawyer","Finance, Insurance and Consulting","Art. 6(1), Art. 9(1)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=483:bunugyi-szemelyes-adatok-kezelese-maganvadlo-altal","https://www.enforcementtracker.com/ETid-1017",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/016","ETid-944","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-03","day",1000,null,"EUR","Store owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00306-2021.pdf","https://www.enforcementtracker.com/ETid-944",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/IT/016","ETid-1010","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-02","day",5000,null,"EUR","Azienda USL di Parma","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9739586","https://www.enforcementtracker.com/ETid-1010",null,null,null,null,"IT: azienda usl di parma",null,null,null,null,null,null,null,null,null],["2021/ES/020","ETid-934","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-02","day",2000,null,"EUR","IMAGINA FRAN SPORT, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00384-2021.pdf","https://www.enforcementtracker.com/ETid-934",null,null,null,null,"imagina fran sport sl",null,null,null,null,null,null,null,null,null],["2021/IT/022","ETid-975","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-02","day",30000,null,"EUR","Ica s.r.l.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9733053","https://www.enforcementtracker.com/ETid-975",null,null,null,null,"ica srl",null,null,null,null,null,null,null,null,null],["2021/IE/002","ETid-987","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2021-12-02","day",60000,null,"EUR","Irish Teacher Council","Public Sector and Education","Art. 32(1), Art. 33, Art. 5(1)","Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2022-01/Redacted%20Final%20Decision%20The%20Teaching%20Council_20-04-01.pdf","https://www.enforcementtracker.com/ETid-987","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_DPC_ref%3A_IN-20-4-1","gdprhub",null,null,"IE: irish teacher council",null,null,null,null,null,null,null,null,null],["2021/IT/020","ETid-991","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-02","day",7000,null,"EUR","Società Med Store Saronno s.r.l.","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9734934","https://www.enforcementtracker.com/ETid-991",null,null,null,null,"societa med store saronno srl",null,null,null,null,null,null,null,null,null],["2021/IT/019","ETid-992","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-12-02","day",30000,null,"EUR","Casa di cura Fondazione Gaetano e Piera Borghi s.r.l.","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9734884","https://www.enforcementtracker.com/ETid-992",null,null,null,null,"casa di cura fondazione gaetano e piera borghi srl",null,null,null,null,null,null,null,null,null],["2021/LU/003","ETid-1001","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-12-01","day",6800,null,"EUR",null,"Employment","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-47FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1001","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_47FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/PL/001","ETid-1069","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-12-01","day",4000,null,"EUR","Pactum Poland Sp. z o.o.","Industry and Commerce","Art. 31, Art. 58(1)(e)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.16.2021","https://www.enforcementtracker.com/ETid-1069",null,null,null,null,"pactum poland spzoo",null,null,null,null,null,null,null,null,null],["2021/ES/021","ETid-933","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-12-01","day",5000,null,"EUR","INTRODUCTION BUSINESS CAPITAL MEDIA, S.L.","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00459-2021.pdf","https://www.enforcementtracker.com/ETid-933",null,null,null,null,"introduction business capital media sl",null,null,null,null,null,null,null,null,null],["2021/ES/025","ETid-923","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-30","day",1500,null,"EUR","Neighborhood community","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00349-2021.pdf","https://www.enforcementtracker.com/ETid-923",null,null,null,null,"ES: neighborhood community",null,null,null,null,null,null,null,null,null],["2021/ES/024","ETid-924","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-30","day",5000,null,"EUR","ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE","Public Sector and Education","Art. 17(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00417-2021.pdf","https://www.enforcementtracker.com/ETid-924",null,null,null,null,"ES: asociacion espanola para la ensenanza online",null,null,null,null,null,null,null,null,null],["2021/ES/023","ETid-925","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-30","day",20000,null,"EUR","DAVISER SERVICIOS, S.L.","Transportation and Energy","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00010-2021.pdf","https://www.enforcementtracker.com/ETid-925",null,null,null,null,"daviser servicios sl",null,null,null,null,null,null,null,null,null],["2021/ES/022","ETid-926","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-30","day",5000,null,"EUR","ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE","Public Sector and Education","Art. 17(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00424-2021.pdf","https://www.enforcementtracker.com/ETid-926",null,null,null,null,"ES: asociacion espanola para la ensenanza online",null,null,null,null,null,null,null,null,null],["2021/GR/034","HDPA (Greece) - 4/2022","gdprhub","Greece","GR","HDPA (Greece)","2021-11-30","day",9100000,"9,100,000","EUR","Cosmote",null,"Art. 13, Art. 14, Art. 25(1), Art. 26, Art. 28, Art. 32, Art. 35(7), Art. 5(1)(a), Art. 5(1)(f), Art. 5(2), Art. 83","Accountability, DPIA, Data principles, Data security, Processor obligations, Transparency",null,null,"https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-peristatiko-parabiasis-prosopikon-dedomenon-kai-mi","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_4/2022",null,"gdprhub",null,null,"GR: cosmote",null,null,null,null,null,null,null,null,null],["2021/BE/032","APD/GBA (Belgium) - 130/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-11-29","day",null,"None","EUR",null,null,"Art. 5(1)(b), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/avertissement-et-reprimande-n-130-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_130/2021",null,"gdprhub",null,"Public authority",null,null,null,null,null,null,null,null,null,null],["2021/HR/008","AZOP (Croatia) - Decision 29-11-2021","gdprhub","Croatia","HR","AZOP (Croatia)","2021-11-29","day",null,null,null,null,null,"Art. 5(1)(a), Art. 6(1)(c)","Data principles, Unlawful processing",null,"Rejected","https://azop.hr/wp-content/uploads/2023/10/Preslika-osobne-iskaznice_zahtjev-odbijen.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_29-11-2021",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2021/ES/027","ETid-921","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-29","day",4000,null,"EUR","TIGERS MARKET, S.L.","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00489-2021.pdf","https://www.enforcementtracker.com/ETid-921",null,null,null,null,"tigers market sl",null,null,null,null,null,null,null,null,null],["2021/ES/026","ETid-922","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-29","day",1000,null,"EUR","Restaurant owner","Accommodation and Hospitality","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00305-2021.pdf","https://www.enforcementtracker.com/ETid-922",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/LT/001","ETid-927","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2021-11-29","day",110000,null,"EUR","UAB Prime Leasing","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/2021%20Prime%20Leasing%2C%20CityBee%20(Privatus).pdf","https://www.enforcementtracker.com/ETid-927","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_VDAI_vs_UAB_Prime_Leasing","gdprhub",null,null,"uab prime leasing",null,null,null,null,null,null,null,null,null],["2021/GB/020","ICO (UK) - EB Associates","gdprhub","United Kingdom","GB","ICO (UK)","2021-11-29","day",null,"140,000","GBP","EB Associates Group Limited",null,null,null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/eb-associates-mpn/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_EB_Associates",null,"gdprhub",null,null,"eb associates group ltd",null,140000.0,165518,"day 2021-11-29|0.8458|GBP",null,null,null,null,null],["2021/IS/033","Persónuvernd (Iceland) - 2020061951","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-11-29","day",null,"None","EUR","Íslenskrar erfðagreiningar",null,"Art. 5(1)","Data principles",null,"Violation found","https://www.personuvernd.is/urlausnir/oflun-samthykkis-covid-19-sjuklinga-fyrir-notkun-blodsyna-i-thagu-rannsoknar-a-vegum-islenskrar-erfdagreiningar","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020061951",null,"gdprhub",null,null,"IS: islenskrar erfagreiningar",null,null,null,null,null,null,null,null,null],["2021/FR/021","CNIL (France) - MED-2021-134","gdprhub","France","FR","CNIL (France)","2021-11-26","day",null,"None","EUR","CLEARVIEW AI",null,"Art. 12, Art. 15, Art. 17, Art. 6","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044499030?init=true&page=1&query=CLEARVIEW&searchField=ALL&tab_selection=all","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_MED-2021-134",null,"gdprhub",null,null,"FR: clearview ai","Clearview AI",null,null,null,null,null,null,null,null],["2021/RO/003","ETid-915","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-11-26","day",2000,null,"EUR","Valoris Center S.R.L.","Industry and Commerce","Art. 29, Art. 32(1)(b), Art. 32(4)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_26_11_2021_Amenda&lang=ro","https://www.enforcementtracker.com/ETid-915",null,null,null,null,"valoris center srl",null,null,null,null,null,null,null,null,null],["2021/IS/030","Persónuvernd (Iceland) - nr. 2020123070","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-11-26","day",null,"None","EUR",null,null,"Art. 15","Data subject rights",null,"Rejected","https://www.personuvernd.is/urlausnir/ekki-tekin-afstada-til-kvortunar-vegna-adgangs-ad-personuupplysingum-kvortun-yfir-skorti-a-upplysingum-um-aminningu-visad","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_nr._2020123070",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2021/DK/023","Datatilsynet (Denmark) - 2021-442-11601","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-11-25","day",null,"None","EUR","Silkeborg Municipality",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/nov/foelsomme-oplysninger-i-ukrypteret-mail-fra-silkeborg-kommune","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-442-11601",null,"gdprhub",null,null,"DK: silkeborg municipality",null,null,null,null,null,null,null,null,null],["2021/IT/013","ETid-1026","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-11-25","day",400000,null,"EUR","B&T S.p.A.","Industry and Commerce","Art. 12, Art. 13, Art. 14, Art. 21, Art. 5(1)(a), Art. 6(1)(a)","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9741157","https://www.enforcementtracker.com/ETid-1026",null,null,null,null,"IT: b and tspa",null,null,null,null,null,null,null,null,null],["2021/IT/012","ETid-1027","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-11-25","day",200000,null,"EUR","Aimon Srl","Media, Telecoms and Broadcasting","Art. 12, Art. 21, Art. 5(1)(a), Art. 6(1)(a)","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9741157","https://www.enforcementtracker.com/ETid-1027",null,null,null,null,"aimon srl",null,null,null,null,null,null,null,null,null],["2021/GB/001","ETid-930","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2021-11-25","day",585000,null,"EUR","Cabinet Office","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/12/cabinet-office-fined-500-000-for-new-year-honours-data-breach/","https://www.enforcementtracker.com/ETid-930",null,null,null,null,"GB: cabinet office",null,null,null,null,null,null,null,null,null],["2021/NL/009","ETid-946","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2021-11-25","day",2750000,null,"EUR","Dutch Minister of Finance","Public Sector and Education","Art. 5(1)(a), Art. 6(1)(e)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://autoriteitpersoonsgegevens.nl/nl/nieuws/boete-belastingdienst-voor-discriminerende-en-onrechtmatige-werkwijze","https://www.enforcementtracker.com/ETid-946",null,null,null,null,"NL: dutch minister of finance",null,null,null,null,null,null,null,null,null],["2021/IT/018","ETid-993","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-11-25","day",6000,null,"EUR","Società H San Raffaele Resnati s.r.l.","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9732967","https://www.enforcementtracker.com/ETid-993",null,null,null,null,"societa h san raffaele resnati srl",null,null,null,null,null,null,null,null,null],["2021/NO/052","Datatilsynet (Norway) - 20/01893","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-11-24","day",null,"1000000","NOK","Statens pensjonskasse (SPK - The Norwegian Public Service Pension Fund)",null,"Art. 5(1)(c), Art. 5(1)(e), Art. 6(1), Art. 9(2)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/cafec165542143da94fb0a7d119001ef/~-20_01893-12-vedtak-om-overtredelsesgebyr--245646_15_1.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01893",null,"gdprhub",null,null,"NO: statens pensjonskasse",null,1000000.0,99741,"day 2021-11-24|10.0260|NOK",null,null,null,null,null],["2021/ES/028","ETid-918","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-24","day",9000,null,"EUR","UNIÓN FINANCIERA ASTURIANA S.A. E.F.C.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00467-2021.pdf","https://www.enforcementtracker.com/ETid-918",null,null,null,null,"ES: union financiera asturiana saefc",null,null,null,null,null,null,null,null,null],["2021/NO/004","ETid-948","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-11-24","day",98000,null,"EUR","Norwegian State Pension Fund (SPK)","Public Sector and Education","Art. 6(1), Art. 9(2)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/vedtak-om-overtredelsesgebyr-til-statens-pensjonskasse/","https://www.enforcementtracker.com/ETid-948",null,null,null,null,"NO: norwegian state pension fund",null,null,null,null,null,null,null,null,null],["2021/ES/030","ETid-913","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-23","day",3000,null,"EUR","FUENSANTA S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00289-2021.pdf","https://www.enforcementtracker.com/ETid-913",null,null,null,null,"fuensanta sl",null,null,null,null,null,null,null,null,null],["2021/ES/029","ETid-914","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-23","day",40000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00269-2021.pdf","https://www.enforcementtracker.com/ETid-914",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/IS/002","ETid-916","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2021-11-23","day",51000,null,"EUR","Icelandic Ministry of Industry and Innovation","Public Sector and Education","Art. 13, Art. 25, Art. 28, Art. 32, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Data security, Processor obligations, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/akvordun-um-sekt-vegna-ferdagjafar-stjornvalda","https://www.enforcementtracker.com/ETid-916",null,null,null,null,"IS: icelandic ministry of industry and innovation",null,null,null,null,null,null,null,null,null],["2021/IS/001","ETid-917","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2021-11-23","day",27200,null,"EUR","YAY ehf.","Industry and Commerce","Art. 28, Art. 32, Art. 5, Art. 6","Data principles, Data security, Processor obligations, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/akvordun-um-sekt-vegna-ferdagjafar-stjornvalda","https://www.enforcementtracker.com/ETid-917",null,null,null,null,"yay ehf",null,null,null,null,null,null,null,null,null],["2021/ES/019","ETid-935","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-23","day",40000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00280-2021.pdf","https://www.enforcementtracker.com/ETid-935",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/018","ETid-936","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-23","day",40000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00269-2021.pdf","https://www.enforcementtracker.com/ETid-936",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/IS/032","Persónuvernd (Iceland) - 2020061954","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-11-23","day",null,"None","EUR","Chief Epidemiologist of the Office of the Medical Director of Health",null,"Art. 14(1), Art. 28(3)","Processor obligations, Transparency",null,"Violation found","https://www.personuvernd.is/urlausnir/frumkvaedisathugun-personuverndar-a-vinnslu-personuupplysinga-i-tengslum-vid-skimanir-fyrir-sars-cov-2-veirunni-og-motefni","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020061954",null,"gdprhub",null,null,"IS: chief epidemiologist of the office of the medical director of health",null,null,null,null,null,null,null,null,null],["2021/IS/031","Persónuvernd (Iceland) - 2020092288","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-11-23","day",null,"11500000","ISK","Ministry of Industries and Innovation",null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 28(3), Art. 32, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Data security, Processor obligations, Transparency, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/akvordun-um-sekt-vegna-ferdagjafar-stjornvalda","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020092288",null,"gdprhub",null,null,"IS: ministry of industries and innovation",null,11500000.0,77913,"day 2021-11-23|147.6000|ISK",null,null,null,null,null],["2021/IS/008","Persónuvernd (Iceland) - 202112772","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-11-23","day",null,"None","EUR","Landspítali – The National University Hospital of Iceland",null,"Art. 35(1)","DPIA",null,"Violation found","https://www.personuvernd.is/urlausnir/oryggi-personuupplysinga-hja-theim-hluta-sykla-og-veirufraedideildar-landspitalans-sem-stadsettur-var-a-starfsstod","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_202112772",null,"gdprhub",null,null,"IS: landspitali the national university hospital of iceland",null,null,null,null,null,null,null,null,null],["2021/ES/034","ETid-907","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-22","day",1000,null,"EUR","Neighborhood community","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00339-2021.pdf","https://www.enforcementtracker.com/ETid-907",null,null,null,null,"ES: neighborhood community",null,null,null,null,null,null,null,null,null],["2021/ES/032","ETid-911","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-22","day",3000,null,"EUR",null,null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00165-2021.pdf","https://www.enforcementtracker.com/ETid-911",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/031","ETid-912","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-22","day",2000,null,"EUR","ANIVERSALIA NETWORKS, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00346-2021.pdf","https://www.enforcementtracker.com/ETid-912",null,null,null,null,"aniversalia networks sl",null,null,null,null,null,null,null,null,null],["2021/CZ/006","ETid-2808","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-11-19","day",800,null,"EUR","Legal Person","Finance, Insurance and Consulting","Art. 12(4)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/132-cj-uoou-0117221-19-dokument-c-132.pdf","https://www.enforcementtracker.com/ETid-2808",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/055","HBDI (Hesse) - 62334 (IMI Case)","gdprhub","Germany","DE","HBDI (Hesse)","2021-11-19","day",null,null,null,null,null,"Art. 16, Art. 58(2)(b), Art. 60","Data subject rights",null,"Violation found","https://edpb.europa.eu/system/files/2022-02/de_-_he_2021-11_right_to_rectification_decisionpublic.pdf","https://gdprhub.eu/index.php?title=HBDI_%28Hesse%29_-_62334_%28IMI_Case%29",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/GR/031","HDPA (Greece) - 51/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-11-19","day",null,"None","EUR",null,null,"Art. 21(1), Art. 22","Data subject rights",null,"Rejected","https://www.dpa.gr/el/enimerwtiko/prakseisArxis","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_51/2021",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2021/SE/015","IMY (Sweden) - DI-2019-13667","gdprhub","Sweden","SE","IMY (Sweden)","2021-11-17","day",null,"None","EUR","The Swedish Migration Agency",null,"Art. 32, Art. 5(1)(e), Art. 58(2)(a)","Data principles, Data security",null,null,"https://www.imy.se/globalassets/dokument/tillsynsbeslut-vis-migrationsverket.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2019-13667",null,"gdprhub",null,null,"SE: the swedish migration agency",null,null,null,null,null,null,null,null,null],["2021/IS/029","Persónuvernd (Iceland) - no. 2020010552","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-11-17","day",null,"None","EUR",null,null,"Art. 2(2)(c)",null,null,"Rejected","https://www.personuvernd.is/urlausnir/kvortun-yfir-birtingu-ljosmynda-a-samfelagsmidli-visad-fra","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_no._2020010552",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/HR/006","AZOP (Croatia) - Decision 16-11-2021","gdprhub","Croatia","HR","AZOP (Croatia)","2021-11-16","day",null,null,null,null,null,"Art. 4(1)",null,null,"Rejected","https://azop.hr/wp-content/uploads/2022/09/Rjesenje-objava-fotografije-na-oglasniku-za-promet-nekretnina.pdf","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_16-11-2021",null,"gdprhub",null,"Real estate agency",null,null,null,null,null,null,null,null,null,null],["2021/GR/029","HDPA (Greece) - 50/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-11-16","day",null,"None","EUR","Hellenic Ministry of Education and Religions Affairs",null,"Art. 12(1), Art. 25(1), Art. 35(9), Art. 37(7), Art. 46, Art. 5(1)(a), Art. 6(1)(c), Art. 6(1)(e)","Accountability, DPIA, Data principles, Data protection officer, International transfers, Transparency, Unlawful processing",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/diadikasia-syghronis-ex-apostaseos-ekpaideysis-apo-ypoyrgeio-paideias","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_50/2021",null,"gdprhub",null,null,"GR: hellenic ministry of education and religions affairs",null,null,null,null,null,null,null,null,null],["2021/ES/037","ETid-903","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-15","day",1000,null,"EUR","Supermarket","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00149-2021.pdf","https://www.enforcementtracker.com/ETid-903",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/036","ETid-904","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-15","day",1000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00351-2021.pdf","https://www.enforcementtracker.com/ETid-904",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/035","ETid-905","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-15","day",30000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00312-2021.pdf","https://www.enforcementtracker.com/ETid-905",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/033","ETid-908","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-15","day",40000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00268-2021.pdf","https://www.enforcementtracker.com/ETid-908",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/GB/021","ICO (UK) - Cabinet Office","gdprhub","United Kingdom","GB","ICO (UK)","2021-11-15","day",null,"500000","GBP","Cabinet Office",null,"Art. 32(1), Art. 33(1), Art. 5(1)(f)","Data breach, Data principles, Data security",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4019105/cabinet-office-mpn-202112.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Cabinet_Office",null,"gdprhub",null,null,"GB: cabinet office",null,500000.0,587096,"day 2021-11-15|0.8517|GBP",null,null,null,null,null],["2021/RO/004","ETid-898","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-11-14","day",2900,null,"EUR","Vodafone România SA","Media, Telecoms and Broadcasting","Art. 32(1)(b), Art. 32(2)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_11_11_2021&lang=ro","https://www.enforcementtracker.com/ETid-898","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_VODAFONE_Rom%C3%A2nia_S.A._5","gdprhub",null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/039","ETid-899","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-12","day",1500,null,"EUR","Company","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00307-2021.pdf","https://www.enforcementtracker.com/ETid-899",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/038","ETid-900","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-12","day",3000,null,"EUR","AD735 DATA MEDIA ADVERTISING S.L.","Media, Telecoms and Broadcasting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00240-2021.pdf","https://www.enforcementtracker.com/ETid-900",null,null,null,null,"ad735 data media advertising sl",null,null,null,null,null,null,null,null,null],["2021/NL/010","ETid-902","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2021-11-12","day",400000,null,"EUR","Transavia","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boete_transavia.pdf","https://www.enforcementtracker.com/ETid-902","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_23.09.2021","gdprhub",null,null,"NL: transavia",null,null,null,null,null,null,null,null,null],["2021/CY/002","ETid-909","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-11-12","day",925000,null,"EUR","WS WiSpear Systems Ltd","Industry and Commerce","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/D7D2A1120DDE670AC225878B0040D4E7?OpenDocument","https://www.enforcementtracker.com/ETid-909",null,null,null,null,"ws wispear systems ltd",null,null,null,null,null,null,null,null,null],["2021/NO/055","Datatilsynet (Norway) - 20/02319","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-11-11","day",null,"None","EUR","Komplett Bank ASA",null,"Art. 12(1), Art. 12(3), Art. 13(1)(c), Art. 13(2)(b), Art. 21(3), Art. 21(4), Art. 6(1)(b)","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://edpb.europa.eu/system/files/2022-02/no_2021-11_decisionpublic.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02319",null,"gdprhub",null,null,"komplett bank asa",null,null,null,null,null,null,null,null,null],["2021/IT/021","ETid-976","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-11-11","day",150000,null,"EUR","TIM S.p.A.","Media, Telecoms and Broadcasting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9722894","https://www.enforcementtracker.com/ETid-976",null,null,null,null,"tim spa",null,null,null,null,null,null,null,null,null],["2021/BE/030","APD/GBA (Belgium) - 124/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-11-10","day",null,"None","EUR",null,null,"Art. 13(1)(c), Art. 6(3)","Transparency, Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-124-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_124/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/BE/029","APD/GBA (Belgium) - 125/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-11-10","day",null,"None","EUR",null,null,"Art. 5(1)(b), Art. 6(1)(f), Art. 6(4)","Data principles, Unlawful processing",null,"Violation found","https://gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-125-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_125/2021",null,"gdprhub",null,"Fitness club",null,null,null,null,null,null,null,null,null,null],["2021/LU/002","ETid-1003","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-11-09","day",1500,null,"EUR",null,"Employment","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-44FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1003","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_44FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/FI/020","Tietosuojavaltuutetun toimisto (Finland) - 4356/532/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-11-09","day",null,"None","EUR","Bisnode Finland Oy",null,"Art. 25(1), Art. 5(1)(a), Art. 58(2)(b), Art. 58(2)(d), Art. 83","Accountability, Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211225#OT2","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4356/532/19",null,"gdprhub",null,null,"bisnode finland oy",null,null,null,null,null,null,null,null,null],["2021/FI/021","Tietosuojavaltuutetun toimisto (Finland) - 8211/161/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-11-09","day",null,"None","EUR","Oikeusrekisterikeskus",null,"Art. 24(1), Art. 24(2), Art. 25(1), Art. 5(1)(a), Art. 5(1)(d), Art. 58(2)(d), Art. 83(7)","Accountability, Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211225#OT2","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8211/161/19",null,"gdprhub",null,null,"FI: oikeusrekisterikeskus",null,null,null,null,null,null,null,null,null],["2021/FI/019","Tietosuojavaltuutetun toimisto (Finland) - 834/532/18","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-11-09","day",null,"None","EUR","Suomen Asiakastieto Oy",null,"Art. 25(1), Art. 5(1)(a), Art. 58(2)(b), Art. 58(2)(d), Art. 83","Accountability, Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211225#OT2","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_834/532/18",null,"gdprhub",null,null,"suomen asiakastieto oy",null,null,null,null,null,null,null,null,null],["2021/DK/024","Datatilsynet (Denmark) - 2021-442-12924","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-11-08","day",null,"None","EUR","Region Nordjylland",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/nov/region-nordjylland-faar-kritik-for-manglende-sikkerhed-omkring-selvbetjeningsloesning","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-442-12924",null,"gdprhub",null,null,"DK: region nordjylland",null,null,null,null,null,null,null,null,null],["2021/ES/228","APDCAT (Catalonia) - IAI 68/2021 - IAI 71/2021","gdprhub","Spain","ES","APDCAT (Catalonia)","2021-11-04","day",null,"None","EUR",null,null,"Art. 10, Art. 86, Art. 9","Special categories",null,null,"https://apdcat.gencat.cat/web/.content/Resolucio/Resolucions_Cercador/Dictamens/2021/Documents/ca_iai_2021_068.pdf","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_IAI_68/2021_-_IAI_71/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/DK/025","Datatilsynet (Denmark) - 2021-441-9356","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-11-04","day",null,null,null,"Coop Danmark A/S",null,"Art. 32(1), Art. 33(1), Art. 4(12)","Data breach, Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/nov/alvorlig-kritik-af-coop-danmark-as%e2%80%99-behandling-af-oplysninger-paa-virksomhedens-faellesdrev-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-441-9356",null,"gdprhub",null,null,"coop danmark as",null,null,null,null,null,null,null,null,null],["2021/FR/006","ETid-910","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-11-04","day",400000,null,"EUR","Régie autonome des transports parisiens","Transportation and Energy","Art. 32, Art. 5(1)(c), Art. 5(1)(e), Art. 5(2)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/fichiers-devaluation-des-agents-sanction-de-400-000-euros-lencontre-de-la-ratp","https://www.enforcementtracker.com/ETid-910",null,null,null,null,"FR: regie autonome des transports parisiens",null,null,null,null,null,null,null,null,null],["2021/ES/017","ETid-937","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-11-02","day",2000,null,"EUR","COOPERA RC SERVICES, S.L.","Media, Telecoms and Broadcasting","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00452-2021.pdf","https://www.enforcementtracker.com/ETid-937",null,null,null,null,"coopera rc services sl",null,null,null,null,null,null,null,null,null],["2021/IS/028","Persónuvernd (Iceland) - 2021010073","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-11-02","day",null,"None","EUR",null,null,"Art. 2(2)(c), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/rafraen-voktun-i-fjoleignarhusi-samraemdist-ekki-logum","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2021010073",null,"gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/CZ/004","ETid-2823","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-11-01","day",1000,null,"EUR","Legal Person","Transportation and Energy","Art. 12(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/166-cj-uoou-0441221-3-dokument-c-166.pdf","https://www.enforcementtracker.com/ETid-2823",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/006","ETid-890","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-11-01","day",1000,null,"EUR","IKEA ROMÂNIA SA","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_01_11_2021_2&lang=ro","https://www.enforcementtracker.com/ETid-890","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_IKEA_ROM%C3%82NIA_SA","gdprhub",null,null,"ikea romania sa",null,null,null,null,null,null,null,null,null],["2021/RO/005","ETid-891","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-11-01","day",5000,null,"EUR","S.P.E.E.H. Hidroelectrica S.A.","Transportation and Energy",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_Presa_01_11_2021_1&lang=ro","https://www.enforcementtracker.com/ETid-891",null,null,null,null,"speeh hidroelectrica sa",null,null,null,null,null,null,null,null,null],["2021/FR/024","CNIL (France) - SAN-2021-019","gdprhub","France","FR","CNIL (France)","2021-10-29","day",400000,"400000","EUR","RATP",null,"Art. 32, Art. 5(1)(c), Art. 5(1)(e), Art. 5(2)","Data principles, Data security",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044286815?init=true&page=1&query=san-2021-019&searchField=ALL&tab_selection=all","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-019",null,"gdprhub",null,null,"FR: ratp",null,null,null,null,null,null,null,null,null],["2021/FI/014","Tietosuojavaltuutetun toimisto (Finland) - 6745/163/18","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-10-29","day",null,"None","EUR",null,null,"Art. 5(1), Art. 58(2)(d), Art. 9(2)(g)","Data principles, Special categories",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211063","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6745/163/18",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/FI/017","Tietosuojavaltuutetun toimisto (Finland) - 9024/181/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-10-29","day",null,"None","EUR",null,null,"Art. 24, Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security",null,"Violation found","https://finlex-fi.translate.goog/fi/viranomaiset/tsv/2021/20211163?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=fr","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_9024/181/19",null,"gdprhub",null,"Cleaning company",null,null,null,null,null,null,null,null,null,null],["2021/IT/026","ETid-928","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-10-28","day",2000,null,"EUR","OTTO s.r.l.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9721784","https://www.enforcementtracker.com/ETid-928",null,null,null,null,"otto srl",null,null,null,null,null,null,null,null,null],["2021/IT/025","ETid-929","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-10-28","day",2000,null,"EUR","Anfiteatro Flavio s.r.l.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9721758","https://www.enforcementtracker.com/ETid-929",null,null,null,null,"anfiteatro flavio srl",null,null,null,null,null,null,null,null,null],["2021/LU/032","CNPD (Luxembourg) - Délibération n° 42FR/2021","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2021-10-27","day",null,"None","EUR",null,null,"Art. 37(1)","Data protection officer",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-42FR-2021-sous-forme-anonymisee.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_42FR/2021",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2021/LU/033","CNPD (Luxembourg) - Délibération n°43FR/2021","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2021-10-27","day",null,"None","EUR",null,null,"Art. 37(1)","Data protection officer",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-43FR-2021-sous-forme-anonymisee.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B043FR/2021",null,"gdprhub",null,"Non-profit association",null,null,null,null,null,null,null,null,null,null],["2021/LU/001","ETid-1747","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-10-27","day",18700,null,"EUR","Company",null,"Art. 37(7), Art. 39(1)(b)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-41FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-1747","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_41FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/LU/004","ETid-920","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-10-27","day",15400,null,"EUR",null,null,null,"Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-40FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-920",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/HU/002","ETid-955","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-10-27","day",13500,null,"EUR","Car importer","Industry and Commerce","Art. 12(1), Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=469:jogos-erdekre-alapitott-ugyfelelegedettseg-meres-adatvedelmi-megfelelesenek-ertekelese","https://www.enforcementtracker.com/ETid-955",null,null,null,null,"HU: car importer",null,null,null,null,null,null,null,null,null],["2021/HU/016","NAIH (Hungary) - NAIH-2857-20/2021","gdprhub","Hungary","HU","NAIH (Hungary)","2021-10-27","day",null,"5000000","HUF",null,null,"Art. 12(1), Art. 13, Art. 5(1), Art. 5(2), Art. 58(2)(d), Art. 6(1), Art. 83(2)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=469:jogos-erdekre-alapitott-ugyfelelegedettseg-meres-adatvedelmi-megfelelesenek-ertekelese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2857-20/2021",null,"gdprhub",null,"Car importer",null,null,5000000.0,13734,"day 2021-10-27|364.0500|HUF",null,null,null,null,null],["2021/ES/043","ETid-886","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-26","day",64000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00249-2021.pdf","https://www.enforcementtracker.com/ETid-886","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00249/2021","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/042","ETid-887","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-26","day",16000,null,"EUR","SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L.","Industry and Commerce","Art. 35","DPIA, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00050-2021.pdf","https://www.enforcementtracker.com/ETid-887","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00050/2021","gdprhub",null,null,"servicios logisticos martorell siglo xxi sl",null,null,null,null,null,null,null,null,null],["2021/ES/041","ETid-888","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-26","day",40000,null,"EUR","VODAFONE SERVICIOS, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00195-2021.pdf","https://www.enforcementtracker.com/ETid-888",null,null,null,null,"vodafone servicios slu","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/040","ETid-889","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-26","day",40000,null,"EUR","VODAFONE SERVICIOS, S.L.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00242-2021.pdf","https://www.enforcementtracker.com/ETid-889",null,null,null,null,"vodafone servicios slu","Vodafone",null,null,null,null,null,null,null,null],["2021/BG/001","ETid-906","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2021-10-26","day",380,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.cpdp.bg/download.php?part=rubric_element&aid=4786","https://www.enforcementtracker.com/ETid-906",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/044","ETid-885","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-25","day",3000,null,"EUR","MERCEDES GERENCIA, S.L.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00239-2021.pdf","https://www.enforcementtracker.com/ETid-885",null,null,null,null,"mercedes gerencia sl",null,null,null,null,null,null,null,null,null],["2021/GB/031","ICO (UK) - Unite the Union","gdprhub","United Kingdom","GB","ICO (UK)","2021-10-25","day",null,"36000","GBP","Unite the Union",null,"Art. 32, Art. 42, Art. 43","Data security",null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/unite-the-union/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Unite_the_Union",null,"gdprhub",null,null,"GB: unite the union",null,36000.0,42664,"day 2021-10-25|0.8438|GBP",null,null,null,null,null],["2021/BE/028","APD/GBA (Belgium) - 117/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-10-22","day",null,"None","EUR","Y, defendant",null,"Art. 24(1), Art. 32(1), Art. 38(3), Art. 57(1)(f), Art. 9","Accountability, Data protection officer, Data security, Special categories",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-117-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_117/2021",null,"gdprhub",null,null,"BE: y defendant",null,null,null,null,null,null,null,null,null],["2021/RO/007","ETid-880","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-10-21","day",5000,null,"EUR","Glove Technology SRL","Industry and Commerce","Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_21.10.2021_2&lang=ro","https://www.enforcementtracker.com/ETid-880","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Glove_Technology_SRL","gdprhub",null,null,"glove technology srl",null,null,null,null,null,null,null,null,null],["2021/ES/045","ETid-884","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-21","day",3000000,null,"EUR","CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00500-2020.pdf","https://www.enforcementtracker.com/ETid-884","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00500/2020","gdprhub",null,null,"caixabank payments and consumer efc ep sau","CaixaBank",null,null,null,null,null,null,null,null],["2021/FI/016","Tietosuojavaltuutetun toimisto (Finland) - 3592/152/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-10-21","day",null,"None","EUR",null,null,"Art. 12(1), Art. 15(3)","Data subject rights, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211123","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3592/152/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/DK/021","Datatilsynet (Denmark) - 2021-431-0125","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-10-20","day",null,"None","EUR","Alstrøm – Din Isenkræmmer ApS",null,"Art. 4(11), Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/okt/alvorlig-kritik-af-alstroem-din-isenkraemmer-aps’-behandling-af-personoplysninger-om-hjemmesidebesoegende","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0125",null,"gdprhub",null,null,"alstrm din isenkrmmer aps",null,null,null,null,null,null,null,null,null],["2021/ES/048","ETid-879","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-19","day",70000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00142-2021.pdf","https://www.enforcementtracker.com/ETid-879",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/047","ETid-881","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-19","day",40000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00352-2021.pdf","https://www.enforcementtracker.com/ETid-881",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/046","ETid-882","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-19","day",2000,null,"EUR","BEEPING FULFILMENT S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00163-2021.pdf","https://www.enforcementtracker.com/ETid-882",null,null,null,null,"beeping fulfilment sl",null,null,null,null,null,null,null,null,null],["2021/DE/056","LfDI (Baden-Württemberg) - 4 Sa 70/20","gdprhub","Germany","DE","LfDI (Baden-Württemberg)","2021-10-19","day",null,null,null,null,null,"Art. 4(15), Art. 7(4), Art. 9(2)(a)","Consent, Special categories",null,"Rejected","https://lrbw.juris.de/cgi-bin/laender_rechtsprechung/document.py?Gericht=bw&Art=en&sid=74127789716c5f5278c4cef1f44fcfc2&nr=36334&pos=0&anz=24","https://gdprhub.eu/index.php?title=LfDI_%28Baden-W%C3%BCrttemberg%29_-_4_Sa_70/20",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2021/DK/022","Datatilsynet (Denmark) - 2021-32-2067","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-10-18","day",null,"None","EUR","Falkonergården (High School)",null,"Art. 32, Art. 33","Data breach, Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/okt/klage-over-sikkerhedsbrud-hos-falkonergaardens-gymnasium-og-hf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-32-2067",null,"gdprhub",null,null,"DK: falkonergarden",null,null,null,null,null,null,null,null,null],["2021/NO/005","ETid-878","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-10-18","day",412000,null,"EUR","Østre Toten municipality","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/4609027cf9504e9aa12c3f05b45bdcf7/varsel-om-vedtak-om-overtredelsesgebyr-og-palegg.pdf","https://www.enforcementtracker.com/ETid-878","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/00480","gdprhub",null,null,"NO: stre toten municipality",null,null,null,null,null,null,null,null,null],["2021/GB/002","ETid-883","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2021-10-18","day",11800,null,"EUR","HIV Scotland","Individuals and Private Associations","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media/action-weve-taken/mpns/4018736/mpn-hiv-scotland-20211018.pdf,","https://www.enforcementtracker.com/ETid-883",null,null,null,null,"GB: hiv scotland",null,null,null,null,null,null,null,null,null],["2021/GB/019","ICO (UK) - HIV Scotland","gdprhub","United Kingdom","GB","ICO (UK)","2021-10-18","day",null,"10000","GBP","HIV Scotland",null,"Art. 32(1), Art. 32(2), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4018736/mpn-hiv-scotland-20211018.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_HIV_Scotland",null,"gdprhub",null,null,"GB: hiv scotland",null,10000.0,11843,"day 2021-10-18|0.8444|GBP",null,null,null,null,null],["2021/FI/015","Tietosuojavaltuutetun toimisto (Finland) - 6132/151/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-10-15","day",null,"None","EUR",null,null,"Art. 12(5), Art. 15(3), Art. 25(1)","Accountability, Data subject rights, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211083","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6132/151/19",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/PL/003","ETid-901","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-10-14","day",78000,null,"EUR","Bank Millennium S.A","Finance, Insurance and Consulting","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.16.2021","https://www.enforcementtracker.com/ETid-901","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.16.2021","gdprhub",null,null,"bank millennium sa",null,null,null,null,null,null,null,null,null],["2021/GR/005","ETid-919","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-10-14","day",20000,null,"EUR","ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ","Industry and Commerce","Art. 12(2), Art. 21, Art. 6","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2021-11/48_2021anonym.pdf","https://www.enforcementtracker.com/ETid-919","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_48/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/IT/023","ETid-932","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-10-14","day",8000,null,"EUR","Health Protection Agency of Sardinia (ATS)","Health Care","Art. 5, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9722265","https://www.enforcementtracker.com/ETid-932",null,null,null,null,"IT: health protection agency of sardinia",null,null,null,null,null,null,null,null,null],["2021/GR/027","HDPA (Greece) - 7/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-10-14","day",null,"None","EUR","Athens Bar Association",null,"Art. 21, Art. 4(10), Art. 4(7), Art. 6(1)(e), Art. 6(4)","Data subject rights, Unlawful processing",null,null,"https://www.dpa.gr/el/enimerwtiko/prakseisArxis/prosbasi-ton-ypopsifion-stis-ekloges-toy-dsa-sta-stoiheia-epikoinonias","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_7/2021",null,"gdprhub",null,null,"GR: athens bar association",null,null,null,null,null,null,null,null,null],["2021/LU/027","CNPD (Luxembourg) - Délibération n°37FR/2021","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2021-10-13","day",null,"None","EUR",null,null,"Art. 37(7), Art. 38(6)","Data protection officer",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-37FR-2021-sous-forme-anomyisee.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B037FR/2021",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2021/DK/020","Datatilsynet (Denmark) - 2020-441-6990","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-10-13","day",null,"None","EUR","Dantherm A/S",null,"Art. 24(1), Art. 32(1)","Accountability, Data security",null,null,"https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/okt/brud-paa-persondatasikkerheden-hos-dantherm","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-441-6990",null,"gdprhub",null,null,"dantherm as",null,null,null,null,null,null,null,null,null],["2021/ES/049","ETid-870","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-13","day",40000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00111-2021.pdf","https://www.enforcementtracker.com/ETid-870","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00111/2021","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/LU/006","ETid-895","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-10-13","day",13200,null,"EUR",null,null,"Art. 38(1), Art. 39(1)(b)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-36FR-2021-sous-forme-anomyisee.pdf","https://www.enforcementtracker.com/ETid-895","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_36FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/LU/005","ETid-896","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-10-13","day",18000,null,"EUR",null,null,"Art. 37(7), Art. 39(1)(b)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-38FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-896","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_38FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/FR/020","CNIL (France) - MEDP-2021-001","gdprhub","France","FR","CNIL (France)","2021-10-11","day",null,"None","EUR","Francetest",null,"Art. 32","Data security",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044199434?page=1&pageSize=10&query=2016%2F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_MEDP-2021-001",null,"gdprhub",null,null,"FR: francetest",null,null,null,null,null,null,null,null,null],["2021/ES/050","ETid-868","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-11","day",10000,null,"EUR","MAF.COM ESQUI CLUB","Industry and Commerce","Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00104-2021.pdf","https://www.enforcementtracker.com/ETid-868",null,null,null,null,"ES: maf com esqui club",null,null,null,null,null,null,null,null,null],["2021/AT/022","DSB (Austria) - 2021-0.698.184","gdprhub","Austria","AT","DSB (Austria)","2021-10-08","day",null,null,null,"N*** Marketing GmbH",null,"Art. 51(1), Art. 57(1)(f), Art. 6(1)(f), Art. 77(1)","Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20211008_2021_0_698_184_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.698.184",null,"gdprhub",null,null,"n marketing gmbh",null,null,null,null,null,null,null,null,null],["2021/ES/051","ETid-867","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-08","day",30000,null,"EUR","ORANGE ESPAGNE, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)(a)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00471-2020.pdf","https://www.enforcementtracker.com/ETid-867",null,null,null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2021/PL/029","UODO (Poland) - ZSPR.440.331.2019.PR.PAM","gdprhub","Poland","PL","UODO (Poland)","2021-10-07","day",null,"None","EUR",null,null,"Art. 15(1), Art. 58(2)(c)","Data subject rights",null,"Violation found","https://klmlaw.pl/publikacje/decyzja-prezesa-uodo-profile-marketingowe/","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSPR.440.331.2019.PR.PAM",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/IE/004","ETid-875","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2021-10-06","day",null,null,"EUR","Facebook Ireland Limited","Media, Telecoms and Broadcasting","Art. 12(1), Art. 13(1)(c), Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://noyb.eu/sites/default/files/2021-10/IN%2018-5-5%20Draft%20Decision%20of%20the%20IE%20SA.pdf","https://www.enforcementtracker.com/ETid-875",null,null,null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2021/LU/007","ETid-894","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-10-06","day",5300,null,"EUR",null,"Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-35FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-894","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_35FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/GR/032","HDPA (Greece) - 1/2022","gdprhub","Greece","GR","HDPA (Greece)","2021-10-06","day",1000,"1000","EUR",null,null,"Art. 12(3), Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiboli-prostimoy-gia-kathysterimeni-ikanopoiisi-dikaiomatos-prosbasis","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_1/2022",null,"gdprhub",null,"Greek company",null,null,null,null,null,null,null,null,null,null],["2021/ES/052","ETid-865","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-05","day",4000,null,"EUR","CLUB DEPORTIVO SANSUEÑA, S.L.","Industry and Commerce","Art. 5(1)(e), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00260-2021.pdf","https://www.enforcementtracker.com/ETid-865",null,null,null,null,"club deportivo sansuena sl",null,null,null,null,null,null,null,null,null],["2021/ES/055","ETid-861","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-04","day",2000,null,"EUR","Store owner","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00187-2021.pdf","https://www.enforcementtracker.com/ETid-861",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/054","ETid-862","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-04","day",1000,null,"EUR","Store owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00243-2021.pdf","https://www.enforcementtracker.com/ETid-862",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/053","ETid-864","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-10-04","day",5000,null,"EUR","CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L.","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00245-2021.pdf","https://www.enforcementtracker.com/ETid-864",null,null,null,null,"caldereria y soldadura de estructuras metalicas sl",null,null,null,null,null,null,null,null,null],["2021/GR/006","ETid-897","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-10-04","day",5000,null,"EUR","PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ","Industry and Commerce","Art. 21(3), Art. 25","Accountability, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-11/44_2021anonym.pdf","https://www.enforcementtracker.com/ETid-897",null,null,null,null,"GR: premiummedia",null,null,null,null,null,null,null,null,null],["2021/IS/027","Persónuvernd (Iceland) - no. 2020020909","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-10-04","day",null,"None","EUR","Creditinfo",null,"Art. 5(1), Art. 58(2)(g), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-creditinfo-a-personuupplysingum-ekki-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_no._2020020909",null,"gdprhub",null,null,"IS: creditinfo",null,null,null,null,null,null,null,null,null],["2021/IS/007","Persónuvernd (Iceland) - 2020010587","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-09-30","day",null,"None","EUR",null,null,"Art. 2(2)(c)",null,null,"Rejected","https://www.personuvernd.is/urlausnir/kvortun-yfir-rafraenni-voktun-nagranna-visad-fra","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020010587",null,"gdprhub",null,"Neighbours",null,null,null,null,null,"person",null,null,null,null],["2021/IS/025","Persónuvernd (Iceland) - 2020010642","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-09-30","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 6(1)(c), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-barnaverndarnefndar-a-personuupplysingum-kvartanda-til-skola-og-fristundasvids-og-eftirfarandi-vinnsla-thess-ekki-i","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020010642",null,"gdprhub",null,"Children Protection Committee",null,null,null,null,null,null,null,null,null,null],["2021/IS/026","Persónuvernd (Iceland) - nr. 2020082238","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-09-30","day",null,"None","EUR","MAGNA Lögmenn (law firm)",null,"Art. 5(1)(a), Art. 6(1)(f), Art. 9(2)(f)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-logmannsstofu-a-personuupplysingum-samraemdist-ekki-logum-um-personuvernd","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_nr._2020082238",null,"gdprhub",null,null,"IS: magna logmenn",null,null,null,null,null,null,null,null,null],["2021/AT/018","DSB (Austria) - 2021-0.568.642","gdprhub","Austria","AT","DSB (Austria)","2021-09-29","day",null,"None","EUR","N* GmbH",null,"Art. 4, Art. 51(1), Art. 6(1)(f), Art. 77(1), Art. 82(1), Art. 82(6)","Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210929_2021_0_568_642_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.568.642",null,"gdprhub",null,null,"n gmbh",null,null,null,null,null,null,null,null,null],["2021/IT/005","ETid-1316","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-29","day",11000,null,"EUR","Territorial Administration of the Government of Genoa","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9719797","https://www.enforcementtracker.com/ETid-1316",null,null,null,null,"IT: territorial administration of the government of genoa",null,null,null,null,null,null,null,null,null],["2021/ES/058","ETid-855","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-29","day",5000,null,"EUR","CYNGASA, S.L.","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00244-2021.pdf","https://www.enforcementtracker.com/ETid-855","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00244/2021","gdprhub",null,null,"cyngasa sl",null,null,null,null,null,null,null,null,null],["2021/ES/057","ETid-856","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-29","day",10000,null,"EUR","ACONCAGUA JUEGOS S.A.","Industry and Commerce","Art. 37","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.aepd.es/es/documento/ps-00231-2021.pdf","https://www.enforcementtracker.com/ETid-856",null,null,null,null,"aconcagua juegos sa",null,null,null,null,null,null,null,null,null],["2021/DK/003","ETid-857","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-09-29","day",107000,null,"EUR","Danish Cancer Society","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/sep/kraeftens-bekaempelse-indstillet-til-boede","https://www.enforcementtracker.com/ETid-857",null,null,null,null,"DK: danish cancer society",null,null,null,null,null,null,null,null,null],["2021/IT/024","ETid-931","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-29","day",2000,null,"EUR","Physician","Health Care","Art. 5(1)(a), Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9720448","https://www.enforcementtracker.com/ETid-931",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/AT/001","ETid-2769","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021-09-28","day",500000,null,"EUR","Address Broker","Industry and Commerce","Art. 12","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://360.lexisnexis.at/d/entscheidungen_ris/bvwg_w137_2248575_1/u_verwaltung_BVwG_2024_BVWGT_20240418_W_cfda6df51d?searchid=20250610155345637&page=1&index=1&origin=rl&rlclick=title&originview=Full","https://www.enforcementtracker.com/ETid-2769",null,null,null,null,"AT: address broker",null,null,null,null,null,null,null,null,null],["2021/ES/059","ETid-854","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-28","day",3000,null,"EUR","Bar owner","Accommodation and Hospitality","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00236-2021.pdf","https://www.enforcementtracker.com/ETid-854",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/AT/008","ETid-871","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021-09-28","day",9500000,null,"EUR","Austrian Post","Transportation and Energy","Art. 12(2)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://news.post.at/presse/de/post/id/1711838/DATENSCHUTZVERFAHREN%20DER%20ÖSTERREICHISCHEN%20POST,","https://www.enforcementtracker.com/ETid-871",null,null,null,null,"AT: austrian post",null,null,null,null,null,null,null,null,null],["2021/NO/009","ETid-851","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-09-27","day",496000,null,"EUR","Ferde AS","Public Sector and Education","Art. 28(3), Art. 32(2), Art. 44, Art. 5(1)(f), Art. 5(2)","Data principles, Data security, International transfers, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.no/contentassets/7121f4f2de614186bc535823c9da7102/20_01727-3vedtak-om-overtredelsesgebyr---ferde-as.pdf","https://www.enforcementtracker.com/ETid-851","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01727","gdprhub",null,null,"ferde as",null,null,null,null,null,null,null,null,null],["2021/IS/024","Persónuvernd (Iceland) - 2021061419","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-09-27","day",null,"None","EUR","Directorate of Labor of Iceland",null,"Art. 33, Art. 5, Art. 6","Data breach, Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-netfangs-med-fjoldaposti-ekki-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2021061419",null,"gdprhub",null,null,"IS: directorate of labor of iceland",null,null,null,null,null,null,null,null,null],["2021/FR/023","CNIL (France) - SAN-2021-016","gdprhub","France","FR","CNIL (France)","2021-09-24","day",null,"None","EUR","Ministry of the Interior",null,null,null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044115170?page=1&pageSize=10&query=2016%2F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-016",null,"gdprhub",null,null,"FR: ministry of the interior",null,null,null,null,null,null,null,null,null],["2021/DE/048","ETid-846","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2021-09-24","day",900000,null,"EUR","Vattenfall Europe Sales GmbH","Transportation and Energy","Art. 12, Art. 13","Transparency","Insufficient data processing agreement","Fine issued","https://www.heise.de/news/DSGVO-Vattenfall-muss-900-000-Euro-nach-Bonushopper-Auslese-zahlen-6200668.html","https://www.enforcementtracker.com/ETid-846",null,null,null,null,"vattenfall europe sales gmbh",null,null,null,null,null,null,null,null,null],["2021/ES/064","ETid-848","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-24","day",3000,null,"EUR",null,null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00227-2021.pdf","https://www.enforcementtracker.com/ETid-848",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/HU/015","NAIH (Hungary) - NAIH-1743/2021","gdprhub","Hungary","HU","NAIH (Hungary)","2021-09-23","day",null,"None","EUR",null,null,"Art. 5(1), Art. 58, Art. 6(1), Art. 9","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=468:hangfelvetel-jogellenes-hozzaferhetove-tetele-kiskoru-erintett-szemelyes-es-kulonleges-szemelyes-adatainak-jogellenes-kezelese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-1743/2021",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2021/DK/018","Datatilsynet (Denmark) - 2021-442-13805","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-09-22","day",null,"None","EUR","The Danish Customs and Tax Administration",null,"Art. 34(1)","Data breach",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/sep/alvorlig-kritik-af-skatteforvaltningen-i-sag-om-underretning","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-442-13805",null,"gdprhub",null,null,"DK: the danish customs and tax administration",null,null,null,null,null,null,null,null,null],["2021/DK/015","Datatilsynet (Denmark) - 2018-41-0013","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-09-21","day",null,"None","EUR","Dating.dk ApS",null,"Art. 32(1), Art. 4(11), Art. 6(1)(a), Art. 7(1), Art. 9(1), Art. 9(2)(a)","Consent, Data security, Special categories, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/sep/tilsyn-med-datingdk","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2018-41-0013",null,"gdprhub",null,null,"dating dk aps",null,null,null,null,null,null,null,null,null],["2021/DK/019","Datatilsynet (Denmark) - 2021-431-0142","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-09-21","day",null,"None","EUR","Falck Danmark A/S",null,"Art. 12(1), Art. 13(1), Art. 13(2)","Transparency",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/sep/tilsyn-med-iagttagelse-af-oplysningspligten-ved-hurtigtest-i-grundskolen-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2021-431-0142",null,"gdprhub",null,null,"falck danmark as",null,null,null,null,null,null,null,null,null],["2021/IT/001","ETid-1599","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-21","day",2000,null,"EUR","Istituto Comprensivo - IC Cosenza III “V. Negroni”","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9718196","https://www.enforcementtracker.com/ETid-1599",null,null,null,null,"IT: istituto comprensivo ic cosenza iii v negroni",null,null,null,null,null,null,null,null,null],["2021/NO/006","ETid-863","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-09-21","day",12500,null,"EUR","Ultra-Technology AS","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/53bc6882df7e426299e6d551428fc811/vedtak-om-overtredelsesgebyr--ultra-technology-as.pdf","https://www.enforcementtracker.com/ETid-863","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02375","gdprhub",null,null,"ultra technology as",null,null,null,null,null,null,null,null,null],["2021/GR/025","HDPA (Greece) - 41/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-09-21","day",null,"None","EUR",null,null,"Art. 13, Art. 5(1)(c), Art. 9(2)(h)","Data principles, Special categories, Transparency",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiplixi-kai-entoli-prosarmogis-sta-nomima-shetika-me-leitoyrgia","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_41/2021",null,"gdprhub",null,"Nursing home",null,null,null,null,null,null,null,null,null,null],["2021/GR/024","HDPA (Greece) - 42/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-09-21","day",null,"None","EUR",null,null,"Art. 32, Art. 5(1)(d), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/epiplixi-gia-tin-apokalypsi-ilektronikon-dieythynseon-se-alloys","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_42/2021",null,"gdprhub",null,"Member of parliament",null,null,null,null,null,"person",null,null,null,null],["2021/IS/023","Persónuvernd (Iceland) - 2020010633","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-09-21","day",null,"None","EUR",null,null,"Art. 5, Art. 6(1)(a), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-sveitarfelags-med-personuupplysingar-i-tengslum-vid-akvardanir-um-uppsogn-og-radningu-i-starf-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020010633",null,"gdprhub",null,"Employers",null,null,null,null,null,null,null,null,null,null],["2021/ES/066","ETid-844","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-20","day",18000,null,"EUR","CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L.","Health Care","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00262-2021.pdf","https://www.enforcementtracker.com/ETid-844",null,null,null,null,"cedico centro de diagnostico por la imagen sl",null,null,null,null,null,null,null,null,null],["2021/NO/008","ETid-858","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-09-20","day",40200,null,"EUR","Høylandet Municipality","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/d01675e54b9447298952002ff1c208fb/vedtak-om-overtredelsesgebyr---hoylandet-kommune.pdf","https://www.enforcementtracker.com/ETid-858","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01879","gdprhub",null,null,"NO: hylandet municipality",null,null,null,null,null,null,null,null,null],["2021/NO/007","ETid-859","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-09-20","day",75600,null,"EUR","ST. OLAVS HOSPITAL HF","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/447e5ad0c7f346fc9cc1c0d62d023bba/vedtak-om-overtredelsesgebyr--st.-olavs-hospital-hf.pdf","https://www.enforcementtracker.com/ETid-859","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01813","gdprhub",null,null,"st olavs hospital hf",null,null,null,null,null,null,null,null,null],["2021/GB/030","ICO (UK) - Your Home Improvements Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2021-09-20","day",null,"20000","GBP","Your Home Improvements Ltd",null,null,null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/your-home-improvements-ltd-mpn/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Your_Home_Improvements_Ltd",null,"gdprhub",null,null,"your home improvements ltd",null,20000.0,23336,"day 2021-09-20|0.8570|GBP",null,null,null,null,null],["2021/FI/013","Tietosuojavaltuutetun toimisto (Finland) - 3394/171/21","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-09-20","day",null,"None","EUR",null,null,null,null,null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211023","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3394/171/21",null,"gdprhub",null,"Finnish police",null,null,null,null,null,null,null,null,null,null],["2021/CY/001","ETid-1146","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-09-17","day",10000,null,"EUR","Mediterranean Hospital of Cyprus","Health Care","Art. 31, Art. 58(1)(a)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/0F2FBFF02DD16959C2258833003EF69E/$file/ΑΠΟΦΑΣΗ%20(Αν)%20Mediterranean%20Hospital.pdf?openelement","https://www.enforcementtracker.com/ETid-1146",null,null,null,null,"CY: mediterranean hospital of cyprus",null,null,null,null,null,null,null,null,null],["2021/DK/004","ETid-839","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-09-17","day",67200,null,"EUR","Syddanmark Region","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/sep/region-syddanmark-indstillet-til-boede","https://www.enforcementtracker.com/ETid-839",null,null,null,null,"DK: syddanmark region",null,null,null,null,null,null,null,null,null],["2021/IT/003","ETid-1353","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-16","day",1000,null,"EUR","Farpa s.r.l.","Health Care","Art. 13, Art. 5(1)(a), Art. 88","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9718901","https://www.enforcementtracker.com/ETid-1353",null,null,null,null,"farpa srl",null,null,null,null,null,null,null,null,null],["2021/DK/005","ETid-836","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-09-16","day",10000,null,"EUR","Favrskov municipality","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/sep/favrskov-kommune-indstilles-til-boede-","https://www.enforcementtracker.com/ETid-836",null,null,null,null,"DK: favrskov municipality",null,null,null,null,null,null,null,null,null],["2021/ES/067","ETid-838","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-16","day",4000,null,"EUR","Frigorifica Botana S.L.","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00093-2021.pdf","https://www.enforcementtracker.com/ETid-838",null,null,null,null,"frigorifica botana sl",null,null,null,null,null,null,null,null,null],["2021/IT/031","ETid-869","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-16","day",5000,null,"EUR","La Prima S.r.l.","Real Estate","Art. 24, Art. 25, Art. 5, Art. 6","Accountability, Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9705632","https://www.enforcementtracker.com/ETid-869",null,null,null,null,"la prima srl",null,null,null,null,null,null,null,null,null],["2021/IT/030","ETid-874","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-16","day",5000,null,"EUR","Ciechi Ardizzone Gioeni di Catania","Individuals and Private Associations","Art. 12(1), Art. 13, Art. 35","DPIA, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9705650","https://www.enforcementtracker.com/ETid-874",null,null,null,null,"IT: ciechi ardizzone gioeni di catania",null,null,null,null,null,null,null,null,null],["2021/IT/029","ETid-876","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-16","day",200000,null,"EUR","Bocconi University","Public Sector and Education","Art. 13, Art. 25, Art. 35, Art. 44, Art. 46, Art. 6, Art. 9","Accountability, DPIA, Data principles, International transfers, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9703988","https://www.enforcementtracker.com/ETid-876","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9703988","gdprhub",null,null,"IT: bocconi university",null,null,null,null,null,null,null,null,null],["2021/IT/028","ETid-877","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-16","day",3296326,null,"EUR","Sky Italia S.r.l.","Media, Telecoms and Broadcasting","Art. 12(2), Art. 14, Art. 21, Art. 28, Art. 29, Art. 6(1), Art. 7","Consent, Data subject rights, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9706389,","https://www.enforcementtracker.com/ETid-877","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9706389","gdprhub",null,null,"sky italia srl",null,null,null,null,null,null,null,null,null],["2021/IT/027","ETid-892","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-09-16","day",5000,null,"EUR","Comune di Montalbano Jonico","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9704069","https://www.enforcementtracker.com/ETid-892",null,null,null,null,"IT: comune di montalbano jonico",null,null,null,null,null,null,null,null,null],["2021/FR/007","ETid-837","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-09-15","day",3000,null,"EUR","Société nouvelle de l’annuaire français","Individuals and Private Associations","Art. 16, Art. 17, Art. 30, Art. 31","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000044043045,","https://www.enforcementtracker.com/ETid-837","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-014","gdprhub",null,null,"FR: societe nouvelle de lannuaire francais",null,null,null,null,null,null,null,null,null],["2021/BE/031","APD/GBA (Belgium) - 103/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-09-14","day",null,"None","EUR",null,null,null,null,null,"Other Outcome","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-103-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_103/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/065","ETid-845","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-14","day",40000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00193-2021.pdf","https://www.enforcementtracker.com/ETid-845","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00193/2021","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/063","ETid-849","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-14","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00189-2021.pdf","https://www.enforcementtracker.com/ETid-849","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00189/2021","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/062","ETid-850","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-14","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00190-2021.pdf","https://www.enforcementtracker.com/ETid-850",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/061","ETid-852","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-14","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00191-2021.pdf","https://www.enforcementtracker.com/ETid-852",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/060","ETid-853","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-14","day",56000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00192-2021.pdf","https://www.enforcementtracker.com/ETid-853",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/IS/022","Persónuvernd (Iceland) - Nr. 2020123144","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-09-14","day",null,"None","EUR","Creditinfo (IS)",null,"Art. 14, Art. 17","Data subject rights, Transparency",null,"Rejected","https://www.personuvernd.is/urlausnir/skraning-creditinfo-lanstraust-hf.-a-vanskilaskra-i-samraemi-vid-log","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_Nr._2020123144",null,"gdprhub",null,null,"IS: creditinfo",null,null,null,null,null,null,null,null,null],["2021/ES/229","APDCAT (Catalonia) - PS 28/2021","gdprhub","Spain","ES","APDCAT (Catalonia)","2021-09-13","day",null,"None","EUR","Ajuntament de Tiana",null,"Art. 13, Art. 25(1), Art. 5(1)(f)","Accountability, Data principles, Transparency",null,"Violation found","https://apdcat.gencat.cat/web/.content/Resolucio/Resolucions_Cercador/Resolucions/Documents/ca_ps_2021_028.pdf","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_PS_28/2021",null,"gdprhub",null,null,"ES: ajuntament de tiana",null,null,null,null,null,null,null,null,null],["2021/ES/070","ETid-833","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-13","day",1000,null,"EUR","GESTIONES AUTO LOW COST S. L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00302-2021.pdf","https://www.enforcementtracker.com/ETid-833",null,null,null,null,"gestiones auto low cost sl",null,null,null,null,null,null,null,null,null],["2021/ES/069","ETid-834","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-13","day",1000,null,"EUR","Hairdressing salon","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00226-2021.pdf","https://www.enforcementtracker.com/ETid-834",null,null,null,null,"ES: hairdressing salon",null,null,null,null,null,null,null,null,null],["2021/ES/068","ETid-835","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-13","day",9000,null,"EUR","Website operator",null,"Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00156-2021.pdf","https://www.enforcementtracker.com/ETid-835",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/GB/018","ICO (UK) - Saga Personal Finance Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-09-13","day",null,"75,000","GBP","Saga Personal Finance Limited",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/saga-personal-finance-ltd-mpn/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Saga_Personal_Finance_Limited",null,"gdprhub",null,null,"saga personal finance ltd",null,75000.0,88111,"day 2021-09-13|0.8512|GBP",null,null,null,null,null],["2021/GB/017","ICO (UK) - Saga Services Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-09-13","day",null,"150,000","GBP","Saga Services Limited",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/saga-services-limited-en/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Saga_Services_Limited",null,"gdprhub",null,null,"saga services ltd",null,150000.0,176222,"day 2021-09-13|0.8512|GBP",null,null,null,null,null],["2021/GB/029","ICO (UK) - SportsDirect.com Retail Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-09-13","day",null,"70,000","GBP","SportsDirect.com Retail Limited",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4018347/sportsdirect_com-retail-limited-mpn-20210913.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_SportsDirect.com_Retail_Limited",null,"gdprhub",null,null,"sportsdirect com retail ltd",null,70000.0,82237,"day 2021-09-13|0.8512|GBP",null,null,null,null,null],["2021/GB/028","ICO (UK) - We Buy Any Car Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-09-13","day",null,"200,000","GBP","We Buy Any Car Limited",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/4018348/we-buy-any-car-limited-mpn-20210913.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_We_Buy_Any_Car_Limited",null,"gdprhub",null,null,"we buy any car ltd",null,200000.0,234962,"day 2021-09-13|0.8512|GBP",null,null,null,null,null],["2021/HU/014","NAIH (Hungary) - NAIH-4177-………./2021","gdprhub","Hungary","HU","NAIH (Hungary)","2021-09-13","day",null,"None","EUR",null,null,"Art. 13(1), Art. 13(2), Art. 2(2)(c), Art. 58(2), Art. 6(1)","Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=456:tarsashazi-adatkezeles-ugyeben-hozott-hatarozat","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-4177-%E2%80%A6%E2%80%A6%E2%80%A6./2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/AT/017","DSB (Austria) - 2021-0.474.768","gdprhub","Austria","AT","DSB (Austria)","2021-09-08","day",null,null,null,"Federal Ministry of the Interior, formerly also: Austrian Federal Office for the Protection of the Constitution and Counterterrorism (BVT; controller)",null,"Art. 5(1)(a), Art. 5(1)(c), Art. 51(1), Art. 57(1)(f), Art. 77(1)","Data principles",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210908_2021_0_474_768_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.474.768",null,"gdprhub",null,null,"AT: federal ministry of the interior formerly also austrian federal office for the protection of the constitution and counterterrorism",null,null,null,null,null,null,null,null,null],["2021/DK/006","ETid-824","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-09-08","day",53800,null,"EUR","Midtjylland Region","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/sep/region-midtjylland-indstillet-til-boede","https://www.enforcementtracker.com/ETid-824",null,null,null,null,"DK: midtjylland region",null,null,null,null,null,null,null,null,null],["2021/IE/005","ETid-825","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2021-09-07","day",1400,null,"EUR","Vodafone Ireland Limited","Media, Telecoms and Broadcasting","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://dataprotection.ie/en/news-media/data-protection-commission-welcomes-outcome-prosecution-proceedings-taken-against-three-ireland","https://www.enforcementtracker.com/ETid-825",null,null,null,null,"vodafone ireland ltd","Vodafone",null,null,null,null,null,null,null,null],["2021/GR/023","HDPA (Greece) - 40/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-09-07","day",10000,"10000","EUR","Organization of Urban Transport of Thessaloniki (OASTH)",null,"Art. 15, Art. 21","Data subject rights",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/dimosiopoiisi-onomaton-proin-metohon-toy-oasth-kai-mi-antapokrisi-toy-se","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_40/2021",null,"gdprhub",null,null,"GR: organization of urban transport of thessaloniki",null,null,null,null,null,null,null,null,null],["2021/IS/021","Persónuvernd (Iceland) - 2020031242","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-09-07","day",null,"None","EUR",null,null,"Art. 12, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.personuvernd.is/urlausnir/afgreidsla-sveitarfelags-og-skola-a-adgangsbeidni","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020031242",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2021/DK/014","Datatilsynet (Denmark) - 2020-31-3586","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-09-06","day",null,"None","EUR",null,null,"Art. 15","Data subject rights",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/sep/afgoerelse-vedroerende-forsikringsselskabets-behandling-af-personoplysninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-31-3586",null,"gdprhub",null,"Insurance company",null,null,null,null,null,null,null,null,null,null],["2021/CY/005","ETid-830","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-09-06","day",40000,null,"EUR","APOEL FC","Individuals and Private Associations","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/57759977195D3477C225874800434764?OpenDocument,","https://www.enforcementtracker.com/ETid-830",null,null,null,null,"CY: apoel fc",null,null,null,null,null,null,null,null,null],["2021/CY/004","ETid-831","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-09-06","day",40000,null,"EUR","AC Omonia","Individuals and Private Associations","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/57759977195D3477C225874800434764?OpenDocument,","https://www.enforcementtracker.com/ETid-831",null,null,null,null,"CY: ac omonia",null,null,null,null,null,null,null,null,null],["2021/CY/003","ETid-832","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-09-06","day",25000,null,"EUR","Hellenic Technical Enterprises Ltd.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/57759977195D3477C225874800434764?OpenDocument,","https://www.enforcementtracker.com/ETid-832",null,null,null,null,"hellenic technical enterprises ltd",null,null,null,null,null,null,null,null,null],["2021/ES/056","ETid-860","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-04","day",1500,null,"EUR","AMPUDIA DIAZ, S.L.","Accommodation and Hospitality","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00471-2020.pdf","https://www.enforcementtracker.com/ETid-860",null,null,null,null,"ampudia diaz sl",null,null,null,null,null,null,null,null,null],["2021/GR/008","ETid-842","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-09-03","day",8000,null,"EUR","Rhodes Municipal Transport Company","Employment","Art. 12(3), Art. 15, Art. 5(1)(c)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-09/39_2021anonym.pdf","https://www.enforcementtracker.com/ETid-842","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_39/2021","gdprhub",null,null,"GR: rhodes municipal transport company",null,null,null,null,null,null,null,null,null],["2021/IE/006","ETid-820","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2021-09-02","day",225000000,null,"EUR","WhatsApp Ireland Ltd.","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 14, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://edpb.europa.eu/system/files/2021-09/dpc_final_decision_redacted_for_issue_to_edpb_01-09-21_en.pdf","https://www.enforcementtracker.com/ETid-820","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_WhatsApp_Ireland_Limited_-_IN-18-12-2","gdprhub",null,null,"whatsapp ireland ltd","Meta",null,null,null,null,null,null,null,null],["2021/ES/071","ETid-823","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-09-02","day",4000,null,"EUR","Automecanica Jerez, S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00259-2021.pdf","https://www.enforcementtracker.com/ETid-823",null,null,null,null,"automecanica jerez sl",null,null,null,null,null,null,null,null,null],["2021/ES/227","AEPD (Spain) - TD/00183/2021","gdprhub","Spain","ES","AEPD (Spain)","2021-09-01","day",null,"None","EUR","EMPRESA MUNICIPAL TRANSPORTES URBANOS, S.A. DE GIJÓN",null,"Art. 15","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/td-00183-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00183/2021",null,"gdprhub",null,null,"empresa municipal transportes urbanos sa de gijon",null,null,null,null,null,null,null,null,null],["2021/ES/073","ETid-821","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-30","day",6000,null,"EUR","Furnishyourspace S.L.","Industry and Commerce","Art. 12, Art. 13, Art. 21(4), Art. 5(1)(a), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00462-2019.pdf","https://www.enforcementtracker.com/ETid-821",null,null,null,null,"furnishyourspace sl",null,null,null,null,null,null,null,null,null],["2021/NO/057","Datatilsynet (Norway) - 20/03293","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-08-26","day",null,"None","EUR","Directorate of Norwegian Correctional Service",null,"Art. 30",null,null,"Violation found","https://www.datatilsynet.no/contentassets/b8f80f9ade934d2b9ec2d51cc165e0b3/vedtak-om-palegg---brevkontroll-med-kriminalomsorgens-behandling-av-personopplysninger.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/03293",null,"gdprhub",null,null,"NO: directorate of norwegian correctional service",null,null,null,null,null,null,null,null,null],["2021/ES/075","ETid-818","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-26","day",1000,null,"EUR","Owners Association","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00345-2020.pdf","https://www.enforcementtracker.com/ETid-818",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/GR/010","ETid-840","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-08-26","day",20000,null,"EUR","Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ","Industry and Commerce","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-09/36_2021anonym.pdf","https://www.enforcementtracker.com/ETid-840",null,null,null,null,"GR: dixons south east europe",null,null,null,null,null,null,null,null,null],["2021/GR/009","ETid-841","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-08-26","day",20000,null,"EUR","National Bank of Greece","Finance, Insurance and Consulting","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-09/36_2021anonym.pdf","https://www.enforcementtracker.com/ETid-841",null,null,null,null,"national bank of greece sa",null,null,null,null,null,null,null,null,null],["2021/GR/007","ETid-843","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-08-26","day",5000,null,"EUR","NOW DOCTOR – Εταιρία Παροχής Ηλεκτρονικών Υπηρεσιών Αναζήτησης και Προβολής Ιατρών Ε.Π.Ε.","Health Care","Art. 17, Art. 5(2), Art. 6(1)","Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2021-09/37_2021anonym.pdf","https://www.enforcementtracker.com/ETid-843",null,null,null,null,"GR: now doctor",null,null,null,null,null,null,null,null,null],["2021/GR/021","HDPA (Greece) - 36/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-08-26","day",40000,"40.000","EUR",null,null,"Art. 12(2), Art. 15, Art. 5(2), Art. 83","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2021-09/36_2021anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_36/2021",null,"gdprhub","KOTSOVOLOS S.A; National Bank of Greece S.A.",null,null,null,null,null,null,null,null,null,null,null],["2021/ES/196","AEPD (Spain) - PS/00161/2021","gdprhub","Spain","ES","AEPD (Spain)","2021-08-25","day",15000,"15,000","EUR","AD735 Data Media Advertising S.L.",null,"Art. 17(1)","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00161-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00161/2021",null,"gdprhub",null,null,"ad735 data media advertising sl",null,null,null,null,null,null,null,null,null],["2021/ES/074","ETid-819","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-25","day",120000,null,"EUR","Banco Bilbao Vizcaya Argentaria, S.A.","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00362-2021.pdf","https://www.enforcementtracker.com/ETid-819","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00362/2021","gdprhub",null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2021/RO/008","ETid-816","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-08-24","day",3000,null,"EUR","Actamedica SRL","Health Care","Art. 28(1), Art. 32, Art. 33","Data breach, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_24_08_2021&lang=ro","https://www.enforcementtracker.com/ETid-816","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Actamedica_SRL","gdprhub",null,null,"actamedica srl",null,null,null,null,null,null,null,null,null],["2021/GB/016","ICO (UK) - DialADeal Scotland Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2021-08-24","day",null,"150,000","GBP","DialADeal Scotland Ltd",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/dialadeal-scotland-ltd-mpn/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_DialADeal_Scotland_Ltd",null,"gdprhub",null,null,"dialadeal scotland ltd",null,150000.0,175279,"day 2021-08-24|0.8558|GBP",null,null,null,null,null],["2021/SK/004","UOOU (Slovakia) - Opinion of 24 August 2021 - FATCA","gdprhub","Slovakia","SK","UOOU (Slovakia)","2021-08-24","day",null,null,null,null,null,"Art. 45, Art. 46","International transfers",null,null,"https://vu.fr/BXzy","https://gdprhub.eu/index.php?title=UOOU_%28Slovakia%29_-_Opinion_of_24_August_2021_-_FATCA",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/076","ETid-815","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-23","day",2000,null,"EUR","Company owner","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00237-2021.pdf","https://www.enforcementtracker.com/ETid-815",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/072","ETid-822","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-23","day",1800,null,"EUR","Agency",null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00164-2021.pdf","https://www.enforcementtracker.com/ETid-822",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/217","AEPD (Spain) - PS/00263/2021","gdprhub","Spain","ES","AEPD (Spain)","2021-08-20","day",3000,"3,000","EUR","NATURAL LOGISTICS, S.L.",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00263-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00263/2021",null,"gdprhub",null,null,"natural logistics sl",null,null,null,null,null,null,null,null,null],["2021/IE/003","ETid-893","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2021-08-20","day",1500,null,"EUR","MOVE Ireland","Individuals and Private Associations","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2021-11/IN-20-7-1%20Move%20Irl%20Final%20Decision.pdf,","https://www.enforcementtracker.com/ETid-893","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-20-7-1","gdprhub",null,null,"IE: move ireland",null,null,null,null,null,null,null,null,null],["2021/ES/218","AEPD (Spain) - PS/00273/2021","gdprhub","Spain","ES","AEPD (Spain)","2021-08-17","day",20000,"20,000","EUR","OASIP SERVICIO INTEGRAL DE COMUNICACIONES S.L.",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00273-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00273/2021",null,"gdprhub",null,null,"oasip servicio integral de comunicaciones sl",null,null,null,null,null,null,null,null,null],["2021/NO/056","Datatilsynet (Norway) - 20/02059","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-08-17","day",null,"None","EUR","Google",null,"Art. 10, Art. 17(1)(c), Art. 21(1), Art. 5(1)(d), Art. 6(1)(f)","Data principles, Data subject rights, Special categories, Unlawful processing",null,"Violation found",null,"https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02059",null,"gdprhub",null,null,"NO: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2021/DK/001","ETid-1420","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-08-17","day",20100,null,"EUR","Danish Immigration Agency","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/aug/udlaendingestyrelsen-indstilles-til-boede","https://www.enforcementtracker.com/ETid-1420",null,null,null,null,"DK: danish immigration agency",null,null,null,null,null,null,null,null,null],["2021/AT/015","DSB (Austria) - 2021-0.432.224","gdprhub","Austria","AT","DSB (Austria)","2021-08-16","day",null,"None","EUR",null,null,"Art. 4(11), Art. 6(1)(a), Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20210816_2021_0_432_224_00/DSBT_20210816_2021_0_432_224_00.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.432.224",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/GB/015","ICO (UK) - Parkin Beacher Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2021-08-16","day",null,"50,000","GBP","Parkin Beacher Ltd",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/parkin-beacher-ltd-en/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Parkin_Beacher_Ltd",null,"gdprhub",null,null,"parkin beacher ltd",null,50000.0,58912,"day 2021-08-16|0.8487|GBP",null,null,null,null,null],["2021/ES/077","ETid-814","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-13","day",1000,null,"EUR","Employer","Employment","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00506-2020.pdf","https://www.enforcementtracker.com/ETid-814",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/PL/004","ETid-817","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-08-13","day",2200,null,"EUR","President of the Zgierz District Court","Public Sector and Education","Art. 25(1), Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.22.2021","https://www.enforcementtracker.com/ETid-817","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.22.2021",null,null,null,"PL: president of the zgierz district court",null,null,null,null,null,null,null,null,null],["2021/NO/010","ETid-809","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-08-12","day",9600,null,"EUR","Waxing Palace AS","Industry and Commerce","Art. 13, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/gebyr-til-waxing-palace-as/","https://www.enforcementtracker.com/ETid-809","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01648","gdprhub",null,null,"waxing palace as",null,null,null,null,null,null,null,null,null],["2021/HU/013","NAIH (Hungary) - NAIH-4447-6/2021","gdprhub","Hungary","HU","NAIH (Hungary)","2021-08-12","day",null,"None","EUR",null,null,"Art. 12, Art. 17(1)(d), Art. 5(1)(c), Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=424:online-kozmeghallgatas-soran-kezelt-szemelyes-adatok-nyilvanossaga","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-4447-6/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/079","ETid-810","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-10","day",2000,null,"EUR","DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00213-2021.pdf","https://www.enforcementtracker.com/ETid-810",null,null,null,null,"ES: despacho tejedor infantes consultores asesores",null,null,null,null,null,null,null,null,null],["2021/ES/082","ETid-804","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-09","day",1000,null,"EUR","BAZTANDIS, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00264-2021.pdf","https://www.enforcementtracker.com/ETid-804",null,null,null,null,"baztandis sl",null,null,null,null,null,null,null,null,null],["2021/ES/081","ETid-805","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-09","day",5000,null,"EUR","CLUB GIMNASIA RÍTMICA SAN ANTONIO","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00209-2021.pdf","https://www.enforcementtracker.com/ETid-805","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00209/2021","gdprhub",null,null,"ES: club gimnasia ritmica san antonio",null,null,null,null,null,null,null,null,null],["2021/AT/020","DSB (Austria) - DPA 2021-0.415.529","gdprhub","Austria","AT","DSB (Austria)","2021-08-06","day",null,null,null,null,null,"Art. 14, Art. 17, Art. 5, Art. 6(1)(f)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210806_2021_0_415_529_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DPA_2021-0.415.529",null,"gdprhub",null,"Recruiter",null,null,null,null,null,null,null,null,null,null],["2021/FI/012","Tietosuojavaltuutetun toimisto (Finland) - 2368/182/20","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-08-06","day",null,"None","EUR",null,null,"Art. 25, Art. 5(1)(c), Art. 58(2), Art. 6, Art. 9","Accountability, Data principles, Special categories, Unlawful processing",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211004","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_2368/182/20",null,"gdprhub",null,"Housing company",null,null,null,null,null,null,null,null,null,null],["2021/ES/089","ETid-797","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-05","day",3000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00424-2020.pdf","https://www.enforcementtracker.com/ETid-797",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/080","ETid-806","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-05","day",6000,null,"EUR","Future Vinline S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00251-2021.pdf","https://www.enforcementtracker.com/ETid-806",null,null,null,null,"future vinline sl",null,null,null,null,null,null,null,null,null],["2021/LU/008","ETid-866","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-08-05","day",135000,null,"EUR","Insurance company","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-31FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-866",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/AT/004","ETid-961","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021-08-05","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20210805_2021_0_518_795_00/DSBT_20210805_2021_0_518_795_00.html","https://www.enforcementtracker.com/ETid-961","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.518.795","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/078","ETid-811","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-03","day",96000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 17, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00188-2021.pdf","https://www.enforcementtracker.com/ETid-811","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00188/2021","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/094","ETid-789","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-08-02","day",3000,null,"EUR","Club Náutico el Estacio","Individuals and Private Associations","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00044-2021.pdf","https://www.enforcementtracker.com/ETid-789",null,null,null,null,"ES: club nautico el estacio",null,null,null,null,null,null,null,null,null],["2021/AT/009","ETid-792","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021-08-02","day",500000,null,"EUR","Unser Ö-Bonus Club GmbH","Industry and Commerce","Art. 6, Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.heise.de/news/Rewe-wird-fuer-Kunden-Profiling-in-Oesterreich-bestraft-6153577.html","https://www.enforcementtracker.com/ETid-792",null,null,null,null,"unser o bonus club gmbh",null,null,null,null,null,null,null,null,null],["2021/RO/009","ETid-787","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-07-30","day",200,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_30_07_2021&lang=ro","https://www.enforcementtracker.com/ETid-787","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_a_natural_person","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/085","ETid-801","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-30","day",600,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00097-2021.pdf","https://www.enforcementtracker.com/ETid-801",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/084","ETid-802","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-30","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00200-2021.pdf","https://www.enforcementtracker.com/ETid-802","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00200/2021","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/083","ETid-803","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-30","day",4000,null,"EUR","Gas inspector","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00206-2021.pdf","https://www.enforcementtracker.com/ETid-803",null,null,null,null,"ES: gas inspector",null,null,null,null,null,null,null,null,null],["2021/BE/027","APD/GBA (Belgium) - 85/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-07-29","day",null,"None","EUR",null,null,"Art. 5(1)(b)","Data principles",null,"Other Outcome","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-85-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_85/2021",null,"gdprhub",null,"Political campaign",null,null,null,null,null,null,null,null,null,null],["2021/ES/102","ETid-779","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-29","day",3000,null,"EUR","UNIVERSIDAD A DISTANCIA DE MADRID, S.A.","Public Sector and Education","Art. 17(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00310-2021.pdf","https://www.enforcementtracker.com/ETid-779",null,null,null,null,"universidad a distancia de madrid sa",null,null,null,null,null,null,null,null,null],["2021/EU/003","EDPB - Binding Decision 1/2021 - 'WhatsApp'","gdprhub","European Union","EU","EDPB","2021-07-28","day",null,"None","EUR","WhatsApp Ireland Ltd.",null,"Art. 12, Art. 13, Art. 14, Art. 4(24), Art. 5(1)(a), Art. 65(1)(a), Art. 83","Data principles, Transparency",null,null,"https://edpb.europa.eu/system/files/2021-09/edpb_bindingdecision_202101_ie_sa_whatsapp_redacted_en.pdf","https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_1/2021_-_%27WhatsApp%27",null,null,null,null,"whatsapp ireland ltd","Meta",null,null,null,null,null,null,null,null],["2021/ES/101","ETid-780","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",500,null,"EUR","Website operator","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00015-2021.pdf","https://www.enforcementtracker.com/ETid-780",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/100","ETid-781","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",1000,null,"EUR","NEXTSTEPAGENCY, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00157-2021.pdf","https://www.enforcementtracker.com/ETid-781",null,null,null,null,"nextstepagency sl",null,null,null,null,null,null,null,null,null],["2021/ES/099","ETid-782","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",10000,null,"EUR","PERSONAL MARK, S.L.","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00488-2020.pdf","https://www.enforcementtracker.com/ETid-782",null,null,null,null,"personal mark sl",null,null,null,null,null,null,null,null,null],["2021/ES/098","ETid-783","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",2400,null,"EUR","PODEMOS PARTIDO POLÍTICO","Public Sector and Education","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00277-2021.pdf","https://www.enforcementtracker.com/ETid-783",null,null,null,null,"ES: podemos partido politico",null,null,null,null,null,null,null,null,null],["2021/ES/097","ETid-784","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",900,null,"EUR","Owners Association","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00396-2020.pdf","https://www.enforcementtracker.com/ETid-784",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/096","ETid-785","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",2000,null,"EUR","Owners Association","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00394-2020.pdf","https://www.enforcementtracker.com/ETid-785",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/095","ETid-788","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",60000,null,"EUR","PRA Iberia S.L.","Finance, Insurance and Consulting","Art. 15, Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00467-2020.pdf","https://www.enforcementtracker.com/ETid-788","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00467/2020","gdprhub",null,null,"pra iberia sl",null,null,null,null,null,null,null,null,null],["2021/ES/093","ETid-793","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",2000,null,"EUR","Body Tonic Shop S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00147-2021.pdf","https://www.enforcementtracker.com/ETid-793",null,null,null,null,"body tonic shop sl",null,null,null,null,null,null,null,null,null],["2021/ES/092","ETid-794","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",2000,null,"EUR","Gerco Fit S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00148-2021.pdf","https://www.enforcementtracker.com/ETid-794",null,null,null,null,"gerco fit sl",null,null,null,null,null,null,null,null,null],["2021/ES/091","ETid-795","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",2000,null,"EUR","Vasco Andaluza de Inversiones S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00146-2021.pdf","https://www.enforcementtracker.com/ETid-795",null,null,null,null,"vasco andaluza de inversiones sl",null,null,null,null,null,null,null,null,null],["2021/ES/090","ETid-796","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",1000,null,"EUR","APARTAMENTOS PLAYA DE COVACHOS, S.L.","Accommodation and Hospitality","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00476-2020.pdf","https://www.enforcementtracker.com/ETid-796",null,null,null,null,"apartamentos playa de covachos sl",null,null,null,null,null,null,null,null,null],["2021/ES/088","ETid-798","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",3000,null,"EUR","UST GLOBAL ESPAÑA, S.A.","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00360-2020.pdf","https://www.enforcementtracker.com/ETid-798",null,null,null,null,"ust global espana sa",null,null,null,null,null,null,null,null,null],["2021/ES/087","ETid-799","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",3000,null,"EUR","INSTAPACK, S.L.","Industry and Commerce","Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00106-2021.pdf","https://www.enforcementtracker.com/ETid-799",null,null,null,null,"instapack sl",null,null,null,null,null,null,null,null,null],["2021/ES/086","ETid-800","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-27","day",4000,null,"EUR",null,"Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00228-2020.pdf","https://www.enforcementtracker.com/ETid-800",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/105","ETid-774","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-26","day",2000,null,"EUR","Intersumi S.C.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00197-2021.pdf","https://www.enforcementtracker.com/ETid-774",null,null,null,null,"intersumi sc",null,null,null,null,null,null,null,null,null],["2021/ES/104","ETid-775","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-26","day",2000,null,"EUR","Fincas Miguel García S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00202-2021.pdf","https://www.enforcementtracker.com/ETid-775",null,null,null,null,"fincas miguel garcia sl",null,null,null,null,null,null,null,null,null],["2021/FR/008","ETid-776","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-07-26","day",400000,null,"EUR","Monsanto Company","Industry and Commerce","Art. 14, Art. 28","Processor obligations, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000043860997","https://www.enforcementtracker.com/ETid-776","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-012","gdprhub",null,null,"FR: monsanto company",null,null,null,null,null,null,null,null,null],["2021/ES/103","ETid-777","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-26","day",2520000,null,"EUR","Mercadona S.A.","Industry and Commerce","Art. 12, Art. 13, Art. 25(1), Art. 35, Art. 5(1)(c), Art. 6, Art. 9","Accountability, DPIA, Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00120-2021.pdf","https://www.enforcementtracker.com/ETid-777",null,null,null,null,"mercadona sa",null,null,null,null,null,null,null,null,null],["2021/IT/038","ETid-790","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-07-22","day",2500000,null,"EUR","Deliveroo Italy s.r.l.","Industry and Commerce","Art. 13, Art. 22(3), Art. 25, Art. 32, Art. 35, Art. 37(7)","Accountability, DPIA, Data principles, Data protection officer, Data security, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9685994","https://www.enforcementtracker.com/ETid-790",null,null,null,null,"deliveroo italy srl",null,null,null,null,null,null,null,null,null],["2021/IT/035","ETid-826","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-07-22","day",200000,null,"EUR","Regione Lombardia","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9697724,","https://www.enforcementtracker.com/ETid-826","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9697724","gdprhub",null,null,"IT: regione lombardia",null,null,null,null,null,null,null,null,null],["2021/IT/034","ETid-827","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-07-22","day",800000,null,"EUR","Roma Capitale","Public Sector and Education","Art. 12, Art. 13, Art. 25, Art. 28, Art. 32, Art. 5","Accountability, Data principles, Data security, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9698724","https://www.enforcementtracker.com/ETid-827","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9698724","gdprhub",null,null,"IT: roma capitale",null,null,null,null,null,null,null,null,null],["2021/IT/033","ETid-828","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-07-22","day",30000,null,"EUR","Flowbird Italia s.r.l.","Industry and Commerce","Art. 30, Art. 5, Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9698558,","https://www.enforcementtracker.com/ETid-828",null,null,null,null,"flowbird italia srl",null,null,null,null,null,null,null,null,null],["2021/IT/032","ETid-829","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-07-22","day",400000,null,"EUR","Atac s.p.a.","Industry and Commerce","Art. 30, Art. 32, Art. 5, Art. 6","Data principles, Data security, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9698597,","https://www.enforcementtracker.com/ETid-829",null,null,null,null,"atac spa",null,null,null,null,null,null,null,null,null],["2021/FR/009","ETid-771","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-07-20","day",1750000,null,"EUR","SGAM AG2R LA MONDIALE","Finance, Insurance and Consulting","Art. 13, Art. 14, Art. 5(1)(e)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000043829617?isSuggest=true","https://www.enforcementtracker.com/ETid-771","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-010","gdprhub",null,null,"FR: sgam ag2r la mondiale",null,null,null,null,null,null,null,null,null],["2021/BE/026","APD/GBA (Belgium) - 80/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-07-19","day",null,"None","EUR",null,null,"Art. 17(1)(c), Art. 19, Art. 21(2), Art. 24(3)","Accountability, Data subject rights",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-80-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_80/2021",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2021/DK/007","ETid-759","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-07-16","day",67900,null,"EUR","Region of Syddanmark","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/jul/region-syddanmark-indstilles-til-boede","https://www.enforcementtracker.com/ETid-759",null,null,null,null,"DK: region of syddanmark",null,null,null,null,null,null,null,null,null],["2021/LU/009","ETid-778","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-07-16","day",null,null,"EUR","Amazon Europe Core S.à.r.l.","Industry and Commerce",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.sec.gov/ix?doc=/Archives/edgar/data/0001018724/000101872421000020/amzn-20210630.htm#i5986f88ea1e04d5c91ff09fed8d716f0_103","https://www.enforcementtracker.com/ETid-778",null,null,null,null,"amazon europe core sarl","Amazon",null,null,null,null,null,null,null,null],["2021/EU/002","EDPB - Urgent Binding Decision 1/2021 - 'WhatsApp'","gdprhub","European Union","EU","EDPB","2021-07-12","day",null,"None","EUR","WhatsApp Ireland Ltd",null,"Art. 12(1), Art. 13(1)(c), Art. 13(1)(e), Art. 5(1)(a), Art. 6(1)(a), Art. 6(1)(f), Art. 61(5), Art. 61(8), Art. 61(9), Art. 62, Art. 66(1), Art. 66(2), Art. 7","Consent, Data principles, Transparency, Unlawful processing",null,null,"https://edpb.europa.eu/our-work-tools/our-documents/urgent-binding-decision-board-art-66/urgent-binding-decision-012021_en","https://gdprhub.eu/index.php?title=EDPB_-_Urgent_Binding_Decision_1/2021_-_%27WhatsApp%27",null,"gdprhub",null,null,"whatsapp ireland ltd","Meta",null,null,null,null,null,null,null,null],["2021/ES/106","ETid-768","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-12","day",45000,null,"EUR","Telefónica Móviles España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00180-2021.pdf","https://www.enforcementtracker.com/ETid-768","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00180/2021","gdprhub",null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2021/DK/008","ETid-757","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-07-09","day",80700,null,"EUR","Medicals Nordic I/S","Health Care",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/jul/medicals-nordic-is-indstillet-til-boede","https://www.enforcementtracker.com/ETid-757","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_Medicals_Nordic","gdprhub",null,null,"DK: medicals nordic is",null,null,null,null,null,null,null,null,null],["2021/ES/112","ETid-761","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-09","day",1500,null,"EUR","Aparcamiento Arcusa S.L.U.","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00435-2020.pdf","https://www.enforcementtracker.com/ETid-761",null,null,null,null,"aparcamiento arcusa slu",null,null,null,null,null,null,null,null,null],["2021/ES/114","ETid-754","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-08","day",50000,null,"EUR","Caixabank S.A.","Finance, Insurance and Consulting","Art. 6(1)(f)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00259-2020.pdf","https://www.enforcementtracker.com/ETid-754","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00259/2020","gdprhub",null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2021/ES/113","ETid-755","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-08","day",4000,null,"EUR","Malagatrom S.L.U.","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00459-2020.pdf","https://www.enforcementtracker.com/ETid-755","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00459/2020","gdprhub",null,null,"malagatrom slu",null,null,null,null,null,null,null,null,null],["2021/GR/011","ETid-767","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-07-08","day",5000,null,"EUR","Pediatrician","Health Care","Art. 12(1), Art. 15(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-07/26_2021anonym.pdf","https://www.enforcementtracker.com/ETid-767","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_26/2021","gdprhub",null,null,"GR: pediatrician",null,null,null,null,null,null,null,null,null],["2021/DK/009","ETid-746","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-07-07","day",53800,null,"EUR","Nordbornholms Byggeforretning Aps","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/jul/privat-virksomhed-indstillet-til-boede","https://www.enforcementtracker.com/ETid-746",null,null,null,null,"nordbornholms byggeforretning aps",null,null,null,null,null,null,null,null,null],["2021/ES/109","ETid-764","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-07","day",2000,null,"EUR","Homeowners Association","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00364-2020.pdf","https://www.enforcementtracker.com/ETid-764",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DK/013","Datatilsynet (Denmark) - 2020-32-1566","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-07-06","day",null,"-","EUR","Erhvervsstyrelsen (Danish Business Authority)",null,"Art. 5(1)(c), Art. 6(1)(a), Art. 6(1)(d), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/jul/erhvervsstyrelsens-optagelse-af-telefonsamtaler","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-32-1566",null,"gdprhub",null,null,"DK: erhvervsstyrelsen",null,null,null,null,null,null,null,null,null],["2021/ES/111","ETid-762","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-06","day",4200,null,"EUR","Marbella Resorts S.L.","Accommodation and Hospitality","Art. 28(3)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.aepd.es/es/documento/ps-00151-2021.pdf","https://www.enforcementtracker.com/ETid-762",null,null,null,null,"marbella resorts sl",null,null,null,null,null,null,null,null,null],["2021/HR/002","ETid-745","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2021-07-05","day",null,null,"EUR","IT services company","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izdane-nove-upravne-novcane-kazne/","https://www.enforcementtracker.com/ETid-745",null,null,null,null,"HR: it services company",null,null,null,null,null,null,null,null,null],["2021/GB/003","ETid-752","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2021-07-05","day",29000,null,"EUR","Mermaids","Individuals and Private Associations","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media/action-weve-taken/mpns/2620171/mermaids-mpn-20210705.pdf","https://www.enforcementtracker.com/ETid-752","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Mermaids","gdprhub",null,null,"GB: mermaids",null,null,null,null,null,null,null,null,null],["2021/HR/001","ETid-756","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2021-07-05","day",null,null,"EUR","Insurance company","Finance, Insurance and Consulting","Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://azop.hr/izdane-nove-upravne-novcane-kazne/","https://www.enforcementtracker.com/ETid-756",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/FI/005","ETid-786","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2021-07-05","day",25000,null,"EUR","Higher Education Institution","Employment","Art. 5(1)(c), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://tietosuoja.fi/-/korkeakoululle-seuraamusmaksu-tietosuojarikkomuksista-tyoajanseurannassa-kertyneiden-sijaintitietojen-kasittelyssa","https://www.enforcementtracker.com/ETid-786","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3843/163/20","gdprhub",null,null,"FI: higher education institution",null,null,null,null,null,null,null,null,null],["2021/ES/110","ETid-763","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-02","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)(a)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00410-2020.pdf","https://www.enforcementtracker.com/ETid-763","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00410/2020","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/108","ETid-765","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-01","day",1000,null,"EUR",null,null,"Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00060-2021.pdf","https://www.enforcementtracker.com/ETid-765","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00060/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/107","ETid-766","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-07-01","day",6000,null,"EUR",null,"Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00205-2021.pdf","https://www.enforcementtracker.com/ETid-766","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00205/2021","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/PL/005","ETid-769","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-06-30","day",3000,null,"EUR","Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra","Public Sector and Education","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.11.2020","https://www.enforcementtracker.com/ETid-769","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.11.2020","gdprhub",null,null,"PL: fundacje promocji mediacji i edukacji prawnej lex nostra",null,null,null,null,null,null,null,null,null],["2021/ES/211","AEPD (Spain) - PS/00427/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-06-29","day",null,"None","EUR","AYUNTAMIENTO DE GIJÓN",null,"Art. 30",null,null,"Violation found","https://www.aepd.es/es/documento/ps-00427-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00427/2020",null,"gdprhub",null,null,"ES: ayuntamiento de gijon",null,null,null,null,null,null,null,null,null],["2021/LU/010","ETid-760","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-06-29","day",12500,null,"EUR",null,null,"Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-24FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-760","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B024FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/GB/014","ICO (UK) - Brazier Consulting Services Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-25","day",null,"200000","GBP",null,null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2620097/brazier-mpn-20210701.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Brazier_Consulting_Services_Ltd",null,"gdprhub",null,"Claims management company",null,null,200000.0,232693,"day 2021-06-25|0.8595|GBP",null,null,null,null,null],["2021/FI/006","ETid-744","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2021-06-24","day",8500,null,"EUR","Magazine publisher","Media, Telecoms and Broadcasting","Art. 12(2), Art. 21(2), Art. 24(1), Art. 5(1)(a)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://finlex.fi/fi/viranomaiset/tsv/2021/20210863","https://www.enforcementtracker.com/ETid-744",null,null,null,null,"FI: magazine publisher",null,null,null,null,null,null,null,null,null],["2021/FI/011","Tietosuojavaltuutetun toimisto (Finland) - 2889/161/21","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-06-24","day",null,"None","EUR",null,null,"Art. 28(3), Art. 58(2)(b), Art. 83","Processor obligations",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20211003","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_2889/161/21",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/GR/030","HDPA (Greece) - 52/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-06-23","day",30000,"30,000","EUR","One Way Private Company",null,"Art. 28(3), Art. 32(2), Art. 32(4)","Data security, Processor obligations",null,"Violation found","https://www.dpa.gr/el/enimerwtiko/prakseisArxis/exetasi-kataggelion-shetika-me-azitites-tilefonikes-kliseis-gia-skopo-0","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_52/2021",null,"gdprhub",null,null,"GR: one way private company",null,null,null,null,null,null,null,null,null],["2021/NO/045","Datatilsynet (Norway) - 21/00045","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-06-22","day",null,"None","EUR",null,null,"Art. 15(1), Art. 55","Data subject rights",null,"Rejected","https://pvn.no/pvn-2021-06","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_21/00045",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/012","ETid-735","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-06-22","day",24800,null,"EUR",null,"Employment","Art. 13, Art. 17, Art. 21, Art. 5, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/gebyr-for-innsyn-i-tidligere-ansatts-e-postkasse-og-manglende-avslutning-av-e-postkassen/","https://www.enforcementtracker.com/ETid-735",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/115","ETid-736","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-06-22","day",10000,null,"EUR","TNT EXPRESS WORLDWIDE SPAIN, S.L.","Industry and Commerce","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00301-2020.pdf","https://www.enforcementtracker.com/ETid-736","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00301/2020","gdprhub",null,null,"tnt express worldwide spain sl",null,null,null,null,null,null,null,null,null],["2021/IT/090","Garante per la protezione dei dati personali (Italy) - 9670001","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-06-22","day",49999,"49999","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(b)","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9670001","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9670001",null,"gdprhub",null,"Mayor of Messina",null,null,null,null,null,null,null,null,null,null],["2021/GB/013","ICO (UK) - Emailmovers Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-22","day",null,"None","EUR","Emailmovers Limited",null,"Art. 4(11), Art. 4(7), Art. 5(1)(a)","Data principles",null,"Violation found","https://ico.org.uk/media/action-weve-taken/enforcement-notices/2620027/emailmovers-limited-en.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Emailmovers_Limited",null,"gdprhub",null,null,"emailmovers ltd",null,null,null,null,null,null,null,null,null],["2021/NO/058","Personvernnemnda (Norway) - 2021-03","gdprhub","Norway","NO","Personvernnemnda (Norway)","2021-06-22","day",null,"NOK 250,000","NOK","Excempt from public disclosure",null,"Art. 13, Art. 21, Art. 24, Art. 5(1)(a), Art. 5(2), Art. 6(1)(f)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://pvn.no/pvn-2021-03","https://gdprhub.eu/index.php?title=Personvernnemnda_%28Norway%29_-_2021-03",null,"gdprhub",null,null,"NO: excempt from public disclosure",null,250000.0,24462,"day 2021-06-22|10.2198|NOK",null,null,null,null,null],["2021/LT/002","ETid-732","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2021-06-21","day",20000,null,"EUR","UAB VS FITNESS","Industry and Commerce","Art. 30, Art. 35(1), Art. 9(1)","DPIA, Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/2021%20Sporto%20klubas%20LT%20(privatus).pdf","https://www.enforcementtracker.com/ETid-732","https://gdprhub.eu/index.php?title=VDAI_%28Lithuania%29_-_UAB_vs_FITNESS","gdprhub",null,null,"uab vs fitness",null,null,null,null,null,null,null,null,null],["2021/SE/001","ETid-733","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2021-06-21","day",1600000,null,"EUR","Storstockholms Lokaltrafik","Transportation and Energy","Art. 13, Art. 6(1)(f)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2021/2021-06-21-beslut-sl.pdf","https://www.enforcementtracker.com/ETid-733","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2018-21487","gdprhub",null,null,"ab storstockholms lokaltrafik",null,null,null,null,null,null,null,null,null],["2021/PL/006","ETid-741","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-06-21","day",35300,null,"EUR","Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A.","Finance, Insurance and Consulting","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.3.2021","https://www.enforcementtracker.com/ETid-741","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.3.2021","gdprhub",null,null,"sopockie towarzystwo ubezpieczen ergo hestia sa",null,null,null,null,null,null,null,null,null],["2021/HU/003","ETid-813","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-06-18","day",28400,null,"EUR","Magyar Telekom Nyrt.","Media, Telecoms and Broadcasting","Art. 17(1), Art. 25, Art. 5(1)(d), Art. 6(1)","Accountability, Data principles, Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=405:erintetti-jogok-biztositasanak-kotelezettsege-nem-ugyfel-erintettek-reszere","https://www.enforcementtracker.com/ETid-813","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-924-10/2021","gdprhub",null,null,"magyar telekom nyrt",null,null,null,null,null,null,null,null,null],["2021/ES/209","AEPD (Spain) - PS/00258/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-06-17","day",12000,"12000 EUR","EUR","AUDAX RENOVABLES, S.A.",null,"Art. 21","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00258-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00258/2020",null,"gdprhub",null,null,"audax renovables sa",null,null,null,null,null,null,null,null,null],["2021/DK/010","ETid-730","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-06-16","day",27000,null,"EUR","Vejle Municipality","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2021/jun/vejle-kommune-indstilles-til-boede","https://www.enforcementtracker.com/ETid-730","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_Datatilsynet_-_Vejle_Kommune_indstilles_til_b%C3%B8de","gdprhub",null,null,"DK: vejle municipality",null,null,null,null,null,null,null,null,null],["2021/GB/011","ICO (UK) - COLOURCOAT LTD","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-16","day",null,"130000","GBP","COLOURCOAT LTD",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2620022/colourcoat-ltd-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_COLOURCOAT_LTD",null,"gdprhub",null,null,"colourcoat ltd",null,130000.0,151462,"day 2021-06-16|0.8583|GBP",null,null,null,null,null],["2021/IS/003","ETid-740","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2021-06-15","day",34000,null,"EUR","Huppuís ehf","Employment","Art. 12(1), Art. 6(1)","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.personuvernd.is/urlausnir/huppuis-ehf.-sektud-vegna-voktunar-med-eftirlitsmyndavelum-i-starfsmannarymi-1","https://www.enforcementtracker.com/ETid-740",null,null,null,null,"huppuis ehf",null,null,null,null,null,null,null,null,null],["2021/BE/025","APD/GBA (Belgium) - 72/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-06-14","day",null,"None","EUR",null,null,"Art. 12(3), Art. 13(1)(c), Art. 15(1), Art. 6(1)(e)","Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-72-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_72/2021",null,"gdprhub",null,"Public authority",null,null,null,null,null,null,null,null,null,null],["2021/ES/116","ETid-727","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-06-14","day",1200,null,"EUR","Inmopiso Zaragoza S.L.","Real Estate","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00177-2021.pdf","https://www.enforcementtracker.com/ETid-727","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00118/2021","gdprhub",null,null,"inmopiso zaragoza sl",null,null,null,null,null,null,null,null,null],["2021/FR/010","ETid-734","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-06-14","day",500000,null,"EUR","BRICO PRIVÉ","Industry and Commerce","Art. 13, Art. 17, Art. 32, Art. 5(1)(e)","Data principles, Data security, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000043668709","https://www.enforcementtracker.com/ETid-734","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-008","gdprhub",null,null,"FR: brico prive",null,null,null,null,null,null,null,null,null],["2021/GB/010","ICO (UK) - Global One 2015","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-14","day",null,"10000","GBP","Global One 2015",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619970/global-one-2015-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Global_One_2015",null,"gdprhub",null,null,"GB: global one 2015",null,10000.0,11642,"day 2021-06-14|0.8590|GBP",null,null,null,null,null],["2021/GB/009","ICO (UK) - Papa John's (GB) Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-14","day",null,"10000","GBP","Papa John's (GB) Limited",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619969/papa-johns-gb-limited-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Papa_John%27s_%28GB%29_Limited",null,"gdprhub",null,null,"papa john s ltd",null,10000.0,11642,"day 2021-06-14|0.8590|GBP",null,null,null,null,null],["2021/LU/013","ETid-748","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-06-11","day",7200,null,"EUR",null,"Employment","Art. 13, Art. 32(1)","Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-22FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-748",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/LU/012","ETid-749","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-06-11","day",7600,null,"EUR",null,"Employment","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-21FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-749",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/LU/011","ETid-753","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-06-11","day",15000,null,"EUR",null,null,null,"Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-20FR-2021-sous-forme-anonymisee-.pdf","https://www.enforcementtracker.com/ETid-753","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_20FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/IT/043","ETid-743","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-06-10","day",2600000,null,"EUR","Foodinho s.r.l.","Industry and Commerce","Art. 13, Art. 22(3), Art. 25, Art. 32, Art. 35, Art. 37(7)","Accountability, DPIA, Data principles, Data protection officer, Data security, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9675440","https://www.enforcementtracker.com/ETid-743","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9675440","gdprhub",null,null,"foodinho srl","Glovo",null,null,null,null,null,null,null,null],["2021/IT/041","ETid-750","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-06-10","day",20000,null,"EUR","Dentist","Health Care",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9677521","https://www.enforcementtracker.com/ETid-750","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9677521","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/IT/037","ETid-807","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-06-10","day",40000,null,"EUR","Aeroporto Guglielmo Marconi di Bologna S.p.a.","Industry and Commerce","Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9685922","https://www.enforcementtracker.com/ETid-807","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9685922","gdprhub",null,null,"aeroporto guglielmo marconi di bologna spa",null,null,null,null,null,null,null,null,null],["2021/IT/036","ETid-808","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-06-10","day",40000,null,"EUR","aiComply S.r.l.","Industry and Commerce","Art. 28, Art. 32","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9685947","https://www.enforcementtracker.com/ETid-808","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9685947","gdprhub",null,null,"aicomply srl",null,null,null,null,null,null,null,null,null],["2021/CZ/009","ETid-2802","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-06-09","day",2000,null,"EUR","Legal Person",null,"Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/143-cj-uoou-0234421-9-dokument-c-143.pdf","https://www.enforcementtracker.com/ETid-2802",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/CZ/008","ETid-2806","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-06-09","day",2000,null,"EUR","Legal Person",null,"Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/142-cj-uoou-0234321-9-dokument-c-142.pdf","https://www.enforcementtracker.com/ETid-2806",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/CZ/007","ETid-2807","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-06-09","day",2000,null,"EUR",null,null,"Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/141-cj-uoou-0234021-9-dokument-c-141.pdf","https://www.enforcementtracker.com/ETid-2807",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/CZ/005","ETid-2809","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-06-09","day",2000,null,"EUR","Legal Person",null,"Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/123-cj-uoou-0016421-15-dokument-c-123.pdf","https://www.enforcementtracker.com/ETid-2809",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/011","ETid-720","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-06-09","day",2000,null,"EUR","S.C. Dreamtime Call S.R.L.",null,"Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09_06_2021&lang=ro","https://www.enforcementtracker.com/ETid-720","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_S.C._Dreamtime_Call_S.R.L.","gdprhub",null,null,"dreamtime call srl",null,null,null,null,null,null,null,null,null],["2021/SE/002","ETid-722","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2021-06-09","day",34800,null,"EUR","Directorate of the Östra Skaraborg Rescue Service","Employment",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2021/2021-06-09-beslut-raddningstjanst-ostra-skaraborg.pdf","https://www.enforcementtracker.com/ETid-722","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2018-22697","gdprhub",null,null,"SE: directorate of the ostra skaraborg rescue service",null,null,null,null,null,null,null,null,null],["2021/RO/010","ETid-728","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-06-09","day",2000,null,"EUR","La Santrade S.R.L.",null,"Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_16_06_2021&lang=ro","https://www.enforcementtracker.com/ETid-728","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_La_Santrade_S.R.L.","gdprhub",null,null,"la santrade srl",null,null,null,null,null,null,null,null,null],["2021/IT/089","Garante per la protezione dei dati personali (Italy) - 9668051","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-06-09","day",null,"None","EUR","Pago PA S.p.A",null,"Art. 5(1), Art. 58(2)(d), Art. 58(2)(f)","Data principles",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9668051","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9668051",null,"gdprhub",null,null,"pago pa spa",null,null,null,null,null,null,null,null,null],["2021/NO/042","Datatilsynet (Norway) - 20/02274","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-06-07","day",null,"150,000","NOK",null,null,"Art. 13, Art. 17(1)(e), Art. 21, Art. 24, Art. 5(1)(a), Art. 5(1)(e), Art. 5(2), Art. 6(1)(f)","Accountability, Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/virksomhet-far-gebyr-for-innsyn-i-tidligere-ansatts-e-postkasse-og-manglende-avslutning-av-e-postkassen/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02274",null,"gdprhub",null,"Company",null,null,150000.0,14928,"day 2021-06-07|10.0483|NOK",null,null,null,null,null],["2021/ES/118","ETid-709","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-06-07","day",20000,null,"EUR","Master Distancia S.A.","Public Sector and Education","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00140-2021.pdf","https://www.enforcementtracker.com/ETid-709",null,null,null,null,"master distancia sa",null,null,null,null,null,null,null,null,null],["2021/ES/117","ETid-710","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-06-07","day",19600,null,"EUR","Radiotelevisión del principado de Asturias","Employment","Art. 12, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00261-2020.pdf","https://www.enforcementtracker.com/ETid-710","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00261/2020","gdprhub",null,null,"ES: radiotelevision del principado de asturias",null,null,null,null,null,null,null,null,null],["2021/SE/007","ETid-715","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2021-06-07","day",25000,null,"EUR","Region Sörmland","Health Care","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2021/2021-06-07-beslut-region-sormland.pdf","https://www.enforcementtracker.com/ETid-715",null,null,null,null,"SE: region sormland",null,null,null,null,null,null,null,null,null],["2021/SE/006","ETid-716","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2021-06-07","day",25000,null,"EUR","Region Värmland","Health Care","Art. 13, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2021/2021-06-07-beslut-region-varmland.pdf","https://www.enforcementtracker.com/ETid-716",null,null,null,null,"SE: region varmland",null,null,null,null,null,null,null,null,null],["2021/SE/005","ETid-717","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2021-06-07","day",50000,null,"EUR","Region Stockholm","Health Care","Art. 13, Art. 14, Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2021/2021-06-07-beslut-region-stockholm.pdf","https://www.enforcementtracker.com/ETid-717",null,null,null,null,"SE: region stockholm",null,null,null,null,null,null,null,null,null],["2021/SE/004","ETid-718","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2021-06-07","day",1200000,null,"EUR","MedHelp AB","Health Care","Art. 13, Art. 32, Art. 6, Art. 9(1)","Data principles, Data security, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2021/2021-06-07-beslut-medhelp.pdf","https://www.enforcementtracker.com/ETid-718","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2019-3375","gdprhub",null,null,"medhelp ab",null,null,null,null,null,null,null,null,null],["2021/SE/003","ETid-719","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2021-06-07","day",64500,null,"EUR","Voice Integrate Nordic AB","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.imy.se/globalassets/dokument/beslut/2021/2021-06-07-beslut-voice-integrate.pdf","https://www.enforcementtracker.com/ETid-719",null,null,null,null,"voice integrate nordic ab",null,null,null,null,null,null,null,null,null],["2021/ES/225","AEPD (Spain) - TD/00044/2021","gdprhub","Spain","ES","AEPD (Spain)","2021-06-04","day",null,"None","EUR","AMAZON WEB SERVICES EMEA SARL SUCURSAL EN ESPAÑA",null,"Art. 17, Art. 28(3), Art. 28(3)(e)","Data subject rights, Processor obligations",null,"Violation found","https://www.aepd.es/es/documento/td-00044-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00044/2021",null,"gdprhub",null,null,"amazon web services emea sarl sucursal en espana","Amazon",null,null,null,null,null,null,null,null],["2021/BE/024","APD/GBA (Belgium) - 66/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-06-04","day",null,"None","EUR","Federal Governmental Agency: Financial",null,"Art. 14, Art. 15, Art. 16, Art. 18, Art. 4(3)","Data subject rights, Transparency",null,"Rejected","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-66-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_66/2021",null,"gdprhub",null,null,"BE: federal governmental agency financial",null,null,null,null,null,null,null,null,null],["2021/ES/119","ETid-708","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-06-04","day",6000,null,"EUR","Creator Energy S.L.","Transportation and Energy","Art. 6(1)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00126-2021.pdf","https://www.enforcementtracker.com/ETid-708",null,null,null,null,"creator energy sl",null,null,null,null,null,null,null,null,null],["2021/NO/011","ETid-738","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-06-04","day",49200,null,"EUR","Moss municipality","Health Care",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/e7e029cdedec4c4e8907aef6bb08590c/20_02165-9-vedtak-om-overtredelsesgebyr--moss-kommune-236334_9_1.pdf","https://www.enforcementtracker.com/ETid-738","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02165","gdprhub",null,null,"NO: moss municipality",null,null,null,null,null,null,null,null,null],["2021/GB/008","ICO (UK) - Solarwave Limited EN","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-04","day",null,"100,000","GBP","Solarwave Limited",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/solarwave-limited-en/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Solarwave_Limited_EN",null,"gdprhub",null,null,"solarwave ltd",null,100000.0,116700,"day 2021-06-04|0.8569|GBP",null,null,null,null,null],["2021/ES/191","AEPD (Spain) - PS/00129/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-06-03","day",null,"None","EUR","Spanish Tax Authority",null,"Art. 13","Transparency",null,"Rejected","https://www.aepd.es/es/documento/ps-00129-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00129/2020",null,"gdprhub",null,null,"ES: spanish tax authority",null,null,null,null,null,null,null,null,null],["2021/EE/001","AKI (Estonia) - 2.1.-1/21/1550","gdprhub","Estonia","EE","AKI (Estonia)","2021-06-03","day",null,"None","EUR",null,null,"Art. 15, Art. 23","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/ettekirjutus-hoiatus_isikuandmete_kaitse_asjas_03.06.2021_nr_2.1.-1_21_1550_viimsi_uudised_ou.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-1/21/1550",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/GR/012","ETid-731","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-06-03","day",15000,null,"EUR","PURPLE SEA MΟΝΟΠΡΟΣΩΠΗ ΙΚΕ",null,"Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2021-06/23_2021anonym.pdf","https://www.enforcementtracker.com/ETid-731","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_23/2021","gdprhub",null,null,"GR: purple sea m",null,null,null,null,null,null,null,null,null],["2021/IT/087","Garante per la protezione dei dati personali (Italy) - 9592298","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-06-03","day",null,"None","EUR","Mitiga Italia App",null,"Art. 6","Unlawful processing",null,"Violation found","http://www.gpdp.it","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9592298",null,"gdprhub",null,null,"IT: mitiga italia app",null,null,null,null,null,null,null,null,null],["2021/GB/033","ICO (UK) - ICO- Conservative Party Case","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-03","day",null,"10000","GBP",null,null,null,null,null,"Violation found","https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/06/conservative-party-fined-10-000-for-sending-unlawful-emails/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_ICO-_Conservative_Party_Case",null,"gdprhub",null,"Conservative Party",null,null,10000.0,11634,"day 2021-06-03|0.8596|GBP",null,null,null,null,null],["2021/GB/007","ICO (UK) - LTH Holdings Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-06-03","day",null,"145000","GBP",null,null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619916/lth-holdings-mpn-20210603.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_LTH_Holdings_Limited",null,"gdprhub",null,"Funeral plan service",null,null,145000.0,168693,"day 2021-06-03|0.8596|GBP",null,null,null,null,null],["2021/ES/120","ETid-706","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-06-02","day",4000,null,"EUR","Avalos Consultores, S.L.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00116-2021.pdf","https://www.enforcementtracker.com/ETid-706",null,null,null,null,"avalos consultores sl",null,null,null,null,null,null,null,null,null],["2021/IT/088","Garante per la protezione dei dati personali (Italy) - 9592011","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-06-01","day",null,"None","EUR","Associazione Rousseau",null,"Art. 28(3)(g), Art. 58(2)(d)","Processor obligations",null,"Violation found","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9592011","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9592011",null,"gdprhub",null,null,"IT: associazione rousseau",null,null,null,null,null,null,null,null,null],["2021/LU/015","ETid-726","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-05-31","day",18000,null,"EUR",null,null,"Art. 39(1)(a)","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-18FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-726","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B018FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/NL/011","ETid-751","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2021-05-31","day",450000,null,"EUR","UWV (Dutch employee insurance service provider)","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boete_uwv_beveiliging_groepsberichten.pdf","https://www.enforcementtracker.com/ETid-751","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_31.05.2021","gdprhub",null,null,"NL: uwv",null,null,null,null,null,null,null,null,null],["2021/NO/013","ETid-723","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-05-28","day",39700,null,"EUR","BRAbank ASA","Finance, Insurance and Consulting","Art. 24","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/28e9c4b1562743debffbc9ab253f3db2/vedtak-om-overtredelsesgebyr---brabankasa.pdf","https://www.enforcementtracker.com/ETid-723","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02376","gdprhub",null,null,"brabank asa",null,null,null,null,null,null,null,null,null],["2021/CZ/018","UOOU (Czech Republic) - UOOU-05284/19-47","gdprhub","Czech Republic","CZ","UOOU (Czech Republic)","2021-05-28","day",null,"None","EUR",null,null,"Art. 10, Art. 5, Art. 6(1)(f), Art. 7, Art. 9","Consent, Data principles, Special categories, Unlawful processing",null,"Other Outcome","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=51369","https://gdprhub.eu/index.php?title=UOOU_%28Czech_Republic%29_-_UOOU-05284/19-47",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/029","ANSPDCP (Romania) - Fine against Vodafone România S.A. 4","gdprhub","Romania","RO","ANSPDCP (Romania)","2021-05-27","day",null,"5000","RON","Vodafone România",null,null,null,null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_27_05_2021&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Vodafone_Rom%C3%A2nia_S.A._4",null,"gdprhub",null,null,"vodafone romania sa","Vodafone",5000.0,1017,"day 2021-05-27|4.9161|RON",null,null,null,null,null],["2021/ES/123","ETid-701","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-27","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00401-2020.pdf","https://www.enforcementtracker.com/ETid-701",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/IT/040","ETid-772","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-05-27","day",120000,null,"EUR","Azienda Usl della Romagna","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9682619","https://www.enforcementtracker.com/ETid-772","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9682619","gdprhub",null,null,"IT: azienda usl della romagna",null,null,null,null,null,null,null,null,null],["2021/IT/039","ETid-773","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-05-27","day",150000,null,"EUR","Azienda Provinciale per i Servizi Sanitari di Trento","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9682641","https://www.enforcementtracker.com/ETid-773","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9682641","gdprhub",null,null,"IT: azienda provinciale per i servizi sanitari di trento",null,null,null,null,null,null,null,null,null],["2021/ES/124","ETid-697","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-26","day",3000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00155-2021.pdf","https://www.enforcementtracker.com/ETid-697","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00155/2021","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/128","ETid-691","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-25","day",900,null,"EUR","Managing Director of a company","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00036-2021.pdf","https://www.enforcementtracker.com/ETid-691",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/127","ETid-694","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-25","day",100000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 28","Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00030-2021.pdf","https://www.enforcementtracker.com/ETid-694",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/126","ETid-695","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-25","day",4000,null,"EUR","Alava Norte, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00378-2020.pdf","https://www.enforcementtracker.com/ETid-695",null,null,null,null,"alava norte sl",null,null,null,null,null,null,null,null,null],["2021/ES/125","ETid-696","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-25","day",6000,null,"EUR","Desolasol Restauración, S.L.","Accommodation and Hospitality","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00316-2020.pdf","https://www.enforcementtracker.com/ETid-696",null,null,null,null,"desolasol restauracion sl",null,null,null,null,null,null,null,null,null],["2021/GB/006","ICO (UK) - Colour Car Sales Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-05-24","day",null,"170000","GBP","Colour Car Sales Limited",null,"Art. 4(11)",null,null,"Violation found","https://cy.ico.org.uk/media/action-weve-taken/enforcement-notices/2619915/colour-car-sales-ltd-en-20210524.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Colour_Car_Sales_Limited",null,"gdprhub",null,null,"colour car sales ltd",null,170000.0,196741,"day 2021-05-24|0.8641|GBP",null,null,null,null,null],["2021/ES/129","ETid-690","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-21","day",3000,null,"EUR","Physician","Health Care","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00066-2021.pdf","https://www.enforcementtracker.com/ETid-690",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/122","ETid-702","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-21","day",3000,null,"EUR","Homeowners Association","Real Estate","Art. 12, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00156-2020.pdf","https://www.enforcementtracker.com/ETid-702",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/121","ETid-705","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-21","day",45000,null,"EUR","Telefónica de España, S.A.U","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00135-2021.pdf","https://www.enforcementtracker.com/ETid-705",null,null,null,null,"telefonica de espana sau","Telefonica",null,null,null,null,null,null,null,null],["2021/SI/015","IP (Slovenia) - 0611-10/2021/11","gdprhub","Slovenia","SI","IP (Slovenia)","2021-05-21","day",null,"None","EUR",null,null,"Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://gdprplanet.com/videonadzor-lokala-in-zakoniti-interes-odlocba-po-zin-2/","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0611-10/2021/11",null,"gdprhub",null,"Bar owner",null,null,null,null,null,"person",null,null,null,null],["2021/NO/015","ETid-688","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-05-20","day",39000,null,"EUR","Municipality of Oslo","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/overtredelsesgebyr-til-oslo-kommune/","https://www.enforcementtracker.com/ETid-688",null,null,null,null,"NO: municipality of oslo",null,null,null,null,null,null,null,null,null],["2021/BE/023","APD/GBA (Belgium) - 61/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-05-19","day",null,"None","EUR",null,null,null,null,null,"Other Outcome","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-61-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_61/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/013","ETid-684","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-05-19","day",500,null,"EUR","Owners Association of Iasi Municipality","Individuals and Private Associations",null,"Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_19_/_05_/_2021_1&lang=ro","https://www.enforcementtracker.com/ETid-684","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_a_Property_Owners_Association","gdprhub",null,null,"RO: owners association of iasi municipality",null,null,null,null,null,null,null,null,null],["2021/RO/012","ETid-685","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-05-19","day",2000,null,"EUR","Banca Comercială Română S.A.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_19_05_2021_2&lang=ro","https://www.enforcementtracker.com/ETid-685","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Banca_Comercial%C4%83_Rom%C3%A2n%C4%83_S.A.","gdprhub",null,null,"banca comerciala romana sa",null,null,null,null,null,null,null,null,null],["2021/ES/224","AEPD (Spain) - PS/00474/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-05-18","day",50000,"50000","EUR","VODAFONE ESPAÑA, S.A.U.",null,"Art. 21","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00474-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00474/2020",null,"gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/NO/014","ETid-700","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-05-18","day",95500,null,"EUR","Innovasjon Norge","Finance, Insurance and Consulting","Art. 5(1), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/ecc60fae5be740da81468d4eb23c43a3/vedtak-om-overtredelsesgebyr-til-innovasjon-norge.pdf","https://www.enforcementtracker.com/ETid-700","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02042","gdprhub",null,null,"NO: innovasjon norge",null,null,null,null,null,null,null,null,null],["2021/GR/014","ETid-699","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-05-17","day",10000,null,"EUR","Municipal Organization for Pre-School Education and Social Solidarity (DOPAKA) of the municipality of Tavros Moschato","Individuals and Private Associations","Art. 17(1)(d), Art. 6(1)(c)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/sites/default/files/2021-05/21_2021anonym.pdf","https://www.enforcementtracker.com/ETid-699",null,null,null,null,"GR: municipal organization for pre school education and social solidarity of the municipality of tavros moschato",null,null,null,null,null,null,null,null,null],["2021/GB/004","ICO (UK) - AMEX","gdprhub","United Kingdom","GB","ICO (UK)","2021-05-17","day",null,"90000","GBP","American Express Services Europe Limited",null,"Art. 4(11), Art. 7(4)","Consent",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619801/amex-mpn-20210521.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_AMEX",null,"gdprhub",null,null,"american express services europe ltd",null,90000.0,104390,"day 2021-05-17|0.8621|GBP",null,null,null,null,null],["2021/CZ/002","ETid-2832","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-05-14","day",800,null,"EUR","Legal Person",null,"Art. 12(4)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/140-cj-uoou-0227421-7-dokument-c-140.pdf","https://www.enforcementtracker.com/ETid-2832",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/015","ETid-675","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-05-14","day",200,null,"EUR","Website operator","Individuals and Private Associations","Art. 32(2), Art. 6(1)","Data principles, Data security, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_14_/_05_/_2021&lang=ro","https://www.enforcementtracker.com/ETid-675",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/130","ETid-677","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-14","day",30000,null,"EUR","Allianz Compañia de Seguros y Reaseguros, S.A.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00123-2021.pdf","https://www.enforcementtracker.com/ETid-677",null,null,null,null,"allianz compania de seguros y reaseguros sa",null,null,null,null,null,null,null,null,null],["2021/IT/004","ETid-1327","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-05-13","day",20000,null,"EUR","Synlab Med srl","Health Care","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9678535","https://www.enforcementtracker.com/ETid-1327",null,null,null,null,"synlab med srl",null,null,null,null,null,null,null,null,null],["2021/RO/014","ETid-676","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-05-13","day",2000,null,"EUR","Telekom Romania Communications SA","Media, Telecoms and Broadcasting","Art. 21, Art. 6","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_13_/_05_/_2021&lang=ro","https://www.enforcementtracker.com/ETid-676","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Telekom_Romania_Communications_SA_3","gdprhub",null,null,"telekom romania communications sa",null,null,null,null,null,null,null,null,null],["2021/IT/044","ETid-737","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-05-13","day",2856169,null,"EUR","Iren Mercato S.p.A.","Transportation and Energy","Art. 6(1), Art. 7(1)","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9670025","https://www.enforcementtracker.com/ETid-737",null,null,null,null,"iren mercato spa",null,null,null,null,null,null,null,null,null],["2021/IT/042","ETid-747","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-05-13","day",84000,null,"EUR","Comune di Bolzano","Employment","Art. 13, Art. 35, Art. 6, Art. 9","DPIA, Data principles, Special categories, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9669974","https://www.enforcementtracker.com/ETid-747","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9669974","gdprhub",null,null,"IT: comune di bolzano",null,null,null,null,null,null,null,null,null],["2021/ES/190","AEPD (Spain) - PS/00131/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-05-12","day",null,"None","EUR","CONSELLERÍA DE EDUCACIÓN, UNIVERSIDAD Y FORMACIÓN PROFESIONAL DE LA XUNTA DE GALICIA",null,"Art. 13","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00131-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00131/2020",null,"gdprhub",null,null,"ES: conselleria de educacion universidad y formacion profesional de la xunta de galicia",null,null,null,null,null,null,null,null,null],["2021/ES/131","ETid-673","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-12","day",3000,null,"EUR","Solram T Y R S.L.","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00113-2021.pdf","https://www.enforcementtracker.com/ETid-673",null,null,null,null,"ES: solram tyrsl",null,null,null,null,null,null,null,null,null],["2021/GR/015","ETid-680","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-05-12","day",5000,null,"EUR","A. ΕΠΙΛΟΓΗ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ",null,"Art. 12(3), Art. 15, Art. 17","Data principles, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2021-05/17_2021anonym.pdf","https://www.enforcementtracker.com/ETid-680",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/GR/013","ETid-703","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-05-12","day",5000,null,"EUR","KARIERA A.E.","Industry and Commerce","Art. 17, Art. 21, Art. 25","Accountability, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-05/20_2021anonym.pdf","https://www.enforcementtracker.com/ETid-703","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_20/2021","gdprhub",null,null,"kariera ae",null,null,null,null,null,null,null,null,null],["2021/LU/019","ETid-711","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-05-12","day",1900,null,"EUR",null,null,null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-17FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-711","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_17FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/LU/018","ETid-712","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-05-12","day",2400,null,"EUR",null,"Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-15FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-712",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/LU/017","ETid-713","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-05-12","day",2600,null,"EUR",null,"Employment","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-14FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-713",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/LU/016","ETid-714","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-05-12","day",1000,null,"EUR",null,null,"Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-16FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-714","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B016FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/PT/002","CNPD (Portugal) - Deliberação 2021/622","gdprhub","Portugal","PT","CNPD (Portugal)","2021-05-11","day",null,"None","EUR",null,null,"Art. 22, Art. 45, Art. 46, Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(e), Art. 6(1)(f)","Data principles, Data subject rights, International transfers, Unlawful processing",null,"Violation found","https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/121887","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2021/622",null,"gdprhub",null,"Educational institution",null,null,null,null,null,null,null,null,null,null],["2021/DE/054","HmbBfDI (Hamburg) - Facebook/WhatsApp","gdprhub","Germany","DE","HmbBfDI (Hamburg)","2021-05-11","day",null,"None","EUR","Facebook Ireland Ltd.",null,"Art. 6","Unlawful processing",null,null,"https://datenschutz-hamburg.de/assets/pdf/2021-05-11-press-release-facebook.pdf","https://gdprhub.eu/index.php?title=HmbBfDI_%28Hamburg%29_-_Facebook/WhatsApp",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["2021/GB/005","ICO (UK) - ICO Monetary Penalty on Tested.me Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2021-05-10","day",null,"8.000","GBP",null,null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619769/tested-me-ltd-mpn-20210510.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_ICO_Monetary_Penalty_on_Tested.me_Ltd",null,"gdprhub",null,"Digital contact tracing service",null,null,8000.0,9281,"day 2021-05-10|0.8619|GBP",null,null,null,null,null],["2021/SI/016","IP (Slovenia) - 0610-32/2021/7","gdprhub","Slovenia","SI","IP (Slovenia)","2021-05-10","day",null,"None","EUR",null,null,"Art. 32","Data security",null,"Violation found","https://gdprplanet.com/objavljanje-osebnih-podatkov-na-eupravi-sklep-o-ustavitvi-po-zin/","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0610-32/2021/7",null,"gdprhub",null,"EGovernment portal",null,null,null,null,null,null,null,null,null,null],["2021/RO/016","ETid-668","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-05-07","day",2000,null,"EUR","World Class România S.A.","Employment","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_07_/_05_/_2021&lang=ro","https://www.enforcementtracker.com/ETid-668","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_World_Class_Romania_S.A.","gdprhub",null,null,"world class romania sa",null,null,null,null,null,null,null,null,null],["2021/BE/022","APD/GBA (Belgium) - 57/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-05-06","day",30000,"30.000","EUR",null,null,"Art. 13(1)(c), Art. 13(1)(d), Art. 5(1)(a), Art. 5(2), Art. 6(1)(c), Art. 6(1)(f)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-57-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_57/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/030","Datatilsynet (Norway) - 20/01626","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-05-05","day",null,"1250000","NOK","Norges idrettsforbund og olympiske og paralympiske komité (NIF)",null,"Art. 32, Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(f), Art. 6","Data principles, Data security, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2020/varsel-om-overtredelsesgebyr-til-norges-idrettsforbund/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01626",null,"gdprhub",null,null,"NO: norges idrettsforbund og olympiske og paralympiske komite",null,1250000.0,125190,"day 2021-05-05|9.9848|NOK",null,null,null,null,null],["2021/NO/016","ETid-667","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-05-05","day",null,null,"EUR","Disqus Inc.","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/8311c84c085b424d8d5c55dd4c9e2a4a/advance-notification-of-an-administrative-fine--disqus-inc.pdf","https://www.enforcementtracker.com/ETid-667","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01801","gdprhub",null,null,"disqus inc",null,null,null,null,null,null,null,null,null],["2021/IS/006","Persónuvernd (Iceland) - 2020010394","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-05-05","day",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-personuupplysinga-milli-sveitarfelags-og-stettarfelags","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020010394",null,"gdprhub",null,"Municipality and trade union",null,null,null,null,null,null,null,null,null,null],["2021/IS/020","Persónuvernd (Iceland) - 2020010609","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-05-05","day",null,"None","EUR",null,null,null,null,null,"Rejected","https://www.personuvernd.is/urlausnir/akvordun-um-adgengi-hins-skrada-ad-upplysingum-um-sig-i-schengen-upplysingakerfinu","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020010609",null,"gdprhub",null,"Police officer",null,null,null,null,null,"person",null,null,null,null],["2021/ES/133","ETid-670","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-04","day",1500000,null,"EUR","EDP Comercializadora, S.A.U.","Transportation and Energy","Art. 13, Art. 25","Accountability, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00037-2020.pdf","https://www.enforcementtracker.com/ETid-670","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00037/2020","gdprhub",null,null,"edp comercializadora sau",null,null,null,null,null,null,null,null,null],["2021/ES/132","ETid-671","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-05-04","day",1500000,null,"EUR","EDP Energía, S.A.U","Transportation and Energy","Art. 13, Art. 25","Accountability, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00236-2020.pdf","https://www.enforcementtracker.com/ETid-671","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00236/2020","gdprhub",null,null,"edp energia sau",null,null,null,null,null,null,null,null,null],["2021/IS/005","Persónuvernd (Iceland) - 2020010355","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-05-04","day",23585,"23585","EUR",null,null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.personuvernd.is/urlausnir/akvordun-vegna-oryggisbrests-hja-infomentor-ehf.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2020010355",null,"gdprhub",null,"School management system operator",null,null,null,null,null,null,null,null,null,null],["2021/AT/013","DSB (Austria) - 2021-0.285.169","gdprhub","Austria","AT","DSB (Austria)","2021-05-03","day",null,"None","EUR",null,null,"Art. 2(2)(c), Art. 4(1), Art. 4(15)",null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210503_2021_0_285_169_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.285.169",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/EU/001","EDPS - 2019-0878","gdprhub","European Union","EU","EDPS","2021-05-03","day",null,"None","EUR","Court of Justice of the European Union",null,"Art. 7","Consent",null,"Violation found","https://files.michae.lv/2019-0878-decision-signed.pdf","https://gdprhub.eu/index.php?title=EDPS_-_2019-0878",null,"gdprhub",null,null,"EU: court of justice of the european union",null,null,null,null,null,null,null,null,null],["2021/FR/015","CNIL (France) - SAN-2021-004","gdprhub","France","FR","CNIL (France)","2021-04-30","day",null,"None","EUR","Google LLC",null,"Art. 7","Consent",null,null,"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000043470685?page=1&pageSize=10&query=2016%2F679&searchField=ALL&searchType=ALL&sortValue=DATE_DECISION_DESC&tab_selection=cnil&typePagination=DEFAULT%20https://www.cnil.fr/fr/cloture-injonction-prononcee-encontre-google","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-004",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2021/IT/002","ETid-1354","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-04-29","day",2000,null,"EUR","Santa Ninfa municipality","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9681085","https://www.enforcementtracker.com/ETid-1354",null,null,null,null,"IT: santa ninfa municipality",null,null,null,null,null,null,null,null,null],["2021/IS/004","ETid-669","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2021-04-29","day",23100,null,"EUR","InfoMentor ehf","Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.personuvernd.is/information-in-english/greinar/personal-data-breach-in-the-information-system-mentor-administrative-fine","https://www.enforcementtracker.com/ETid-669",null,null,null,null,"infomentor ehf",null,null,null,null,null,null,null,null,null],["2021/ES/135","ETid-657","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-27","day",3000,null,"EUR","Pagamastarde S.L.","Finance, Insurance and Consulting","Art. 17(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00107-2021.pdf","https://www.enforcementtracker.com/ETid-657",null,null,null,null,"pagamastarde sl",null,null,null,null,null,null,null,null,null],["2021/ES/134","ETid-658","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-27","day",15000,null,"EUR","Anytime Fitness Iberia S.L.","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00055-2021.pdf","https://www.enforcementtracker.com/ETid-658",null,null,null,null,"anytime fitness iberia sl",null,null,null,null,null,null,null,null,null],["2021/HU/006","ETid-692","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-04-27","day",1400,null,"EUR","Company","Industry and Commerce","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=381:diszpecseri-munkakort-betolto-munkavallaloval-folytatott-telefonhivas-rogzitese","https://www.enforcementtracker.com/ETid-692",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/HU/005","ETid-693","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-04-27","day",570,null,"EUR","Company","Industry and Commerce","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=381:diszpecseri-munkakort-betolto-munkavallaloval-folytatott-telefonhivas-rogzitese","https://www.enforcementtracker.com/ETid-693",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/PL/008","ETid-721","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-04-27","day",5050,null,"EUR","PNP S.A.",null,"Art. 31, Art. 58(1)(e)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.23.2020","https://www.enforcementtracker.com/ETid-721","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.23.2020","gdprhub",null,null,"pnp sa",null,null,null,null,null,null,null,null,null],["2021/HU/011","NAIH (Hungary) - NAIH-4495-1/2021","gdprhub","Hungary","HU","NAIH (Hungary)","2021-04-27","day",null,"700.000","HUF",null,null,"Art. 13(1), Art. 13(2), Art. 5(1)(a), Art. 5(2), Art. 6","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=381:diszpecseri-munkakort-betolto-munkavallaloval-folytatott-telefonhivas-rogzitese","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-4495-1/2021",null,"gdprhub",null,"Employer",null,null,700000.0,1930,"day 2021-04-27|362.7700|HUF",null,null,null,null,null],["2021/IS/018","Persónuvernd - 2020010708","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-04-27","day",null,"None","EUR",null,null,"Art. 6(1)","Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-creditinfo-lanstrausts-hf.-i-tengslum-vid-gerd-skyrslna-um-lanshaefi-1","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010708",null,"gdprhub",null,"Credit rating company",null,null,null,null,null,null,null,null,null,null],["2021/BE/003","ETid-664","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2021-04-26","day",100000,null,"EUR","Financial company","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-56-2021.pdf","https://www.enforcementtracker.com/ETid-664","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_56/2021","gdprhub",null,null,"BE: financial company",null,null,null,null,null,null,null,null,null],["2021/ES/136","ETid-656","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-23","day",1000000,null,"EUR","Equifax Iberica S.L.","Finance, Insurance and Consulting","Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00240-2019.pdf","https://www.enforcementtracker.com/ETid-656","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00240/2019","gdprhub",null,null,"equifax iberica sl","Equifax",null,null,null,null,null,null,null,null],["2021/IT/086","Garante per la protezione dei dati personali (Italy) - 9582723","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-04-23","day",null,"None","EUR",null,null,"Art. 5","Data principles",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9582723","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9582723",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/BE/021","APD/GBA (Belgium) - 54/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-04-22","day",null,"None","EUR",null,null,"Art. 24, Art. 4, Art. 5, Art. 6","Accountability, Data principles, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-54-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_54/2021",null,"gdprhub",null,"Family allowance fund",null,null,null,null,null,null,null,null,null,null],["2021/BE/020","APD/GBA (Belgium) - 55/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-04-22","day",null,"None","EUR",null,null,"Art. 13(1)(a), Art. 13(1)(b), Art. 25(1), Art. 25(2), Art. 6(1)(e), Art. 6(3)","Accountability, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-55-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_55/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/138","ETid-644","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-22","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00359-2020.pdf","https://www.enforcementtracker.com/ETid-644",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/137","ETid-645","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-22","day",4000,null,"EUR","HazteOir.Org","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00102-2021.pdf","https://www.enforcementtracker.com/ETid-645",null,null,null,null,"ES: hazteoir org",null,null,null,null,null,null,null,null,null],["2021/PL/009","ETid-681","cms_tracker","Poland","PL","Polish Data Protection Authority (UODO)","2021-04-22","day",245000,null,"EUR","Cyfrowy Polsat S.A.","Media, Telecoms and Broadcasting","Art. 24(1), Art. 34(1)","Accountability, Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5130.3114.2020","https://www.enforcementtracker.com/ETid-681","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5130.3114.2020","gdprhub",null,null,"cyfrowy polsat sa",null,null,null,null,null,null,null,null,null],["2021/IT/085","Garante per la protezione dei dati personali (Italy) - 9578184","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-04-22","day",null,"None","EUR",null,null,"Art. 13, Art. 14, Art. 25, Art. 32, Art. 5, Art. 6(3), Art. 9","Accountability, Data principles, Data security, Special categories, Transparency, Unlawful processing",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9578184","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9578184",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2021/HU/017","NAIH (Hungary) - NAIH-1855-4/2022","gdprhub","Hungary","HU","NAIH (Hungary)","2021-04-22","day",null,"3000000","HUF","Magyar Kétfarkú Kutya Párt, MKKP",null,"Art. 32(1)(a), Art. 32(1)(b), Art. 32(2), Art. 5(2), Art. 83, Art. 9(1)","Data principles, Data security, Special categories",null,"Violation found","https://naih.hu/hatarozatok-vegzesek?download=535:politikai-partot-erinto-adatvedelmi-incidens","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-1855-4/2022",null,"gdprhub",null,null,"HU: magyar ketfarku kutya part mkkp",null,3000000.0,8253,"day 2021-04-22|363.5200|HUF",null,null,null,null,null],["2021/LU/021","CNPD (Luxembourg) - Délibération n°13FR/2021","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2021-04-21","day",null,"None","EUR",null,null,"Art. 12, Art. 13","Transparency",null,"Violation found","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-13FR-2021-sous-forme-anonymisee.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B013FR/2021",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2021/FI/007","ETid-665","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2021-04-21","day",75000,null,"EUR","ParkkiPate Oy","Industry and Commerce","Art. 14(2)(a), Art. 14(3), Art. 15, Art. 17(1)(a), Art. 25(2), Art. 5(1)(c)","Accountability, Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://tietosuoja.fi/documents/6927448/58640544/Seuraamuskollegion+p%C3%A4%C3%A4t%C3%B6s_henkil%C3%B6tietojen+k%C3%A4sittely+pys%C3%A4k%C3%B6inninvalvontamaksujen+yhteydess%C3%A4.pdf/9b105604-51e0-7beb-e21b-df1b504843e6/Seuraamuskollegion+p%C3%A4%C3%A4t%C3%B6s_henkil%C3%B6tietojen+k%C3%A4sittely+pys%C3%A4k%C3%B6inninvalvontamaksujen+yhteydess%C3%A4.pdf?t=1619763172841","https://www.enforcementtracker.com/ETid-665",null,null,null,null,"parkkipate oy",null,null,null,null,null,null,null,null,null],["2021/IT/046","ETid-704","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-04-21","day",15000,null,"EUR","Fondazione Policlinico Tor Vergata di Roma","Health Care","Art. 13, Art. 25, Art. 32","Accountability, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9591223","https://www.enforcementtracker.com/ETid-704",null,null,null,null,"IT: fondazione policlinico tor vergata di roma",null,null,null,null,null,null,null,null,null],["2021/ES/188","AEPD (Spain) - E/03690/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-04-20","day",null,"None","EUR","Ministerio de Transportes, Movilidad y Agenda Urbana",null,"Art. 89(1)",null,null,"Violation found","https://www.aepd.es/es/documento/e-03690-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/03690/2020",null,"gdprhub",null,null,"ES: ministerio de transportes movilidad y agenda urbana",null,null,null,null,null,null,null,null,null],["2021/ES/139","ETid-642","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-20","day",8000,null,"EUR","Highcliffe Estates Marbella S.L.","Real Estate","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00491-2020.pdf","https://www.enforcementtracker.com/ETid-642",null,null,null,null,"highcliffe estates marbella sl",null,null,null,null,null,null,null,null,null],["2021/HU/004","ETid-812","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-04-20","day",2800,null,"EUR","Website operator",null,"Art. 24, Art. 5(2)","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.naih.hu/hatarozatok-vegzesek?download=408:elszamoltathatosag-elvenek-megsertese","https://www.enforcementtracker.com/ETid-812",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/017","ETid-637","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-04-19","day",1500,null,"EUR","Lugera & Makler Broker S.R.L.","Finance, Insurance and Consulting","Art. 29","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_presa_19_/_04_/_2021&lang=ro","https://www.enforcementtracker.com/ETid-637","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Lugera_%26_Makler_Broker_S.R.L.","gdprhub",null,null,"lugera and makler broker srl",null,null,null,null,null,null,null,null,null],["2021/ES/140","ETid-638","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-19","day",1500,null,"EUR","Pub owner","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00293-2020.pdf","https://www.enforcementtracker.com/ETid-638",null,null,null,null,"ES: pub owner",null,null,null,null,null,null,null,null,null],["2021/GR/016","ETid-646","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-04-16","day",2000,null,"EUR","Candidate for parliamentary elections","Public Sector and Education","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-04/7_2021anonym_0.pdf","https://www.enforcementtracker.com/ETid-646",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/018","ETid-633","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-04-15","day",5000,null,"EUR","S.C. Tip Top Food Industry S.R.L","Employment","Art. 5(2), Art. 6, Art. 7","Consent, Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_15_/_04_/_2021&lang=ro","https://www.enforcementtracker.com/ETid-633","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_S.C._Tip_Top_Food_Industry_S.R.L","gdprhub",null,null,"tip top food industry srl",null,null,null,null,null,null,null,null,null],["2021/ES/142","ETid-635","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-15","day",3000,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00151-2020.pdf","https://www.enforcementtracker.com/ETid-635","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00151/2020","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/IT/050","ETid-682","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-04-15","day",2000,null,"EUR","Società triveneta di chirurgia","Health Care","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9567489","https://www.enforcementtracker.com/ETid-682",null,null,null,null,"IT: societa triveneta di chirurgia",null,null,null,null,null,null,null,null,null],["2021/IT/049","ETid-683","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-04-15","day",5000,null,"EUR","Physician","Health Care","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9587637","https://www.enforcementtracker.com/ETid-683",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/IT/048","ETid-686","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-04-15","day",40000,null,"EUR","Comune di Palermo","Public Sector and Education","Art. 25, Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9587053","https://www.enforcementtracker.com/ETid-686",null,null,null,null,"IT: comune di palermo",null,null,null,null,null,null,null,null,null],["2021/IT/045","ETid-707","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-04-15","day",12000,null,"EUR","Istituto Nazionale Previdenza Sociale (INPS)","Public Sector and Education","Art. 12, Art. 15, Art. 5(1)(a)","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9592133","https://www.enforcementtracker.com/ETid-707",null,null,null,null,"IT: istituto nazionale previdenza sociale",null,null,null,null,null,null,null,null,null],["2021/PL/021","UODO (Poland) - DKE.523.10.2021","gdprhub","Poland","PL","UODO (Poland)","2021-04-15","day",null,"None","EUR",null,null,"Art. 6(1)(c), Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://uodo.gov.pl/decyzje/DKE.523.10.2021","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.523.10.2021",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2021/ES/141","ETid-636","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-13","day",90000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00085-2021.pdf","https://www.enforcementtracker.com/ETid-636","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00085/2021","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/223","AEPD (Spain) - TD/00013/2021","gdprhub","Spain","ES","AEPD (Spain)","2021-04-09","day",null,"None","EUR","GOKOAN EDUCATION, S. L.",null,"Art. 12(6), Art. 15, Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/es/documento/td-00013-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00013/2021",null,"gdprhub",null,null,"gokoan education sl",null,null,null,null,null,null,null,null,null],["2021/NO/018","ETid-628","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-04-09","day",3400,null,"EUR","Miljø- og Kvalitetsledelse AS","Industry and Commerce","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/miljo--og-kvalitetsledelse-as-far-gebyr/","https://www.enforcementtracker.com/ETid-628",null,null,null,null,"milj og kvalitetsledelse as",null,null,null,null,null,null,null,null,null],["2021/NL/012","ETid-770","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2021-04-09","day",750000,null,"EUR","TikTok","Media, Telecoms and Broadcasting","Art. 12","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boete_tiktok.pdf","https://www.enforcementtracker.com/ETid-770","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_09.04.2021","gdprhub",null,null,"NL: tiktok","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2021/BE/019","APD/GBA (Belgium) - 48/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-04-08","day",null,"None","EUR","A notary",null,"Art. 5(1)(a), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-48-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_48/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/143","ETid-630","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-08","day",60000,null,"EUR","Kutxabank, S.A.","Finance, Insurance and Consulting","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00473-2020.pdf","https://www.enforcementtracker.com/ETid-630",null,null,null,null,"kutxabank sa",null,null,null,null,null,null,null,null,null],["2021/LU/014","ETid-742","cms_tracker","Luxembourg","LU","National Commission for Data Protection (CNPD)","2021-04-08","day",2800,null,"EUR",null,null,"Art. 13, Art. 5(1)(e)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://cnpd.public.lu/content/dam/cnpd/fr/decisions-fr/2021/Decision-11FR-2021-sous-forme-anonymisee.pdf","https://www.enforcementtracker.com/ETid-742","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_11FR/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/SI/009","IP - 07120-1/2021/168","gdprhub","Slovenia","SI","IP (Slovenia)","2021-04-08","day",null,"None","EUR",null,null,"Art. 15","Data subject rights",null,null,"https://www.ip-rs.si/mnenja-gdpr/notranji-vpogledi-v-zdravstvene-osebne-podatke-drugih-zaposlenih-in-ukrepanje-v-zvezi-s-tem","https://gdprhub.eu/index.php?title=IP_-_07120-1/2021/168",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/SI/010","IP - 07121-1/2021/678","gdprhub","Slovenia","SI","IP (Slovenia)","2021-04-07","day",null,"None","EUR",null,null,"Art. 6(1)(b)","Unlawful processing",null,null,"https://bit.ly/3fZUEnb","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/678",null,"gdprhub",null,"Building manager",null,null,null,null,null,null,null,null,null,null],["2021/IS/019","Persónuvernd - 2020031243","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-04-07","day",null,"None","EUR",null,null,"Art. 8","Consent",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-grunnskola-a-personuupplysingum-nemanda-til-radgjafarfyrirtaekis","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020031243",null,"gdprhub",null,"Primary school",null,null,null,null,null,null,null,null,null,null],["2021/ES/144","ETid-624","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-06","day",2400,null,"EUR","Promotech Digital S.L.","Finance, Insurance and Consulting","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00087-2021.pdf","https://www.enforcementtracker.com/ETid-624",null,null,null,null,"promotech digital sl",null,null,null,null,null,null,null,null,null],["2021/SI/011","IP - 07121-1/2021/662","gdprhub","Slovenia","SI","IP (Slovenia)","2021-04-06","day",null,"None","EUR",null,null,"Art. 4(1)",null,null,null,"https://www.ip-rs.si/mnenja-gdpr/javno-objavljeni-podatki-na-spletu-o-samozaposlenih-v-kulturi","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/662",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/147","ETid-621","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-05","day",3000,null,"EUR","Kukimbia S.L.","Industry and Commerce","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00464-2020.pdf","https://www.enforcementtracker.com/ETid-621","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00464/2020","gdprhub",null,null,"kukimbia sl",null,null,null,null,null,null,null,null,null],["2021/ES/146","ETid-622","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-05","day",3000,null,"EUR","Electrotecnica Bastida S.L.","Industry and Commerce","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00054-2021.pdf","https://www.enforcementtracker.com/ETid-622","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00054/2021","gdprhub",null,null,"electrotecnica bastida sl",null,null,null,null,null,null,null,null,null],["2021/ES/145","ETid-623","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-04-05","day",4000,null,"EUR","Stockhunters S.L.","Finance, Insurance and Consulting","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00437-2020.pdf","https://www.enforcementtracker.com/ETid-623",null,null,null,null,"stockhunters sl",null,null,null,null,null,null,null,null,null],["2021/SE/011","IMY (Sweden) - DI-2020-10518","gdprhub","Sweden","SE","IMY (Sweden)","2021-03-31","day",null,"None","EUR","Klarna Bank AB",null,"Art. 12(3), Art. 15, Art. 56, Art. 58(2)(b)","Data subject rights, Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/beslut-klarna-bank-ab.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-10518",null,"gdprhub",null,null,"klarna bank ab","Klarna",null,null,null,null,null,null,null,null],["2021/RO/019","ETid-613","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-03-30","day",10000,null,"EUR","Telekom Romania Mobile Communications S.A.","Media, Telecoms and Broadcasting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_30_/_03_/_2021&lang=ro","https://www.enforcementtracker.com/ETid-613","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Telekom_Romania_mobile_communications_S.A._2","gdprhub",null,null,"telekom romania mobile communications sa",null,null,null,null,null,null,null,null,null],["2021/SI/008","IP - 07121-1/2021/597","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-26","day",null,"None","EUR",null,null,"Art. 2(2)",null,null,null,"https://www.ip-rs.si/mnenja-gdpr/varnostne-kamere-na-sosedovem-objektu","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/597",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2021/IT/006","ETid-1291","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-25","day",6000,null,"EUR","Convitto Nazionale Statale \"Giordano Bruno\" di Maddaloni (boarding school)","Public Sector and Education","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9583865","https://www.enforcementtracker.com/ETid-1291",null,null,null,null,"IT: convitto nazionale statale giordano bruno di maddaloni",null,null,null,null,null,null,null,null,null],["2021/IT/059","ETid-620","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-25","day",4500000,null,"EUR","Fastweb S.p.A.","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 21, Art. 24, Art. 25, Art. 33(1), Art. 34(1), Art. 5, Art. 6, Art. 7","Accountability, Consent, Data breach, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9570997","https://www.enforcementtracker.com/ETid-620","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9570997","gdprhub",null,null,"fastweb spa",null,null,null,null,null,null,null,null,null],["2021/IT/053","ETid-662","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-25","day",30000,null,"EUR","OneDirect Srl","Media, Telecoms and Broadcasting","Art. 30, Art. 31, Art. 6(1), Art. 7(1)","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9577323","https://www.enforcementtracker.com/ETid-662",null,null,null,null,"onedirect srl",null,null,null,null,null,null,null,null,null],["2021/IT/052","ETid-663","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-25","day",20000,null,"EUR","GEDI News Network Spa","Media, Telecoms and Broadcasting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9577346","https://www.enforcementtracker.com/ETid-663",null,null,null,null,"gedi news network spa",null,null,null,null,null,null,null,null,null],["2021/IT/051","ETid-674","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-25","day",4000,null,"EUR","Comune di Castellanza","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9584421","https://www.enforcementtracker.com/ETid-674",null,null,null,null,"IT: comune di castellanza",null,null,null,null,null,null,null,null,null],["2021/HU/007","ETid-679","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-03-25","day",1425,null,"EUR","Operator of a care facility","Health Care","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=380:kamerak-uzemeltetese-idosek-otthonaban","https://www.enforcementtracker.com/ETid-679",null,null,null,null,"HU: operator of a care facility",null,null,null,null,null,null,null,null,null],["2021/IT/047","ETid-698","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-25","day",7000,null,"EUR","TECNOMEDICAL S.r.l.","Health Care","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9590711","https://www.enforcementtracker.com/ETid-698",null,null,null,null,"tecnomedical srl",null,null,null,null,null,null,null,null,null],["2021/IT/083","Garante per la protezione dei dati personali (Italy) - 9574709","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-03-25","day",null,"None","EUR","TikTok",null,"Art. 12, Art. 13, Art. 24, Art. 25, Art. 58(2)(d), Art. 58(2)(f), Art. 66(1)","Accountability, Transparency",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9574709","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9574709",null,"gdprhub",null,null,"IT: tiktok","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2021/SI/013","IP - 0613-438/2019/16","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-25","day",null,"None","EUR",null,null,"Art. 32","Data security",null,"Violation found","https://gdprplanet.com/objava-kazenske-ovadbe-odlocba-po-zin-2/","https://gdprhub.eu/index.php?title=IP_-_0613-438/2019/16",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2021/HU/010","NAIH (Hungary) - NAIH-3748-1/2021","gdprhub","Hungary","HU","NAIH (Hungary)","2021-03-25","day",null,"500000","HUF",null,null,"Art. 13(1), Art. 13(2), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(2), Art. 6","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek?download=380:kamerak-uzemeltetese-idosek-otthonaban","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-3748-1/2021",null,"gdprhub",null,null,null,null,500000.0,1371,"day 2021-03-25|364.7800|HUF",null,null,null,null,null],["2021/HU/008","ETid-666","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2021-03-24","day",27700,null,"EUR","Budapest Főváros Kormányhivatala XI. kerületi Hivatalát (11th District Public Health Department of the Government Office of the Capital City Budapest)","Health Care","Art. 32(2), Art. 33(1), Art. 34(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://naih.hu//hatarozatok-vegzesek?download=354:bfkh-xi-keruleti-hivatalanal-bekovetkezett-egeszsegugyi-adatokat-erinto-adatvedelmi-incidens-es-adatbiztonsagi-hianyossagok","https://www.enforcementtracker.com/ETid-666",null,null,null,null,"HU: budapest fovaros kormanyhivatala xi keruleti hivatalat",null,null,null,null,null,null,null,null,null],["2021/BE/015","APD/GBA (Belgium) - 26/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-03-23","day",null,"None","EUR","IAB Europe",null,"Art. 6","Unlawful processing",null,null,"https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-26-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_26/2021",null,"gdprhub",null,null,"BE: iab europe",null,null,null,null,null,null,null,null,null],["2021/BE/017","APD/GBA (Belgium) - 38/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-03-23","day",null,"None","EUR","The federal public service of Belgium \"SPF Belgique\"",null,"Art. 17, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-38-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_38/2021",null,"gdprhub",null,null,"BE: the federal public service of belgium spf belgique",null,null,null,null,null,null,null,null,null],["2021/AT/023","DSB (Austria) - 2020-0.829.566","gdprhub","Austria","AT","DSB (Austria)","2021-03-23","day",null,null,null,null,null,"Art. 15(3), Art. 17","Data subject rights",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210323_2020_0_829_566_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.829.566",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/RO/020","ETid-606","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-03-23","day",2000,null,"EUR","S.C. Medicover S.R.L.","Health Care",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_23_/_03_/_2021&lang=ro","https://www.enforcementtracker.com/ETid-606",null,null,null,null,"medicover srl",null,null,null,null,null,null,null,null,null],["2021/ES/149","ETid-607","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-23","day",1000,null,"EUR","Laboratorio Octogón, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00295-2020.pdf","https://www.enforcementtracker.com/ETid-607",null,null,null,null,"laboratorio octogon sl",null,null,null,null,null,null,null,null,null],["2021/IE/007","ETid-689","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2021-03-23","day",90000,null,"EUR","Irish Credit Bureau DAC","Finance, Insurance and Consulting","Art. 24(1), Art. 25(1), Art. 5(2)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2021-05/Redacted_23.03.2021_Decision_IN-19-7-2.pdf","https://www.enforcementtracker.com/ETid-689","https://gdprhub.eu/index.php?title=DPC_%28Ireland%29_-_IN-19-7-2","gdprhub",null,null,"irish credit bureau dac",null,null,null,null,null,null,null,null,null],["2021/SE/010","IMY (Sweden) - DI-2020-10561","gdprhub","Sweden","SE","IMY (Sweden)","2021-03-23","day",null,"None","EUR","Rebtel Networks AB",null,"Art. 12(3), Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/imy-beslut-2021-03-23-dnr-di-2020-10561-rebtel-networks-ab.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-10561",null,"gdprhub",null,null,"rebtel networks ab",null,null,null,null,null,null,null,null,null],["2021/GR/017","ETid-626","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2021-03-22","day",2000,null,"EUR","Candidate for parliamentary elections","Public Sector and Education","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/sites/default/files/2021-04/7_2021anonym.pdf","https://www.enforcementtracker.com/ETid-626",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/SI/001","IP - 07121-1/2021/563","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-22","day",null,"None","EUR",null,null,"Art. 6(1)(f)","Unlawful processing",null,null,"https://www.ip-rs.si/mnenja-gdpr/skrito-snemanje-na-delovnem-mestu","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/563",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2021/NO/017","ETid-643","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-03-21","day",19900,null,"EUR","Basaren Drift AS","Accommodation and Hospitality","Art. 13, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/gebyr-til-basaren-drift-as/","https://www.enforcementtracker.com/ETid-643",null,null,null,null,"basaren drift as",null,null,null,null,null,null,null,null,null],["2021/PL/007","ETid-729","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-03-19","day",4900,null,"EUR","Funeda Sp. z o.o.","Finance, Insurance and Consulting","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/decyzje/DKE.561.25.2020","https://www.enforcementtracker.com/ETid-729","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.25.2020","gdprhub",null,null,"funeda spzoo",null,null,null,null,null,null,null,null,null],["2021/SI/003","IP - 07121-1/2021/400","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-19","day",null,"None","EUR",null,null,"Art. 4(15), Art. 9","Special categories",null,null,"https://www.ip-rs.si/mnenja-gdpr/nadaljnje-razkritje-na-blogu-objavljenega-zdravstvenega-podatka","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/400",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2021/SI/002","IP - 07121-1/2021/540","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-19","day",null,"None","EUR",null,null,"Art. 5(1)(c)","Data principles",null,null,"https://www.ip-rs.si/mnenja-gdpr/podatki-o-cepljenju-in-zdravstvenem-stanju-na-vlogi-za-vpis-otroka-v-vrtec","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/540",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/IS/017","Persónuvernd - 2020010710","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-03-19","day",null,"None","EUR","Reykjavík Health Inspectorate",null,"Art. 5, Art. 6(1)(c)","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/urskurdur-um-vinnslu-personuupplysinga-hja-heilbrigdiseftirliti-reykjavikur","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010710",null,"gdprhub",null,null,"IS: reykjavik health inspectorate",null,null,null,null,null,null,null,null,null],["2021/ES/151","ETid-604","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-18","day",3000,null,"EUR","Asesoría Alpi-Clúa S.L.","Finance, Insurance and Consulting","Art. 32(1), Art. 5(1)(f)","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00483-2020.pdf","https://www.enforcementtracker.com/ETid-604","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00483/2020","gdprhub",null,null,"asesoria alpi clua sl",null,null,null,null,null,null,null,null,null],["2021/NO/040","Datatilsynet (Norway) - 20/01777","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-03-17","day",null,"35000","NOK","Miljø- og Kvalitetsledelse AS",null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/en/news/2021/miljo--og-kvalitetsledelse-as-fined/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01777",null,"gdprhub",null,null,"milj og kvalitetsledelse as",null,35000.0,3458,"day 2021-03-17|10.1213|NOK",null,null,null,null,null],["2021/SI/005","IP - 07121-1/2021/517","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-17","day",null,"None","EUR",null,null,"Art. 55(3)",null,null,null,"https://www.ip-rs.si/mnenja-gdpr/vpogled-v-sodni-spis","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/517",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/BE/016","APD/GBA (Belgium) - 37/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-03-16","day",null,"None","EUR","Y representing Y1 (Defendant - Public body)",null,"Art. 25, Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(e)","Accountability, Data principles, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-37-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_37/2021",null,"gdprhub",null,null,"BE: y representing y1",null,null,null,null,null,null,null,null,null],["2021/ES/150","ETid-605","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-16","day",60000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00484-2020.pdf","https://www.enforcementtracker.com/ETid-605","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00484/2020","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/DE/053","BayLfD (Bavaria) - LDA-1085.1-12159/20-IDV","gdprhub","Germany","DE","BayLDA (Bavaria)","2021-03-15","day",null,"None","EUR","[...]",null,"Art. 77",null,null,"Violation found","https://gdprhub.eu/index.php?title=BayLDA_-_LDA-1085.1-12159/20-IDV#Original_Text","https://gdprhub.eu/index.php?title=BayLfD_%28Bavaria%29_-_LDA-1085.1-12159/20-IDV",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/036","Datatilsynet (Norway) - 20/02147","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-03-15","day",null,"50000","NOK","Alesund municipality",null,"Art. 24(1), Art. 32(1)(b), Art. 35, Art. 5","Accountability, DPIA, Data principles, Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/aceb0267e82e4404bd3e8b2e8987f458/vedtak-om-overtredelsesgebyr-ved-bruk-av-treningsappen-strava--alesund-kommune.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02147",null,"gdprhub",null,null,"NO: alesund municipality",null,50000.0,4951,"day 2021-03-15|10.0988|NOK",null,null,null,null,null],["2021/ES/154","ETid-597","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-15","day",5000,null,"EUR","Certime S.A.","Public Sector and Education","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00417-2020.pdf","https://www.enforcementtracker.com/ETid-597",null,null,null,null,"certime sa",null,null,null,null,null,null,null,null,null],["2021/BE/004","ETid-601","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2021-03-15","day",1000,null,"EUR","School","Public Sector and Education","Art. 5(1)(c), Art. 6(1), Art. 8","Consent, Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-36-2021.pdf","https://www.enforcementtracker.com/ETid-601",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/153","ETid-602","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-15","day",3000,null,"EUR","Cultural association","Individuals and Private Associations","Art. 6(1)(a)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00405-2020.pdf","https://www.enforcementtracker.com/ETid-602","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00405/2020","gdprhub",null,null,"ES: cultural association",null,null,null,null,null,null,null,null,null],["2021/ES/152","ETid-603","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-15","day",2000,null,"EUR","Heredad de Urueña S.A.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00375-2020.pdf","https://www.enforcementtracker.com/ETid-603",null,null,null,null,"heredad de uruena sa",null,null,null,null,null,null,null,null,null],["2021/NO/021","ETid-608","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-03-15","day",4900,null,"EUR","Ålesund Municipality","Public Sector and Education","Art. 24(1), Art. 32(1)(b), Art. 35","Accountability, DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/gebyr-til-alesund-kommune-for-bruk-av-strava/","https://www.enforcementtracker.com/ETid-608",null,null,null,null,"NO: alesund municipality",null,null,null,null,null,null,null,null,null],["2021/ES/148","ETid-609","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-15","day",600000,null,"EUR","Air Europa Lineas Aereas, SA.","Industry and Commerce","Art. 32(1), Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00179-2020.pdf","https://www.enforcementtracker.com/ETid-609","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00179/2020","gdprhub",null,null,"air europa lineas aereas sa",null,null,null,null,null,null,null,null,null],["2021/NO/019","ETid-627","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-03-15","day",100000,null,"EUR","Asker Municipality","Public Sector and Education","Art. 24, Art. 32(1)(b), Art. 5, Art. 6","Accountability, Data principles, Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/65e913da425949d985baf76849a5929b/vedtak-om-overtredelsesgebyr---asker-kommune.pdf","https://www.enforcementtracker.com/ETid-627","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01516","gdprhub",null,null,"NO: asker municipality",null,null,null,null,null,null,null,null,null],["2021/SI/012","IP - 0610-376/2020/35","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-15","day",null,"None","EUR","Ministry of Public Administration",null,"Art. 13(1), Art. 13(2), Art. 58(2)(a)","Transparency",null,"Violation found","https://gdprplanet.com/zacasna-odlocba-informacijskega-pooblascenca-o-zbiranju-prijavah-interesov-za-cepljenje-na-portalu-euprava-2/","https://gdprhub.eu/index.php?title=IP_-_0610-376/2020/35",null,"gdprhub",null,null,"SI: ministry of public administration",null,null,null,null,null,null,null,null,null],["2021/SI/014","IP - 07120-1/2021/182","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-15","day",null,"None","EUR",null,null,"Art. 6(1), Art. 9(1)","Special categories, Unlawful processing",null,null,"https://bit.ly/3algYns","https://gdprhub.eu/index.php?title=IP_-_07120-1/2021/182",null,"gdprhub",null,"Public body",null,null,null,null,null,null,null,null,null,null],["2021/SI/004","IP - N/A","gdprhub","Slovenia","SI","IP (Slovenia)","2021-03-15","day",null,"None","EUR",null,null,"Art. 13","Transparency",null,"Violation found","https://www.ip-rs.si/novice/zaupanje-ljudi-v-cepljenje-je-odvisno-tudi-od-jasnih-in-nedvoumnih-informacij-o-poteku-prijav-na-cepljenje-ter-zakonitega-zbiranja-kakršnihkoli-podatkov","https://gdprhub.eu/index.php?title=IP_-_N/A",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/HU/009","NAIH (Hungary) - NAIH-2894-3/2021","gdprhub","Hungary","HU","NAIH (Hungary)","2021-03-14","day",null,"10000000","HUF","Budapest Főváros Kormányhivatala XI. kerületi Hivatala",null,"Art. 32(1)(a), Art. 32(1)(b), Art. 32(2), Art. 33(1), Art. 34(1)","Data breach, Data security",null,"Violation found","https://www.naih.hu/hatarozatok-vegzesek/file/354-bfkh-xi-keruleti-hivatalanal-bekovetkezett-egeszsegugyi-adatokat-erinto-adatvedelmi-incidens-es-adatbiztonsagi-hianyossagok","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2894-3/2021",null,"gdprhub",null,null,"HU: budapest fovaros kormanyhivatala xi keruleti hivatala",null,10000000.0,27309,"day 2021-03-12|366.1800|HUF",null,null,null,null,null],["2021/ES/156","ETid-595","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-12","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00193-2020.pdf","https://www.enforcementtracker.com/ETid-595",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2021/ES/155","ETid-596","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-12","day",12000,null,"EUR","NBQ Technology, S.A.U.","Finance, Insurance and Consulting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00061-2021.pdf","https://www.enforcementtracker.com/ETid-596",null,null,null,null,"nbq technology sau",null,null,null,null,null,null,null,null,null],["2021/IS/013","Persónuvernd - 2020051606","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-03-12","day",null,"None","EUR","Akureyri Hospital",null,"Art. 32, Art. 5","Data principles, Data security",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-sjukrahussins-a-akureyri-vid-utsendingu-sjukraskyrslna","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020051606",null,"gdprhub",null,null,"IS: akureyri hospital",null,null,null,null,null,null,null,null,null],["2021/ES/157","ETid-594","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-11","day",8150000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 21, Art. 24, Art. 28, Art. 44","Accountability, Data subject rights, International transfers, Processor obligations","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00059-2020.pdf","https://www.enforcementtracker.com/ETid-594","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00059/2020","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/IT/056","ETid-647","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-11","day",3000,null,"EUR","Comune di San Marco in Lamis","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9578258","https://www.enforcementtracker.com/ETid-647",null,null,null,null,"IT: comune di san marco in lamis",null,null,null,null,null,null,null,null,null],["2021/NL/013","ETid-659","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2021-03-11","day",600000,null,"EUR","Municipality of Enschede","Public Sector and Education","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boetebesluit_ap_gemeente_enschede.pdf","https://www.enforcementtracker.com/ETid-659","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_11.03.2021","gdprhub",null,null,"NL: municipality of enschede",null,null,null,null,null,null,null,null,null],["2021/IT/055","ETid-660","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-11","day",15000,null,"EUR","Mediacom s.r.l.","Industry and Commerce","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9577065","https://www.enforcementtracker.com/ETid-660",null,null,null,null,"mediacom srl",null,null,null,null,null,null,null,null,null],["2021/IT/054","ETid-661","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-03-11","day",80000,null,"EUR","Planet Group Spa","Industry and Commerce","Art. 12(3), Art. 25(1), Art. 5(1)(a), Art. 6(1)","Accountability, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9577371","https://www.enforcementtracker.com/ETid-661",null,null,null,null,"planet group spa",null,null,null,null,null,null,null,null,null],["2021/CZ/001","ETid-2834","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-03-10","day",200,null,"EUR","Self Employed Person","Accommodation and Hospitality","Art. 13, Art. 14, Art. 15, Art. 22, Art. 6(1)","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/133-cj-uoou-0122021-4-dokument-c-133.pdf","https://www.enforcementtracker.com/ETid-2834",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/049","ETid-586","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2021-03-10","day",300000,null,"EUR","VfB Stuttgart 1893 AG","Individuals and Private Associations","Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/vfb-stuttgart-bussgeld-erlassen/","https://www.enforcementtracker.com/ETid-586",null,null,null,null,"vfb stuttgart 1893 ag",null,null,null,null,null,null,null,null,null],["2021/ES/161","ETid-587","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-10","day",10000,null,"EUR","Hospital Campogrande DE","Health Care","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00074-2020.pdf","https://www.enforcementtracker.com/ETid-587",null,null,null,null,"ES: hospital campogrande de",null,null,null,null,null,null,null,null,null],["2021/ES/160","ETid-588","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-10","day",8000,null,"EUR","Filigrana Comunicación S.L.U.","Media, Telecoms and Broadcasting","Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00136-2020.pdf","https://www.enforcementtracker.com/ETid-588","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00136/2020","gdprhub",null,null,"filigrana comunicacion slu",null,null,null,null,null,null,null,null,null],["2021/ES/159","ETid-592","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-10","day",50000,null,"EUR","Equifax Iberica S.L.","Finance, Insurance and Consulting","Art. 6(1)(f)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00406-2020.pdf","https://www.enforcementtracker.com/ETid-592","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00406/2020","gdprhub",null,null,"equifax iberica sl","Equifax",null,null,null,null,null,null,null,null],["2021/ES/158","ETid-593","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-10","day",90000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 17, Art. 32, Art. 5(1)(f)","Data principles, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00448-2020.pdf","https://www.enforcementtracker.com/ETid-593","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00448/2020","gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2021/IS/014","Persónuvernd - 2020010532","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-03-10","day",null,"None","EUR","Landsbankinn",null,"Art. 6(1)(c)","Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-hja-fjarmalastofnun-i-tengslum-vid-reidufjarvidskipti","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010532",null,"gdprhub",null,null,"landsbankinn hf",null,null,null,null,null,null,null,null,null],["2021/IS/016","Persónuvernd - 2020010577","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-03-10","day",null,"None","EUR","Wedo ehf.",null,"Art. 6(1)(a), Art. 7","Consent, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-um-heimilisfong-notenda-bland.is","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010577",null,"gdprhub",null,null,"wedo ehf",null,null,null,null,null,null,null,null,null],["2021/IS/015","Persónuvernd - 2020010604","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-03-10","day",null,"None","EUR",null,null,"Art. 12","Transparency",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-upplysinga-hja-logheimtunni-og-skraning-creditinfo-lanstrausts-a-upplysingum-um-umdeilda-skuld-a-vanskilaskra-talin","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010604",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/IS/011","Persónuvernd - 2020082122","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-03-10","day",null,"None","EUR","Icelandic National Police",null,"Art. 44","International transfers",null,"Violation found","https://www.personuvernd.is/urlausnir/mottaka-logreglu-a-upplysingum-i-gegnum-facebook","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020082122",null,"gdprhub",null,null,"IS: icelandic national police",null,null,null,null,null,null,null,null,null],["2021/ES/162","ETid-585","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-09","day",15000,null,"EUR","Homeowners Association","Real Estate","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00378-2019.pdf","https://www.enforcementtracker.com/ETid-585",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/037","Datatilsynet (Norway) - 20/01627","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-03-08","day",null,"150000","NOK","Dragefossen AS",null,"Art. 4(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/bb8618c1ce604468b3b478676bf196c5/vedtak-om-overtredelsesgebyr---dragefossen-as.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01627",null,"gdprhub",null,null,"dragefossen as",null,150000.0,14737,"day 2021-03-08|10.1785|NOK",null,null,null,null,null],["2021/NO/020","ETid-611","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-03-08","day",14900,null,"EUR","Dragefossen AS","Transportation and Energy","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/dragefossen-as-far-gebyr/","https://www.enforcementtracker.com/ETid-611",null,null,null,null,"dragefossen as",null,null,null,null,null,null,null,null,null],["2021/CY/011","Commissioner (Cyprus) - 1.17.001.007.270","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2021-03-04","day",null,"None","EUR","Cyprus Association of Automotive Engineer Assessors",null,"Art. 31, Art. 5(1)(a), Art. 6(1), Art. 9","Data principles, Special categories, Unlawful processing",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/E63EA89EE7CC4050C2258758003318BC/$file/1.%20%CE%91%CE%BD%CF%89%CE%BD%CF%85%CE%BC%CE%BF%CF%80%CE%BF%CE%B9%CE%B7%CE%BC%CE%AD%CE%BD%CE%B7%20%CE%91%CF%80%CF%8C%CF%86%CE%B1%CF%83%CE%B7%20%CE%A3%CF%85%CE%BD%CE%B4%CE%AD%CF%83%CE%BC%CE%BF%CF%85%20%CE%95%CE%BA%CF%84%CE%B9%CE%BC%CE%B7%CF%84%CF%8E%CE%BD.pdf?openelement&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=fr&_x_tr_pto=nui&_x_tr_sch=http","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_1.17.001.007.270",null,"gdprhub",null,null,"CY: cyprus association of automotive engineer assessors",null,null,null,null,null,null,null,null,null],["2021/RO/021","ETid-582","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-03-04","day",500,null,"EUR","Natural person holding the position of General Secretary for a political party in Bucharest","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_04_03_2021&lang=ro","https://www.enforcementtracker.com/ETid-582","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_04.03.2021","gdprhub",null,null,"RO: natural person holding the position of general secretary for a political party in bucharest",null,null,null,null,null,null,null,null,null],["2021/DE/050","ETid-575","cms_tracker","Germany","DE","Data Protection Authority of Sachsen-Anhalt","2021-03-03","day",null,null,"EUR",null,"Individuals and Private Associations","Art. 32, Art. 5","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://twitter.com/EinRobert1/status/1367163781508440066","https://www.enforcementtracker.com/ETid-575",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/CY/009","ETid-578","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-03-03","day",25000,null,"EUR","Hellenic Bank","Finance, Insurance and Consulting","Art. 33(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/B0CED3EDDC2EE5EDC225868D0037E7A4?OpenDocument","https://www.enforcementtracker.com/ETid-578",null,null,null,null,"CY: hellenic bank",null,null,null,null,null,null,null,null,null],["2021/CY/008","ETid-579","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-03-03","day",10000,null,"EUR","Cypriot Real Estate Registration Authority","Public Sector and Education","Art. 12, Art. 15, Art. 31, Art. 58(1)(e)","Data subject rights, Transparency","Insufficient fulfilment of information obligations","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/B0CED3EDDC2EE5EDC225868D0037E7A4?OpenDocument","https://www.enforcementtracker.com/ETid-579",null,null,null,null,"CY: cypriot real estate registration authority",null,null,null,null,null,null,null,null,null],["2021/CY/007","ETid-580","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-03-03","day",6000,null,"EUR","KEPIDES","Real Estate",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/B0CED3EDDC2EE5EDC225868D0037E7A4?OpenDocument","https://www.enforcementtracker.com/ETid-580",null,null,null,null,"CY: kepides",null,null,null,null,null,null,null,null,null],["2021/CY/006","ETid-581","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2021-03-03","day",40000,null,"EUR","Electricity Authority of Cyprus","Employment","Art. 6(1), Art. 9(2)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/B0CED3EDDC2EE5EDC225868D0037E7A4?OpenDocument","https://www.enforcementtracker.com/ETid-581",null,null,null,null,"CY: electricity authority of cyprus",null,null,null,null,null,null,null,null,null],["2021/NO/022","ETid-573","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-03-02","day",24400,null,"EUR",null,"Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/far-gebyr-for-ulovleg-vidaresending-av-e-post/","https://www.enforcementtracker.com/ETid-573","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01916","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/164","ETid-574","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-02","day",9000,null,"EUR",null,null,"Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00279-2020.pdf","https://www.enforcementtracker.com/ETid-574",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/LT/003","ETid-576","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2021-03-02","day",15000,null,"EUR","Registrų Centras","Public Sector and Education",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/Registru%20centras%20(viesasis)%202021.pdf","https://www.enforcementtracker.com/ETid-576",null,null,null,null,"LT: registru centras",null,null,null,null,null,null,null,null,null],["2021/ES/163","ETid-577","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-03-02","day",200000,null,"EUR","I-DE Redes Eléctricas Inteligentes, S.A.U","Media, Telecoms and Broadcasting","Art. 6(1)(b)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00197-2020.pdf","https://www.enforcementtracker.com/ETid-577","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00197/2020","gdprhub",null,null,"i de redes electricas inteligentes sau",null,null,null,null,null,null,null,null,null],["2021/GB/022","ICO (UK) - First Choice Selection Services Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-03-02","day",null,"None","EUR","First Choice Selection Services Limited",null,"Art. 15","Data subject rights",null,"Violation found","https://ico.org.uk/action-weve-taken/enforcement/first-choice-selection-services-limited/","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_First_Choice_Selection_Services_Limited",null,"gdprhub",null,null,"first choice selection services ltd",null,null,null,null,null,null,null,null,null],["2021/GB/027","ICO - Leads Work Limited (Monetary Penalty)","gdprhub","United Kingdom","GB","ICO (UK)","2021-03-01","day",null,"250000","GBP","Leads Work Limited",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619378/leads-work-limited-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_-_Leads_Work_Limited_%28Monetary_Penalty%29",null,"gdprhub",null,null,"leads work ltd",null,250000.0,288824,"day 2021-03-01|0.8656|GBP",null,null,null,null,null],["2021/GB/025","ICO - Monetary penalty Leads Work Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-03-01","day",null,"250000","GBP","Leads Work Limited",null,"Art. 4(11), Art. 6(1)(a), Art. 7(1), Art. 7(2)","Consent, Unlawful processing",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619378/leads-work-limited-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_-_Monetary_penalty_Leads_Work_Limited",null,"gdprhub",null,null,"leads work ltd",null,250000.0,288824,"day 2021-03-01|0.8656|GBP",null,null,null,null,null],["2021/IS/012","Persónuvernd - 2020010724","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-03-01","day",null,"None","EUR","Icelandic National Police",null,null,null,null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-af-halfu-logreglu-med-notkun-hljod-og-myndupptokubunads-i-logreglubifreidum","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010724",null,"gdprhub",null,null,"IS: icelandic national police",null,null,null,null,null,null,null,null,null],["2021/LT/005","ETid-571","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2021-02-26","day",12000,null,"EUR","Nacionaliniam visuomenės sveikatos centrui (NVSC)","Public Sector and Education","Art. 13, Art. 24, Art. 32, Art. 35, Art. 58(2)(f)","Accountability, DPIA, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/Programele%20Karantinas%20(viesasis%2C%20privatusis)%202021.pdf","https://www.enforcementtracker.com/ETid-571",null,null,null,null,"LT: nacionaliniam visuomenes sveikatos centrui",null,null,null,null,null,null,null,null,null],["2021/LT/004","ETid-572","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2021-02-26","day",3000,null,"EUR","IT sprendimai sėkmei","Industry and Commerce","Art. 13, Art. 24, Art. 32, Art. 35, Art. 58(2)(f)","Accountability, DPIA, Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/Programele%20Karantinas%20(viesasis%2C%20privatusis)%202021.pdf","https://www.enforcementtracker.com/ETid-572",null,null,null,null,"LT: it sprendimai sekmei",null,null,null,null,null,null,null,null,null],["2021/SI/006","IP - 0610–643/2020/5","gdprhub","Slovenia","SI","IP (Slovenia)","2021-02-26","day",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,"Violation found","https://gdprplanet.com/snemanje-dijaka-s-tehnologijo-prepoznave-obraza-in-prostora-med-opravljanjem-izpita-sklep-o-ustavitvi-po-zin/","https://gdprhub.eu/index.php?title=IP_-_0610%E2%80%93643/2020/5",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2021/ES/186","AEPD (Spain) - PS/00128/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-02-25","day",null,"None","EUR",null,null,"Art. 13, Art. 4(13), Art. 6(1)(b), Art. 83(5)(b), Art. 9(2)(b)","Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00128-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00128/2020",null,"gdprhub",null,"Local council",null,null,null,null,null,null,null,null,null,null],["2021/IT/069","ETid-591","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-25","day",null,null,"EUR","Istituto Nazionale Previdenza Sociale (INPS)","Public Sector and Education","Art. 25, Art. 35","Accountability, DPIA, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9556958","https://www.enforcementtracker.com/ETid-591","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9556958","gdprhub",null,null,"IT: istituto nazionale previdenza sociale",null,null,null,null,null,"annulled","The Garante removed this decision from its website after a final court judgment against it.","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9556958",300000],["2021/IT/066","ETid-610","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-25","day",2000,null,"EUR","Comune di Conflenti","Employment","Art. 6(2), Art. 6(3)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9565258","https://www.enforcementtracker.com/ETid-610",null,null,null,null,"IT: comune di conflenti",null,null,null,null,null,null,null,null,null],["2021/IT/065","ETid-614","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-25","day",6000,null,"EUR","Comune di Commezzadura","Employment","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9567429","https://www.enforcementtracker.com/ETid-614",null,null,null,null,"IT: comune di commezzadura",null,null,null,null,null,null,null,null,null],["2021/IT/063","ETid-616","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-25","day",20000,null,"EUR","Gedi Gruppo Editoriale S.p.A.","Media, Telecoms and Broadcasting","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9568244","https://www.enforcementtracker.com/ETid-616",null,null,null,null,"gedi gruppo editoriale spa",null,null,null,null,null,null,null,null,null],["2021/IT/060","ETid-619","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-25","day",4000,null,"EUR","Ministero dell’Istruzione, Ufficio Scolastico Regionale per il Lazio","Public Sector and Education","Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9565218","https://www.enforcementtracker.com/ETid-619",null,null,null,null,"IT: ministero dellistruzione ufficio scolastico regionale per il lazio",null,null,null,null,null,null,null,null,null],["2021/IT/057","ETid-629","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-25","day",6000,null,"EUR","Azienda Ospedaliera Universitaria Careggi","Health Care","Art. 5, Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9574789","https://www.enforcementtracker.com/ETid-629",null,null,null,null,"IT: azienda ospedaliera universitaria careggi",null,null,null,null,null,null,null,null,null],["2021/ES/165","ETid-567","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-24","day",12000,null,"EUR","Avilon Center 2016 S.L.","Media, Telecoms and Broadcasting","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00502-2020.pdf","https://www.enforcementtracker.com/ETid-567","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00502/2020","gdprhub",null,null,"avilon center 2016 sl",null,null,null,null,null,null,null,null,null],["2021/CZ/012","ETid-2797","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-02-23","day",1200,null,"EUR","Legal Person",null,"Art. 17(1)(c)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/163-cj-uoou-0369220-7-dokument-c-163.pdf","https://www.enforcementtracker.com/ETid-2797",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/052","ETid-98","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021-02-23","day",900000,null,"EUR","Deutsche Wohnen SE","Real Estate","Art. 25, Art. 5","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191105-PM-Bussgeld_DW.pdf","https://www.enforcementtracker.com/ETid-98",null,null,null,null,"deutsche wohnen se",null,null,null,null,null,null,null,null,null],["2021/AT/016","DSB (Austria) - 2021-0.119.956","gdprhub","Austria","AT","DSB (Austria)","2021-02-22","day",null,null,null,"City of Vienna",null,"Art. 15(1), Art. 15(2), Art. 15(3), Art. 5(1)(e), Art. 51(1), Art. 57(1)(f), Art. 77(1), Art. 9","Data principles, Data subject rights, Special categories",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210222_2021_0_119_956_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.119.956",null,"gdprhub",null,null,"AT: city of vienna",null,null,null,null,null,null,null,null,null],["2021/HR/003","ETid-566","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2021-02-22","day",null,null,"EUR",null,"Industry and Commerce",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://azop.hr/izdana-nova-upravna-novcana-kazna/","https://www.enforcementtracker.com/ETid-566","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_22-02-2021","gdprhub",null,"Security company",null,null,null,null,null,null,null,null,null,null],["2021/ES/183","AEPD (Spain) - PS/00054/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-02-19","day",null,"None","EUR",null,null,"Art. 13, Art. 5(1)(c)","Data principles, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00054-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00054/2020",null,"gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/IS/009","Persónuvernd - 2020051637","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-02-19","day",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-hja-sjukratryggingum-islands","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020051637",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2021/GB/026","ICO - Monetary penalty Valca Vehicle Ltd","gdprhub","United Kingdom","GB","ICO (UK)","2021-02-18","day",null,"80000","GBP","Valca Vehicle and Life Cover Agency Limited",null,"Art. 6(1)(a), Art. 7(1)","Consent, Unlawful processing",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619319/valca-mpn-20200218.pdf","https://gdprhub.eu/index.php?title=ICO_-_Monetary_penalty_Valca_Vehicle_Ltd",null,"gdprhub",null,null,"valca vehicle and life cover agency ltd",null,80000.0,92443,"day 2021-02-18|0.8654|GBP",null,null,null,null,null],["2021/FI/009","Tietosuojavaltuutetun toimisto (Finland) - 8314/182/20","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-02-18","day",null,"None","EUR","Suomen Asiakastieto Oy",null,"Art. 5","Data principles",null,null,"https://finlex.fi/fi/viranomaiset/tsv/2021/20210783#OT2","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8314/182/20",null,"gdprhub",null,null,"suomen asiakastieto oy",null,null,null,null,null,null,null,null,null],["2021/ES/184","AEPD (Spain) - PS/00040/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-02-17","day",null,"None","EUR","AYUNTAMIENTO DE GATA",null,"Art. 15","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00040-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00040/2020",null,"gdprhub",null,null,"ES: ayuntamiento de gata",null,null,null,null,null,null,null,null,null],["2021/BE/014","APD/GBA (Belgium) - 24/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-02-17","day",null,"None","EUR","Defendant : Westtoer APB a public entity giving autonomous services in the area of tourism in the province of West -Flanders.",null,"Art. 12, Art. 13, Art. 25, Art. 30, Art. 35(2), Art. 35(7), Art. 38, Art. 6, Art. 7(1), Art. 7(3)","Accountability, Consent, DPIA, Data protection officer, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-24-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_24/2021",null,"gdprhub",null,null,"BE: defendant westtoer apb a public entity giving autonomous services in the area of tourism in the province of west flanders",null,null,null,null,null,null,null,null,null],["2021/GR/026","HDPA (Greece) - 13/2021","gdprhub","Greece","GR","HDPA (Greece)","2021-02-17","day",20000,"20000","EUR",null,null,"Art. 12(3), Art. 17, Art. 21, Art. 25(1)","Accountability, Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/sites/default/files/2021-04/13_2021anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_13/2021",null,"gdprhub",null,"Sports clothing company",null,null,null,null,null,null,null,null,null,null],["2021/ES/167","ETid-557","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-16","day",1000,null,"EUR","The Washpoint S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00469-2019.pdf","https://www.enforcementtracker.com/ETid-557",null,null,null,null,"the washpoint sl",null,null,null,null,null,null,null,null,null],["2021/IS/010","Persónuvernd - 2020031337","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2021-02-16","day",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vardveisla-personuupplysinga-hja-opinberri-stofnun","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020031337",null,"gdprhub",null,"Public institution",null,null,null,null,null,null,null,null,null,null],["2021/AT/011","DSB (Austria) - 2021-0.101.211","gdprhub","Austria","AT","DSB (Austria)","2021-02-15","day",null,"None","EUR","N*** Ärztezentrum-Dr. U*** & Co GmbH",null,"Art. 4(15), Art. 6(1)(c), Art. 9","Special categories, Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210215_2021_0_101_211_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.101.211",null,"gdprhub",null,null,"n arztezentrum dr u and co gmbh",null,null,null,null,null,null,null,null,null],["2021/BE/012","APD/GBA (Belgium) - 19/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-02-12","day",null,"None","EUR","Telenet",null,"Art. 12, Art. 13, Art. 14, Art. 21(2), Art. 32, Art. 7(3)","Consent, Data security, Data subject rights, Transparency",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-19-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_19/2021",null,"gdprhub",null,null,"BE: telenet",null,null,null,null,null,null,null,null,null],["2021/DK/011","ETid-22","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2021-02-12","day",13450,null,"EUR","IDdesign A / S","Industry and Commerce","Art. 5(1)(e), Art. 5(2)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2019/jun/tilsyn-med-iddesigns-behandling-af-personoplysninger/","https://www.enforcementtracker.com/ETid-22",null,null,null,null,"iddesign as",null,null,null,null,null,null,null,null,null],["2021/ES/168","ETid-554","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-12","day",120000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00430-2020.pdf","https://www.enforcementtracker.com/ETid-554","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00430/2020","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/ES/166","ETid-565","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-12","day",1600,null,"EUR","Ripobruna 207, S.L.","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00191-2020.pdf","https://www.enforcementtracker.com/ETid-565","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00191/2020","gdprhub",null,null,"ripobruna 207 sl",null,null,null,null,null,null,null,null,null],["2021/AT/005","ETid-951","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021-02-12","day",3000,null,"EUR",null,null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20210212_2020_0_582_166_00/DSBT_20210212_2020_0_582_166_00.html","https://www.enforcementtracker.com/ETid-951",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/169","ETid-549","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-11","day",24000,null,"EUR","Vamavi Phone S.L.","Media, Telecoms and Broadcasting","Art. 21, Art. 28","Data subject rights, Processor obligations","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00026-2021.pdf","https://www.enforcementtracker.com/ETid-549","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00026/2021","gdprhub",null,null,"vamavi phone sl",null,null,null,null,null,null,null,null,null],["2021/NL/014","ETid-555","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2021-02-11","day",440000,null,"EUR","OLVG","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/nl/nieuws/ziekenhuis-olvg-beboet-om-onvoldoende-beveiliging-medische-dossiers","https://www.enforcementtracker.com/ETid-555","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_26.11.2020","gdprhub",null,null,"NL: olvg",null,null,null,null,null,null,null,null,null],["2021/PL/012","ETid-564","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-02-11","day",22200,null,"EUR","Krajowa Szkoła Sądownictwa i Prokuratury","Public Sector and Education","Art. 25(1), Art. 28(3), Art. 5(1)(f)","Accountability, Data principles, Data security, Processor obligations","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5130.2024.2020","https://www.enforcementtracker.com/ETid-564","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5130.2024.2020","gdprhub",null,null,"PL: krajowa szkoa sadownictwa i prokuratury",null,null,null,null,null,null,null,null,null],["2021/IT/068","ETid-599","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-11","day",75000,null,"EUR","Ministero dello Sviluppo Economico","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9556625","https://www.enforcementtracker.com/ETid-599","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9556625","gdprhub",null,null,"IT: ministero dello sviluppo economico",null,null,null,null,null,null,null,null,null],["2021/IT/064","ETid-615","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-11","day",5000,null,"EUR","Fondazione di religione e di culto “Casa sollievo della sofferenza” Opera di San Pio da Pietrelcina","Individuals and Private Associations","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9567489","https://www.enforcementtracker.com/ETid-615",null,null,null,null,"IT: fondazione di religione e di culto casa sollievo della sofferenza opera di san pio da pietrelcina",null,null,null,null,null,null,null,null,null],["2021/IT/062","ETid-617","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-11","day",350000,null,"EUR","Roma Capitale","Public Sector and Education","Art. 28, Art. 32, Art. 5, Art. 6","Data principles, Data security, Processor obligations, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9562852","https://www.enforcementtracker.com/ETid-617",null,null,null,null,"IT: roma capitale",null,null,null,null,null,null,null,null,null],["2021/IT/061","ETid-618","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-11","day",60000,null,"EUR","Roma Servizi per La Mobilita S.r.l.","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9562831","https://www.enforcementtracker.com/ETid-618",null,null,null,null,"roma servizi per la mobilita srl",null,null,null,null,null,null,null,null,null],["2021/IT/058","ETid-625","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-02-11","day",45000,null,"EUR","Istituti ospedalieri bergamaschi","Health Care","Art. 32, Art. 9","Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9561792","https://www.enforcementtracker.com/ETid-625",null,null,null,null,"IT: istituti ospedalieri bergamaschi",null,null,null,null,null,null,null,null,null],["2021/RO/022","ETid-550","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2021-02-10","day",1000,null,"EUR","ING Bank N.V. Amsterdam - Bucharest office","Finance, Insurance and Consulting","Art. 29","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_10_/_02_/_21&lang=ro","https://www.enforcementtracker.com/ETid-550","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_ING_Bank_N.V._Amsterdam_%E2%80%93_Bucharest_Branch_%282%29","gdprhub",null,null,"ing bank nv amsterdam bucharest office","ING",null,null,null,null,null,null,null,null],["2021/SE/009","IMY (Sweden) - DI-2020-2719","gdprhub","Sweden","SE","IMY (Sweden)","2021-02-10","day",null,"2500000","SEK","Polismyndigheten",null,null,null,null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/beslut-tillsyn-polismyndigheten-cvai.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-2719",null,"gdprhub",null,null,"SE: polismyndigheten",null,2500000.0,248016,"day 2021-02-10|10.0800|SEK",null,null,null,null,null],["2021/SI/007","IP - 0611-762/2020/8","gdprhub","Slovenia","SI","IP (Slovenia)","2021-02-10","day",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,"Violation found","https://gdprplanet.com/podatek-o-registrski-stevilki-avtomobila-sklep-o-ustavitvi-po-zin/","https://gdprhub.eu/index.php?title=IP_-_0611-762/2020/8",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2021/BE/013","APD/GBA (Belgium) - 15/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-02-09","day",null,"None","EUR",null,null,"Art. 15(1), Art. 15(3), Art. 24, Art. 32, Art. 5(2)","Accountability, Data principles, Data security, Data subject rights",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-15-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_15/2021",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2021/ES/170","ETid-548","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-09","day",5000,null,"EUR","Predase Servicios Integrales S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00062-2020.pdf","https://www.enforcementtracker.com/ETid-548","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00062/2020","gdprhub",null,null,"predase servicios integrales sl",null,null,null,null,null,null,null,null,null],["2021/LV/001","ETid-553","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2021-02-09","day",65000,null,"EUR","Lursoft IT SIA","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dvi.gov.lv/lv/zinas/datu-valsts-inspekcija-internetveikalam-piemero-eur-15-000-naudas-sodu/","https://www.enforcementtracker.com/ETid-553",null,null,null,null,"lursoft it sia",null,null,null,null,null,null,null,null,null],["2021/ES/172","ETid-546","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-08","day",3000,null,"EUR","Patio Ancestral S.L.","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00440-2020.pdf","https://www.enforcementtracker.com/ETid-546",null,null,null,null,"patio ancestral sl",null,null,null,null,null,null,null,null,null],["2021/ES/171","ETid-547","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-08","day",5000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00253-2020.pdf","https://www.enforcementtracker.com/ETid-547","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00253/2020","gdprhub",null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2021/FI/010","Tietosuojavaltuutetun toimisto (Finland) - 6609/163/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-02-08","day",null,"None","EUR",null,null,"Art. 25(2), Art. 5(1)(c), Art. 58(2)(d)","Accountability, Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20210743#OT6","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6609/163/19",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/173","ETid-545","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-04","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00270-2020.pdf","https://www.enforcementtracker.com/ETid-545",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2021/NL/015","ETid-725","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2021-02-04","day",12000,null,"EUR","Orthodontic Clinic","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boete_orthodontiepraktijk.pdf","https://www.enforcementtracker.com/ETid-725","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_4.02.2021","gdprhub",null,null,"NL: orthodontic clinic",null,null,null,null,null,null,null,null,null],["2021/NO/023","ETid-540","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-02-03","day",19300,null,"EUR","Cyberbook AS","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/cyberbook-as-far-gebyr/","https://www.enforcementtracker.com/ETid-540",null,null,null,null,"cyberbook as",null,null,null,null,null,null,null,null,null],["2021/ES/174","ETid-544","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-03","day",100000,null,"EUR","Iberdrola Clientes","Transportation and Energy","Art. 17, Art. 5(1)(d)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00220-2020.pdf","https://www.enforcementtracker.com/ETid-544","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00220/2020","gdprhub",null,null,"ES: iberdrola clientes","Iberdrola",null,null,null,null,null,null,null,null],["2021/AT/012","DSB (Austria) - 2021-0.024.862","gdprhub","Austria","AT","DSB (Austria)","2021-02-02","day",null,"None","EUR",null,null,"Art. 13(1), Art. 13(2), Art. 35(1), Art. 35(7)(d), Art. 36(1), Art. 36(3)(e), Art. 6(1)(f)","DPIA, Transparency, Unlawful processing",null,null,"https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20210202_2021_0_024_862_00/DSBT_20210202_2021_0_024_862_00.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2021-0.024.862",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/034","Datatilsynet (Norway) - 20/02379","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-02-02","day",null,"None","EUR","Bergens Tidende",null,"Art. 85",null,null,"Rejected","https://pvn.no/node/567","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02379",null,"gdprhub",null,null,"NO: bergens tidende",null,null,null,null,null,null,null,null,null],["2021/CZ/010","ETid-2799","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-02-02","day",400,null,"EUR","Legal Person","Industry and Commerce","Art. 17(1)(c)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/154-cj-uoou-0305820-21-dokument-c-154.pdf","https://www.enforcementtracker.com/ETid-2799",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/CZ/011","ETid-2798","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-02-01","day",80,null,"EUR","Legal Person",null,"Art. 17(1)(c)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/161-cj-uoou-0358020-14-dokument-c-161.pdf","https://www.enforcementtracker.com/ETid-2798",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/176","ETid-541","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-01","day",24000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 58(2)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00433-2020.pdf","https://www.enforcementtracker.com/ETid-541",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2021/ES/175","ETid-542","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-02-01","day",3000,null,"EUR","IDFINANCE Spain, S.L.","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00335-2020.pdf","https://www.enforcementtracker.com/ETid-542",null,null,null,null,"idfinance spain sl",null,null,null,null,null,null,null,null,null],["2021/IT/007","ETid-1278","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-27","day",10000,null,"EUR","City of Rome (Roma capitale)","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9556172","https://www.enforcementtracker.com/ETid-1278",null,null,null,null,"IT: city of rome",null,null,null,null,null,null,null,null,null],["2021/FR/012","ETid-535","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-01-27","day",150000,null,"EUR",null,"Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnil.fr/fr/credential-stuffing-la-cnil-sanctionne-un-responsable-de-traitement-et-son-sous-traitant","https://www.enforcementtracker.com/ETid-535",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/FR/011","ETid-536","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-01-27","day",75000,null,"EUR",null,"Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnil.fr/fr/credential-stuffing-la-cnil-sanctionne-un-responsable-de-traitement-et-son-sous-traitant","https://www.enforcementtracker.com/ETid-536",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/BE/005","ETid-537","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2021-01-27","day",50000,null,"EUR","Family Service / N.D.P.K. nv.","Industry and Commerce","Art. 13, Art. 24, Art. 25, Art. 28, Art. 5, Art. 6, Art. 7","Accountability, Consent, Data principles, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-04-2021.pdf","https://www.enforcementtracker.com/ETid-537","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_04/2021","gdprhub",null,null,"family service ndpk nv",null,null,null,null,null,null,null,null,null],["2021/IT/074","ETid-559","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-27","day",50000,null,"EUR","Azienda USL della Romagna","Health Care","Art. 32(1)(b), Art. 9","Data principles, Data security, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9544504","https://www.enforcementtracker.com/ETid-559","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9544504","gdprhub",null,null,"IT: azienda usl della romagna",null,null,null,null,null,null,null,null,null],["2021/IT/073","ETid-560","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-27","day",50000,null,"EUR","Azienda Ospedaliero Universitaria Senese","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9544457","https://www.enforcementtracker.com/ETid-560",null,null,null,null,"IT: azienda ospedaliero universitaria senese",null,null,null,null,null,null,null,null,null],["2021/IT/072","ETid-561","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-27","day",10000,null,"EUR","Azienda Ospedaliero Universitaria di Parma","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9544092","https://www.enforcementtracker.com/ETid-561",null,null,null,null,"IT: azienda ospedaliero universitaria di parma",null,null,null,null,null,null,null,null,null],["2021/IT/078","Garante per la protezione dei dati personali (Italy) - 9547248","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-01-27","day",null,"None","EUR","Barclays Bank Plc",null,"Art. 17(1)(a), Art. 57(1)(u), Art. 58(2), Art. 58(2)(b), Art. 77, Art. 78","Data subject rights",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9547248","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9547248",null,"gdprhub",null,null,"barclays bank plc",null,null,null,null,null,null,null,null,null],["2021/GB/024","ICO - Rancom Security Limited","gdprhub","United Kingdom","GB","ICO (UK)","2021-01-27","day",null,"110000","GBP","Rancom Security Limited",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2619141/rancom-security-limited-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_-_Rancom_Security_Limited",null,"gdprhub",null,null,"rancom security ltd",null,110000.0,124441,"day 2021-01-27|0.8840|GBP",null,null,null,null,null],["2021/DK/012","Datatilsynet (Denmark) - 2020-432-0034","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2021-01-26","day",null,"None","EUR","IT University of Copenhagen",null,"Art. 32, Art. 35, Art. 5, Art. 5(1)(f), Art. 6(1)","DPIA, Data principles, Data security, Unlawful processing",null,"Rejected","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2021/jan/universitets-brug-af-tilsynsprogram-ved-online-eksamen#_ftn2","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-432-0034",null,"gdprhub",null,null,"DK: it university of copenhagen",null,null,null,null,null,null,null,null,null],["2021/NO/032","Datatilsynet (Norway) - 20/02136 (notification)","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-01-24","day",null,"100000000","NOK","Grindr, LLC",null,"Art. 51(1), Art. 58(2)(i), Art. 6(1), Art. 9(1)","Special categories, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/contentassets/da7652d0c072493c84a4c7af506cf293/advance-notification-of-an-administrative-fine.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02136_%28notification%29",null,"gdprhub",null,null,"grindr llc",null,100000000.0,9679792,"day 2021-01-22|10.3308|NOK",null,null,null,null,null],["2021/BE/006","ETid-533","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2021-01-22","day",25000,null,"EUR",null,"Media, Telecoms and Broadcasting","Art. 24, Art. 32, Art. 34(1)","Accountability, Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-05-2021.pdf","https://www.enforcementtracker.com/ETid-533",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/IT/077","Garante per la protezione dei dati personali (Italy) - 9524194","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2021-01-22","day",null,"None","EUR","TikTok",null,"Art. 58(2)(f), Art. 66(1)",null,null,"Violation found","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9524194","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9524194",null,"gdprhub",null,null,"IT: tiktok","TikTok (ByteDance)",null,null,null,null,null,null,null,null],["2021/SE/008","IMY (Sweden) - DI-2020-10538","gdprhub","Sweden","SE","IMY (Sweden)","2021-01-22","day",null,"None","EUR",null,null,"Art. 12(3)","Transparency",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/2021-01-22-beslut-tillsyn-maginteractive.pdf","https://gdprhub.eu/index.php?title=IMY_%28Sweden%29_-_DI-2020-10538",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/FI/026","Tietosuojavaltuutetun toimisto (Finland) - 9209/157/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-01-22","day",null,"None","EUR",null,null,"Art. 12(4), Art. 17(3), Art. 21(2), Art. 21(3), Art. 25(2), Art. 58(2)(b)","Accountability, Data subject rights, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2021/20210724","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_9209/157/2019",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/178","ETid-529","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-01-21","day",50000,null,"EUR","Alterna Operador Integral S.L.","Transportation and Energy","Art. 6(1)(b)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00232-2020.pdf","https://www.enforcementtracker.com/ETid-529","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00232/2020","gdprhub",null,null,"alterna operador integral sl",null,null,null,null,null,null,null,null,null],["2021/ES/177","ETid-534","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-01-21","day",75000,null,"EUR","Telefónica Móviles España, SAU","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00235-2020.pdf","https://www.enforcementtracker.com/ETid-534",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2021/CZ/014","ETid-2790","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-01-20","day",11430,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/172-cj-uoou-0522520-21-dokument-c-172.pdf","https://www.enforcementtracker.com/ETid-2790",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/CZ/013","ETid-2792","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-01-20","day",26710,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/170-cj-uoou-0522420-31-dokument-c-170.pdf","https://www.enforcementtracker.com/ETid-2792",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/179","ETid-528","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-01-20","day",1200,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00215-2020.pdf","https://www.enforcementtracker.com/ETid-528",null,null,null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2021/ES/204","AEPD (Spain) - PS/00268/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-01-19","day",2000,"2000","EUR","The Washpoint SL",null,"Art. 13","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00268-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00268/2020",null,"gdprhub",null,null,"the washpoint sl",null,null,null,null,null,null,null,null,null],["2021/CZ/003","ETid-2826","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-01-19","day",1200,null,"EUR","Legal Person",null,"Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/124-cj-uoou-0020119-12-dokument-c-124.pdf","https://www.enforcementtracker.com/ETid-2826",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/NO/024","ETid-530","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-01-19","day",9700,null,"EUR","Aquateknikk AS","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/c5f433a97050467497810b9e891d5b83/vedtak-om-palegg-og-overtredelsesgebyr---aquateknikk-as.pdf","https://www.enforcementtracker.com/ETid-530",null,null,null,null,"aquateknikk as",null,null,null,null,null,null,null,null,null],["2021/NO/033","Datatilsynet (Norway) - 20/02162","gdprhub","Norway","NO","Datatilsynet (Norway)","2021-01-18","day",null,"200000","NOK","CyberBook AS",null,"Art. 13, Art. 17(1)(e), Art. 21, Art. 24, Art. 6(1)(f)","Accountability, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/cyberbook-as-far-gebyr/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02162",null,"gdprhub",null,null,"cyberbook as",null,200000.0,19257,"day 2021-01-18|10.3858|NOK",null,null,null,null,null],["2021/PL/011","ETid-583","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-01-15","day",4600,null,"EUR","Anwara Sp. z.o.o.","Public Sector and Education","Art. 31, Art. 58(1)(a)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.16.2020","https://www.enforcementtracker.com/ETid-583","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.16.2020","gdprhub",null,null,"anwara spzoo",null,null,null,null,null,null,null,null,null],["2021/FI/008","Tietosuojavaltuutetun toimisto (Finland) - 6689/186/20","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2021-01-15","day",null,"None","EUR","Helsingin kaupunki (City of Helsinki)",null,"Art. 5(1), Art. 6","Data principles, Unlawful processing",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200703","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6689/186/20",null,"gdprhub",null,null,"FI: helsingin kaupunki",null,null,null,null,null,null,null,null,null],["2021/ES/201","AEPD (Spain) - PS/00264/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-01-14","day",null,"None","EUR","Asociación de Afectados por las Asociaciones de Consumidores",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00264-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00264/2020",null,"gdprhub",null,null,"ES: asociacion de afectados por las asociaciones de consumidores",null,null,null,null,null,null,null,null,null],["2021/ES/200","AEPD (Spain) - PS/00273/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-01-14","day",1000,"1000","EUR",null,null,"Art. 17","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00273-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00273/2020",null,"gdprhub",null,"Beauty salon",null,null,null,null,null,null,null,null,null,null],["2021/LV/002","DVI (Latvia) - SIA “Lursoft IT”","gdprhub","Latvia","LV","DVI (Latvia)","2021-01-14","day",65000,"65000","EUR","SIA “Lursoft IT”",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(e), Art. 6(1)(f), Art. 6(3)","Data principles, Unlawful processing",null,"Violation found","https://www.dvi.gov.lv/sites/dvi/files/media_file/dvi_lursoft_izraksts.pdf","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_%E2%80%9CLursoft_IT%E2%80%9D",null,"gdprhub",null,null,"lursoft it sia",null,null,null,null,null,null,null,null,null],["2021/NO/025","ETid-525","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-01-14","day",38600,null,"EUR","Coop Finnmark SA","Industry and Commerce","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/5cd2e76bd5d2481f9578ffe721b7e24d/vedtak-om-overtredelsesgebyr-til-coop-finnmark-sa.pdf","https://www.enforcementtracker.com/ETid-525","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01790","gdprhub",null,null,"coop finnmark sa",null,null,null,null,null,null,null,null,null],["2021/IT/076","ETid-556","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-14","day",8000,null,"EUR","Agenzia regionale protezione ambientale Campania (ARPAC)","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9538748","https://www.enforcementtracker.com/ETid-556",null,null,null,null,"IT: agenzia regionale protezione ambientale campania",null,null,null,null,null,null,null,null,null],["2021/IT/075","ETid-558","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-14","day",30000,null,"EUR","Azienda sanitaria provinciale di Enna","Employment","Art. 5(1)(a), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9542071","https://www.enforcementtracker.com/ETid-558",null,null,null,null,"IT: azienda sanitaria provinciale di enna",null,null,null,null,null,null,null,null,null],["2021/IT/071","ETid-562","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-14","day",2000,null,"EUR","Poliambulatorio Talenti S.r.l.","Health Care","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9542096","https://www.enforcementtracker.com/ETid-562","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9542096","gdprhub",null,null,"poliambulatorio talenti srl",null,null,null,null,null,null,null,null,null],["2021/IT/070","ETid-563","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-14","day",18000,null,"EUR","Azienda Usl di Bologna","Health Care","Art. 5(1)(f), Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9542155","https://www.enforcementtracker.com/ETid-563",null,null,null,null,"IT: azienda usl di bologna",null,null,null,null,null,null,null,null,null],["2021/IT/067","ETid-600","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2021-01-14","day",75000,null,"EUR","Regione Lazio","Public Sector and Education","Art. 28, Art. 5(2)","Data principles, Processor obligations","Insufficient data processing agreement","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9542113","https://www.enforcementtracker.com/ETid-600",null,null,null,null,"IT: regione lazio",null,null,null,null,null,null,null,null,null],["2021/BE/009","APD/GBA (Belgium) - 03/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-01-13","day",null,"None","EUR",null,null,"Art. 24(1), Art. 24(2), Art. 25(1), Art. 25(2), Art. 5(1)(b), Art. 6(1)(f), Art. 6(4)","Accountability, Data principles, Unlawful processing",null,"Violation found","https://gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-03-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_03/2021",null,"gdprhub",null,"School",null,null,null,null,null,null,null,null,null,null],["2021/ES/180","ETid-522","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-01-13","day",2000000,null,"EUR","Caixabank S.A.","Finance, Insurance and Consulting","Art. 13, Art. 14, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00477-2019.pdf","https://www.enforcementtracker.com/ETid-522",null,null,null,null,"caixabank sa","CaixaBank",null,null,null,null,null,null,null,null],["2021/ES/221","AEPD (Spain) - TD/00164/2020","gdprhub","Spain","ES","AEPD (Spain)","2021-01-12","day",null,"None","EUR","Associació Catalana per la Participació Política",null,"Art. 12, Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/es/documento/td-00164-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00164/2020",null,"gdprhub",null,null,"ES: associacio catalana per la participacio politica",null,null,null,null,null,null,null,null,null],["2021/FR/014","CNIL (France) - SAN-2021-003","gdprhub","France","FR","CNIL (France)","2021-01-12","day",null,"None","EUR","Ministry of Interior",null,"Art. 4(1), Art. 4(2)",null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042960768","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2021-003",null,"gdprhub",null,null,"FR: ministry of interior",null,null,null,null,null,null,null,null,null],["2021/CY/010","Commissioner (Cyprus) - 11.17.001.008.042","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2021-01-12","day",null,"None","EUR",null,null,"Art. 4(11), Art. 5(1)(c), Art. 7(3), Art. 9(2)","Consent, Data principles, Special categories",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/B0CED3EDDC2EE5EDC225868D0037E7A4/$file/DECISION%20(An)%20SeaChefs.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.008.042",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2021/NO/026","ETid-524","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-01-12","day",38600,null,"EUR",null,"Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/far-gebyr-for-videresending-av-e-post/","https://www.enforcementtracker.com/ETid-524","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02178","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/BE/007","ETid-526","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2021-01-12","day",10000,null,"EUR",null,"Media, Telecoms and Broadcasting","Art. 12(3), Art. 21(1), Art. 6(1)","Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-02-2021.pdf","https://www.enforcementtracker.com/ETid-526","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_02/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/PL/010","ETid-584","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-01-11","day",30000,null,"EUR","Enea S.A.","Transportation and Energy","Art. 33(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5131.7.2020","https://www.enforcementtracker.com/ETid-584","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.7.2020","gdprhub",null,null,"enea sa",null,null,null,null,null,null,null,null,null],["2021/PL/017","UODO (Poland) - DKN.5130.2815.2020","gdprhub","Poland","PL","UODO (Poland)","2021-01-11","day",null,"None","EUR",null,null,"Art. 24(1), Art. 25(1), Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 57(1)(a), Art. 58(2)(b)","Accountability, Data principles, Data security",null,"Violation found","https://www.uodo.gov.pl/decyzje/DKN.5130.2815.2020","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5130.2815.2020",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2021/BE/008","APD/GBA (Belgium) - 01/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)","2021-01-08","day",null,"None","EUR","IAB Europe",null,"Art. 60",null,null,null,"https://www.autoriteprotectiondonnees.be/publications/decision-interlocutoire-n-01-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_01/2021",null,"gdprhub",null,null,"BE: iab europe",null,null,null,null,null,null,null,null,null],["2021/DE/051","ETid-519","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2021-01-08","day",900000,null,"EUR","notebooksbilliger.de","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://lfd.niedersachsen.de/startseite/infothek/presseinformationen/lfd-niedersachsen-verhangt-bussgeld-uber-10-4-millionen-euro-gegen-notebooksbilliger-de-196019.html","https://www.enforcementtracker.com/ETid-519",null,null,null,null,"DE: notebooksbilliger de",null,null,null,null,null,null,null,null,null],["2021/AT/010","DSB (Austria) - 2020-0.816.655","gdprhub","Austria","AT","DSB (Austria)","2021-01-07","day",null,"None","EUR","N*** & Co Material GmbH",null,"Art. 12(1), Art. 14, Art. 15(1), Art. 3, Art. 4(16)(a), Art. 57(1)(f)","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20210107_2020_0_816_655_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.816.655",null,"gdprhub",null,null,"n and co material gmbh",null,null,null,null,null,null,null,null,null],["2021/NO/027","ETid-515","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-01-07","day",7250,null,"EUR","Gveik AS","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/gveik-as-far-gebyr/","https://www.enforcementtracker.com/ETid-515",null,null,null,null,"gveik as",null,null,null,null,null,null,null,null,null],["2021/NO/028","ETid-514","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-01-06","day",9700,null,"EUR","Lindstrand Trading AS","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2021/lindstrand-trading-as-far-overtredelsesgebyr/","https://www.enforcementtracker.com/ETid-514",null,null,null,null,"lindstrand trading as",null,null,null,null,null,null,null,null,null],["2021/FR/013","ETid-511","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2021-01-05","day",20000,null,"EUR","Nestor SAS","Industry and Commerce","Art. 12, Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.cnil.fr/fr/prospection-commerciale-sanction-de-20-000-euros-lencontre-de-la-societe-nestor","https://www.enforcementtracker.com/ETid-511",null,null,null,null,"nestor sas",null,null,null,null,null,null,null,null,null],["2021/PL/014","ETid-527","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-01-05","day",5500,null,"EUR","Śląski Uniwersytet Medyczny (Medical University of Silesia)","Public Sector and Education","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.6.2020","https://www.enforcementtracker.com/ETid-527","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.6.2020","gdprhub",null,null,"PL: slaski uniwersytet medyczny",null,null,null,null,null,null,null,null,null],["2021/PL/013","ETid-551","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2021-01-05","day",19000,null,"EUR",null,"Health Care","Art. 58(2)(e)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.11.2020","https://www.enforcementtracker.com/ETid-551","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.11.2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2021/ES/181","ETid-506","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2021-01-04","day",54000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00415-2020.pdf","https://www.enforcementtracker.com/ETid-506","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00415/2020","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2021/NO/029","ETid-507","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2021-01-04","day",95500,null,"EUR","Innovasjon Norge","Finance, Insurance and Consulting","Art. 5(1), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/004f43fe684445c29e4fc8393a9a714d/varsel-om-overtredelsesgebyr---innovasjon-norge.pdf","https://www.enforcementtracker.com/ETid-507",null,null,null,null,"NO: innovasjon norge",null,null,null,null,null,null,null,null,null],["2021/CZ/015","ETid-513","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2021-01-04","day",118500,null,"EUR",null,"Industry and Commerce","Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/vismo/dokumenty2.asp?id_org=200144&id=47199","https://www.enforcementtracker.com/ETid-513",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/047","ETid-1205","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2021","year",1800,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/807-50-tb-lfd-hessen-2022-20-8296-vom-08-06-2022/file","https://www.enforcementtracker.com/ETid-1205",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/046","ETid-1206","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2021","year",500,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/807-50-tb-lfd-hessen-2022-20-8296-vom-08-06-2022/file","https://www.enforcementtracker.com/ETid-1206",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/045","ETid-1207","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2021","year",600,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/807-50-tb-lfd-hessen-2022-20-8296-vom-08-06-2022/file","https://www.enforcementtracker.com/ETid-1207",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/044","ETid-1208","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2021","year",400,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/807-50-tb-lfd-hessen-2022-20-8296-vom-08-06-2022/file","https://www.enforcementtracker.com/ETid-1208",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/043","ETid-1209","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2021","year",170,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/807-50-tb-lfd-hessen-2022-20-8296-vom-08-06-2022/file","https://www.enforcementtracker.com/ETid-1209",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/042","ETid-1210","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR",null,"Accommodation and Hospitality",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1210",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/041","ETid-1211","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR",null,"Public Sector and Education",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1211",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/040","ETid-1212","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1212",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/039","ETid-1213","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1213",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/038","ETid-1214","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1214",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/037","ETid-1215","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1215",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/036","ETid-1216","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1216",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/035","ETid-1217","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Job center employee","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1217",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/034","ETid-1218","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Job center employee","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1218",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/033","ETid-1219","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Medical clinic","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1219",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/032","ETid-1220","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Beverage retailer","Industry and Commerce",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1220",null,null,null,null,"DE: beverage retailer",null,null,null,null,null,null,null,null,null],["2021/DE/031","ETid-1221","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Attorney","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1221",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/030","ETid-1222","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2021","year",null,null,"EUR","Clinic","Health Care",null,"Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/802-tb-lfd-berlin-2021-ohne-drs-nr-vom-24-05-2022/file","https://www.enforcementtracker.com/ETid-1222",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/029","ETid-1224","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR","Physician","Health Care","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1224",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/028","ETid-1225","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR","Company","Industry and Commerce",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1225",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/027","ETid-1229","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR","Real estate agent","Real Estate","Art. 12, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1229",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/026","ETid-1275","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1275",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DE/025","ETid-1276","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1276",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DE/024","ETid-1277","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR","Physician","Health Care","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1277",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/023","ETid-1279","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR","Police department","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1279",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/022","ETid-1280","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR","Police department","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1280",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/021","ETid-1281","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2021","year",null,null,"EUR","Police department","Public Sector and Education",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/797-23-tb-lfd-brandenburg-2021-o-drs-nr-vom-09-05-2022/file","https://www.enforcementtracker.com/ETid-1281",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/020","ETid-1282","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2021","year",null,null,"EUR","Company","Health Care","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/796-30-tb-lfd-hamburg-2021-o-drs-nr-vom-06-04-2022/file","https://www.enforcementtracker.com/ETid-1282",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/019","ETid-1300","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2021","year",5000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/796-30-tb-lfd-hamburg-2021-o-drs-nr-vom-06-04-2022/file","https://www.enforcementtracker.com/ETid-1300",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DE/018","ETid-1301","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2021","year",12500,null,"EUR","Energy supplier","Transportation and Energy",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/796-30-tb-lfd-hamburg-2021-o-drs-nr-vom-06-04-2022/file","https://www.enforcementtracker.com/ETid-1301",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/017","ETid-1302","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2021","year",12500,null,"EUR","Energy supplier","Transportation and Energy",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/796-30-tb-lfd-hamburg-2021-o-drs-nr-vom-06-04-2022/file","https://www.enforcementtracker.com/ETid-1302",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/016","ETid-1303","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2021","year",10100,null,"EUR","Car trading group","Industry and Commerce",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/hamburg/796-30-tb-lfd-hamburg-2021-o-drs-nr-vom-06-04-2022/file","https://www.enforcementtracker.com/ETid-1303",null,null,null,null,"DE: car trading group",null,null,null,null,null,null,null,null,null],["2021/DE/015","ETid-1335","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2021","year",16000,null,"EUR","Electronics store","Industry and Commerce","Art. 17, Art. 35(3), Art. 5(1)(c)","DPIA, Data principles, Data subject rights","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/805-27-tb-lfd-niedersachen-2021-o-dr-nr-vom-02-06-2022/file","https://www.enforcementtracker.com/ETid-1335",null,null,null,null,"DE: electronics store",null,null,null,null,null,null,null,null,null],["2021/DE/014","ETid-1336","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2021","year",null,null,"EUR","Company",null,"Art. 25, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/805-27-tb-lfd-niedersachen-2021-o-dr-nr-vom-02-06-2022/file","https://www.enforcementtracker.com/ETid-1336",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/013","ETid-1337","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2021","year",null,null,"EUR",null,null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/805-27-tb-lfd-niedersachen-2021-o-dr-nr-vom-02-06-2022/file","https://www.enforcementtracker.com/ETid-1337",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/012","ETid-1338","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2021","year",null,null,"EUR",null,null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/805-27-tb-lfd-niedersachen-2021-o-dr-nr-vom-02-06-2022/file","https://www.enforcementtracker.com/ETid-1338",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/011","ETid-1339","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2021","year",1001000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/804-22-tb-lfd-sachsen-2021-o-drs-nr-vom-25-05-2022/file","https://www.enforcementtracker.com/ETid-1339",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DE/010","ETid-1340","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2021","year",null,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/804-22-tb-lfd-sachsen-2021-o-drs-nr-vom-25-05-2022/file","https://www.enforcementtracker.com/ETid-1340",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DE/009","ETid-1342","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2021","year",null,null,"EUR",null,"Individuals and Private Associations",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/804-22-tb-lfd-sachsen-2021-o-drs-nr-vom-25-05-2022/file","https://www.enforcementtracker.com/ETid-1342",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DE/008","ETid-1343","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2021","year",null,null,"EUR",null,"Individuals and Private Associations",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/804-22-tb-lfd-sachsen-2021-o-drs-nr-vom-25-05-2022/file","https://www.enforcementtracker.com/ETid-1343",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/DE/007","ETid-1344","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2021","year",null,null,"EUR","Gym owner","Employment",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/804-22-tb-lfd-sachsen-2021-o-drs-nr-vom-25-05-2022/file","https://www.enforcementtracker.com/ETid-1344",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/006","ETid-1345","cms_tracker","Germany","DE","Data Protection Authority of Schleswig-Holstein","2021","year",null,null,"EUR","Physician","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/schleswig-holstein/landesdatenschutzbeauftragter-8/790-40-tb-lfd-schleswig-holstein-2021-19-3545-vom-22-02-2022/file","https://www.enforcementtracker.com/ETid-1345",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/005","ETid-1346","cms_tracker","Germany","DE","Data Protection Authority of Schleswig-Holstein","2021","year",null,null,"EUR","Physician","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/schleswig-holstein/landesdatenschutzbeauftragter-8/790-40-tb-lfd-schleswig-holstein-2021-19-3545-vom-22-02-2022/file","https://www.enforcementtracker.com/ETid-1346",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/004","ETid-1347","cms_tracker","Germany","DE","Data Protection Authority of Schleswig-Holstein","2021","year",null,null,"EUR",null,"Health Care",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/schleswig-holstein/landesdatenschutzbeauftragter-8/790-40-tb-lfd-schleswig-holstein-2021-19-3545-vom-22-02-2022/file","https://www.enforcementtracker.com/ETid-1347",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/003","ETid-1348","cms_tracker","Germany","DE","Data Protection Authority of Schleswig-Holstein","2021","year",null,null,"EUR","Bank employee","Finance, Insurance and Consulting",null,"Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/schleswig-holstein/landesdatenschutzbeauftragter-8/790-40-tb-lfd-schleswig-holstein-2021-19-3545-vom-22-02-2022/file","https://www.enforcementtracker.com/ETid-1348",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/002","ETid-1349","cms_tracker","Germany","DE","Data Protection Authority of Saarland","2021","year",null,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 24, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.zaftda.de/tb-bundeslaender/saarland/landesdatenschutzbeauftragte-1/808-30-tb-lfd-saarland-2021-17-09-vom-22-06-2022/file","https://www.enforcementtracker.com/ETid-1349",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/DE/001","ETid-1350","cms_tracker","Germany","DE","Data Protection Authority of Saarland","2021","year",null,null,"EUR","Political organization","Individuals and Private Associations",null,null,"Unknown","Fine issued","https://www.zaftda.de/tb-bundeslaender/saarland/landesdatenschutzbeauftragte-1/808-30-tb-lfd-saarland-2021-17-09-vom-22-06-2022/file","https://www.enforcementtracker.com/ETid-1350",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/SK/003","ETid-1358","cms_tracker","Slovakia","SK","Slovak Data Protection Office","2021","year",500,null,"EUR",null,null,"Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://dataprotection.gov.sk/uoou/sites/default/files/sprava_o_stave_ochrany_osobnych_udajov_za_rok_2021.pdf","https://www.enforcementtracker.com/ETid-1358",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/SK/002","ETid-1359","cms_tracker","Slovakia","SK","Slovak Data Protection Office","2021","year",100,null,"EUR",null,null,null,null,"Unknown","Fine issued","https://dataprotection.gov.sk/uoou/sites/default/files/sprava_o_stave_ochrany_osobnych_udajov_za_rok_2021.pdf","https://www.enforcementtracker.com/ETid-1359",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/SK/001","ETid-1360","cms_tracker","Slovakia","SK","Slovak Data Protection Office","2021","year",40000,null,"EUR",null,null,"Art. 28, Art. 5(1)(a), Art. 5(2)","Data principles, Processor obligations","Non-compliance with general data processing principles","Fine issued","https://dataprotection.gov.sk/uoou/sites/default/files/sprava_o_stave_ochrany_osobnych_udajov_za_rok_2021.pdf","https://www.enforcementtracker.com/ETid-1360",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/AT/003","ETid-1418","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021","year",null,null,"EUR",null,"Individuals and Private Associations",null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dsb.gv.at/dam/jcr:1360e98b-d22a-4a49-b3bd-6afca2f86d4c/Datenschutzbericht_2021.pdf","https://www.enforcementtracker.com/ETid-1418",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/AT/002","ETid-1419","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021","year",600,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.dsb.gv.at/dam/jcr:1360e98b-d22a-4a49-b3bd-6afca2f86d4c/Datenschutzbericht_2021.pdf","https://www.enforcementtracker.com/ETid-1419",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2021/AT/007","ETid-872","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021","year",4000000,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dsb.gv.at/dam/jcr:1360e98b-d22a-4a49-b3bd-6afca2f86d4c/Datenschutzbericht_2021.pdf","https://www.enforcementtracker.com/ETid-872",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2021/AT/006","ETid-873","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2021","year",700000,null,"EUR","Customer loyalty program","Industry and Commerce",null,null,"Unknown","Fine issued","https://www.derstandard.at/story/2000130047781/post-und-joe-im-visier-der-datenschutzbehoerde","https://www.enforcementtracker.com/ETid-873",null,null,null,null,"AT: customer loyalty program",null,null,null,null,null,null,null,null,null],["2020/ES/160","AEPD (Spain) - PS/00123/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-12-30","day",null,"None","EUR","AYUNTAMIENTO DE TOBAR",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00123-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00123/2020",null,"gdprhub",null,null,"ES: ayuntamiento de tobar",null,null,null,null,null,null,null,null,null],["2020/RO/001","ETid-505","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-12-30","day",3000,null,"EUR","ING Bank N.V. Amsterdam - Bucharest office","Finance, Insurance and Consulting","Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_presa_30_12_2020&lang=ro","https://www.enforcementtracker.com/ETid-505","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_ING_Bank_N.V._Amsterdam_%E2%80%93_Bucharest_Branch","gdprhub",null,null,"ing bank nv amsterdam bucharest office","ING",null,null,null,null,null,null,null,null],["2020/RO/002","ETid-504","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-12-29","day",1000,null,"EUR","Qualitance QBS SA","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_29_12_2020&lang=ro","https://www.enforcementtracker.com/ETid-504",null,null,null,null,"qualitance qbs sa",null,null,null,null,null,null,null,null,null],["2020/PL/004","ETid-501","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-12-28","day",18930,null,"EUR","Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A.","Finance, Insurance and Consulting","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.5.2020","https://www.enforcementtracker.com/ETid-501","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5131.5.2020","gdprhub",null,null,"towarzystwo ubezpieczen i reasekuracji warta sa",null,null,null,null,null,null,null,null,null],["2020/BE/038","APD/GBA (Belgium) - 82/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-12-23","day",null,"None","EUR","FPS Finance",null,"Art. 25(1), Art. 35, Art. 6(1)","Accountability, DPIA, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-82-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_82/2020",null,"gdprhub",null,null,"BE: fps finance",null,null,null,null,null,null,null,null,null],["2020/BE/002","ETid-499","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-12-23","day",50000,null,"EUR",null,"Industry and Commerce","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-81-2020.pdf","https://www.enforcementtracker.com/ETid-499","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_81/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/001","ETid-500","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-12-23","day",15000,null,"EUR",null,"Industry and Commerce","Art. 12(3), Art. 6","Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-81-2020.pdf","https://www.enforcementtracker.com/ETid-500",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/001","ETid-497","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-22","day",6000,null,"EUR","Iberdrola Clientes, SAU","Transportation and Energy","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00368-2020.pdf","https://www.enforcementtracker.com/ETid-497","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00368/2020","gdprhub",null,null,"ES: iberdrola clientes","Iberdrola",null,null,null,null,null,null,null,null],["2020/RO/003","ETid-498","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-12-22","day",2000,null,"EUR","S.C. C&V Water Control S.A.","Industry and Commerce","Art. 58(2)(i)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_22_12_2020&lang=ro","https://www.enforcementtracker.com/ETid-498","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_SC_C%26V_Water_Control_SA","gdprhub",null,null,"scc and v water control sa",null,null,null,null,null,null,null,null,null],["2020/ES/002","ETid-496","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-21","day",36000,null,"EUR","Banco Bilbao Vizcaya Argentaria, S.A.","Finance, Insurance and Consulting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00219-2019.pdf","https://www.enforcementtracker.com/ETid-496","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00219/2019","gdprhub",null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2020/NL/006","ETid-678","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2020-12-20","day",525000,null,"EUR","Locatefamily.com","Media, Telecoms and Broadcasting","Art. 27","Data principles","Non-compliance with general data processing principles","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/20210512_boetebesluit_ap_locatefamily.pdf","https://www.enforcementtracker.com/ETid-678","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_10.12.2020_%28locatefamily.com%29","gdprhub",null,null,"NL: locatefamily com",null,null,null,null,null,null,null,null,null],["2020/ES/162","AEPD (Spain) - PS/00050/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-12-18","day",null,"None","EUR",null,null,"Art. 5(1)(a)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00050-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00050/2020",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2020/CZ/028","ETid-2784","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",8340,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/178-cj-uoou-0523120-5-dokument-c-178.pdf","https://www.enforcementtracker.com/ETid-2784",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/027","ETid-2785","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",9420,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/177-cj-uoou-0523020-8-dokument-c-177.pdf","https://www.enforcementtracker.com/ETid-2785",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/026","ETid-2786","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",10070,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/176-cj-uoou-0522920-10-dokument-c-176.pdf","https://www.enforcementtracker.com/ETid-2786",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/025","ETid-2787","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",11830,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/175-cj-uoou-0522820-13-dokument-c-175.pdf","https://www.enforcementtracker.com/ETid-2787",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/024","ETid-2788","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",12910,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/174-cj-uoou-0522720-8-dokument-c-174.pdf","https://www.enforcementtracker.com/ETid-2788",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/023","ETid-2789","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",11430,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/173-cj-uoou-0522620-11-dokument-c-173.pdf","https://www.enforcementtracker.com/ETid-2789",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/022","ETid-2791","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",11430,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/171-cj-uoou-0522520-17-dokument-c-171.pdf","https://www.enforcementtracker.com/ETid-2791",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/021","ETid-2793","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",26710,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/169-cj-uoou-0522420-25-dokument-c-169.pdf","https://www.enforcementtracker.com/ETid-2793",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/016","ETid-2803","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",8800,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/181-cj-uoou-0523420-8-dokument-c-181.pdf","https://www.enforcementtracker.com/ETid-2803",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/015","ETid-2804","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",8800,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/180-cj-uoou-0523320-7-dokument-c-180.pdf","https://www.enforcementtracker.com/ETid-2804",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/014","ETid-2805","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",8100,null,"EUR","Legal Person",null,"Art. 14, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/179-cj-uoou-0523220-5-dokument-c-179.pdf","https://www.enforcementtracker.com/ETid-2805",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/013","ETid-2810","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-18","day",200,null,"EUR","Legal Person",null,"Art. 17(1)(c)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/168-cj-uoou-0495720-3-dokument-c-168.pdf","https://www.enforcementtracker.com/ETid-2810",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/SI/027","IP - 07121-1/2020/2281","gdprhub","Slovenia","SI","IP (Slovenia)","2020-12-18","day",null,"None","EUR",null,null,"Art. 6(1)","Unlawful processing",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=2295","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/2281",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/PL/027","UODO (Poland) - DKE.561.17.2020","gdprhub","Poland","PL","UODO (Poland)","2020-12-18","day",null,"None","EUR",null,null,"Art. 31, Art. 58(1)(e)",null,null,"Violation found","https://uodo.gov.pl/decyzje/DKE.561.17.2020","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.17.2020",null,"gdprhub",null,"Sole proprietor",null,null,null,null,null,"person",null,null,null,null],["2020/SE/027","Datainspektionen - DI-2019-13112","gdprhub","Sweden","SE","Datainspektionen (Sweden)","2020-12-17","day",null,"None","EUR","Swedish Customs (Tullverket)",null,null,null,null,"Other Outcome","https://www.imy.se/globalassets/dokument/beslut/2020-12-17-beslut-tillsyn-tullverket.pdf","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-13112",null,"gdprhub",null,null,"SE: swedish customs",null,null,null,null,null,null,null,null,null],["2020/RO/004","ETid-489","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-12-17","day",100000,null,"EUR","Banca Transilvania SA","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_17_12_2020&lang=ro","https://www.enforcementtracker.com/ETid-489",null,null,null,null,"banca transilvania sa",null,null,null,null,null,null,null,null,null],["2020/FR/003","ETid-490","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2020-12-17","day",3000,null,"EUR","Doctor","Health Care","Art. 32, Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042675720","https://www.enforcementtracker.com/ETid-490","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-014","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/FR/002","ETid-491","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2020-12-17","day",6000,null,"EUR","Doctor","Health Care","Art. 32, Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnil.fr/fr/violations-de-donnees-de-sante-la-cnil-sanctionne-deux-medecins","https://www.enforcementtracker.com/ETid-491","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-015","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/PL/003","ETid-509","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-12-17","day",235300,null,"EUR","ID Finance Poland Sp. z o.o.","Finance, Insurance and Consulting","Art. 25(1), Art. 5(1)(f)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/DKN.5130.1354.2020","https://www.enforcementtracker.com/ETid-509","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5130.1354.2020","gdprhub",null,null,"id finance poland spzoo",null,null,null,null,null,null,null,null,null],["2020/IT/007","ETid-531","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-12-17","day",500000,null,"EUR","Roma Capitale (Rome Municipality)","Public Sector and Education","Art. 13, Art. 14, Art. 32, Art. 5(1)(a)","Data principles, Data security, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9524175","https://www.enforcementtracker.com/ETid-531",null,null,null,null,"IT: roma capitale",null,null,null,null,null,null,null,null,null],["2020/IT/006","ETid-532","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-12-17","day",40000,null,"EUR","Miropass S.r.l.","Industry and Commerce","Art. 28, Art. 6, Art. 9","Processor obligations, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9525315","https://www.enforcementtracker.com/ETid-532",null,null,null,null,"miropass srl",null,null,null,null,null,null,null,null,null],["2020/IT/005","ETid-539","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-12-17","day",100000,null,"EUR","Azienda Unità Sanitaria Locale Toscana Sud Est","Health Care","Art. 13, Art. 14, Art. 28, Art. 30, Art. 32, Art. 35, Art. 5(1)(f)","DPIA, Data principles, Data security, Processor obligations, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9529527","https://www.enforcementtracker.com/ETid-539","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9529527","gdprhub",null,null,"IT: azienda unita sanitaria locale toscana sud est",null,null,null,null,null,null,null,null,null],["2020/IE/002","ETid-552","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2020-12-17","day",70000,null,"EUR","University College Dublin","Public Sector and Education","Art. 32(1), Art. 33(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2021-02/Inquiry%20University%20College%20Dublin_0.pdf","https://www.enforcementtracker.com/ETid-552","https://gdprhub.eu/index.php?title=DPC_-_Inquiry_into_University_College_Dublin_%28IN-19-7-4%29","gdprhub",null,null,"IE: university college dublin",null,null,null,null,null,null,null,null,null],["2020/IT/003","ETid-589","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-12-17","day",4000,null,"EUR","Comune di Santo Stefano Belbo","Public Sector and Education","Art. 6(2), Art. 6(3)(b)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9557753","https://www.enforcementtracker.com/ETid-589",null,null,null,null,"IT: comune di santo stefano belbo",null,null,null,null,null,null,null,null,null],["2020/IT/002","ETid-590","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-12-17","day",10000,null,"EUR","Comune di Luino","Public Sector and Education","Art. 37(1)(a), Art. 37(7), Art. 6(2), Art. 6(3)(b)","Data principles, Data protection officer, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9557593","https://www.enforcementtracker.com/ETid-590",null,null,null,null,"IT: comune di luino",null,null,null,null,null,null,null,null,null],["2020/IT/001","ETid-598","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-12-17","day",2000,null,"EUR","Ordine degli Assistenti Sociali della Regione Lazio","Public Sector and Education",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9557793","https://www.enforcementtracker.com/ETid-598",null,null,null,null,"IT: ordine degli assistenti sociali della regione lazio",null,null,null,null,null,null,null,null,null],["2020/IS/010","Persónuvernd - 2020010548","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-12-17","day",null,"None","EUR",null,null,"Art. 2(2)(c), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/rafraen-voktun-i-fjoleignarhusi","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010548",null,"gdprhub",null,"Resident of an apartment building",null,null,null,null,null,"person",null,null,null,null],["2020/IE/010","DPC - C-XX-X-XX Groupon International Limited - December 2020","gdprhub","Ireland","IE","DPC (Ireland)","2020-12-16","day",null,"None","EUR","Groupon International Limited",null,"Art. 12(2), Art. 12(6), Art. 17(1), Art. 5(1)(c), Art. 6(1), Art. 60(2), Art. 60(3), Art. 60(4)","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2021-02/16.12.2020_Decision_Complaint_GrouponInternationalLimited.pdf","https://gdprhub.eu/index.php?title=DPC_-_C-XX-X-XX_Groupon_International_Limited_-_December_2020",null,"gdprhub",null,null,"groupon international ltd",null,null,null,null,null,null,null,null,null],["2020/HU/006","ETid-493","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-12-16","day",1940,null,"EUR",null,"Employment","Art. 13(1)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.naih.hu/files/NAIH-2020-2729-15-hatarozat.pdf","https://www.enforcementtracker.com/ETid-493","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/2729/15","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/HU/005","ETid-494","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-12-16","day",55400,null,"EUR","Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.)","Industry and Commerce","Art. 32(1)(b), Art. 34(1)","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.naih.hu/files/NAIH-2020-0066-21-hatarozat.pdf","https://www.enforcementtracker.com/ETid-494","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/66/21","gdprhub",null,null,"robinson tours ltd",null,null,null,null,null,null,null,null,null],["2020/HU/004","ETid-495","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-12-16","day",1385,null,"EUR","Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.)","Media, Telecoms and Broadcasting","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.naih.hu/files/NAIH-2020-0066-21-hatarozat.pdff","https://www.enforcementtracker.com/ETid-495",null,null,null,null,"next time media agency ltd",null,null,null,null,null,null,null,null,null],["2020/HU/002","ETid-568","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-12-16","day",97150,null,"EUR",null,"Finance, Insurance and Consulting","Art. 12, Art. 5(1)(c), Art. 6(1), Art. 9(1)","Data principles, Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=326:babavaro-kolcsonnel-osszefuggesben-vegzett-adatkezeles-varandosgondozasi-konyvekrol-valo-masolatkeszites-jogszerusege","https://www.enforcementtracker.com/ETid-568","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2020-2546-5","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SI/025","IP - 07121-1 / 2020/2260","gdprhub","Slovenia","SI","IP (Slovenia)","2020-12-16","day",null,"None","EUR",null,null,"Art. 4(11), Art. 6(1)","Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=2282","https://gdprhub.eu/index.php?title=IP_-_07121-1_/_2020/2260",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/026","IP - 07121-1 / 2020/2263","gdprhub","Slovenia","SI","IP (Slovenia)","2020-12-16","day",null,"None","EUR",null,null,"Art. 32, Art. 5, Art. 6(1)","Data principles, Data security, Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=2284","https://gdprhub.eu/index.php?title=IP_-_07121-1_/_2020/2263",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/HU/026","NAIH (Hungary) - NAIH/2020/6484","gdprhub","Hungary","HU","NAIH (Hungary)","2020-12-16","day",null,"None","EUR",null,null,"Art. 15(1)(a), Art. 15(1)(c), Art. 15(1)(d)","Data subject rights",null,"Violation found","https://www.naih.hu/files/NAIH-2020-6484-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/6484",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/IE/003","ETid-485","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2020-12-15","day",450000,null,"EUR","Twitter International Company","Media, Telecoms and Broadcasting",null,"Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://edpb.europa.eu/sites/edpb/files/decisions/final_decision_-_in-19-1-1_9.12.2020.pdf","https://www.enforcementtracker.com/ETid-485","https://gdprhub.eu/index.php?title=DPC_-_In_the_matter_of_Twitter_International_Company_%28IN-19-1-1%29","gdprhub",null,null,"IE: twitter international company","X (Twitter)",null,null,null,null,null,null,null,null],["2020/SE/001","ETid-486","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-15","day",29500,null,"EUR","Uppsalahem AB","Real Estate","Art. 5, Art. 6(1)(f)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/2020-12-14-beslut-tillsyn-uppsalahem.pdf","https://www.enforcementtracker.com/ETid-486","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2020-4534","gdprhub",null,null,"uppsalahem ab",null,null,null,null,null,null,null,null,null],["2020/LV/002","ETid-487","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2020-12-15","day",15000,null,"EUR","HH Invest SIA","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dvi.gov.lv/lv/zinas/datu-valsts-inspekcija-internetveikalam-piemero-eur-15-000-naudas-sodu/","https://www.enforcementtracker.com/ETid-487","https://gdprhub.eu/index.php?title=DVI_%28Latvia%29_-_SIA_%E2%80%9CHH_Invest%E2%80%9D","gdprhub",null,null,"hh invest sia",null,null,null,null,null,null,null,null,null],["2020/LV/001","ETid-488","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2020-12-15","day",6250,null,"EUR",null,"Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dvi.gov.lv/lv/zinas/datu-valsts-inspekcija-par-neatbilstosu-personas-datu-apstradi-darba-devejam-piemero-eur-6250-lielu-naudas-sodu/","https://www.enforcementtracker.com/ETid-488",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/003","ETid-492","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-15","day",10000,null,"EUR","Online Services","Industry and Commerce","Art. 13, Art. 6(1)(a), Art. 8(1)","Consent, Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00438-2019.pdf","https://www.enforcementtracker.com/ETid-492",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/PL/005","ETid-483","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-12-14","day",443000,null,"EUR","Virgin Mobile Polska","Media, Telecoms and Broadcasting","Art. 25(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/DKN.5112.1.2020","https://www.enforcementtracker.com/ETid-483","https://gdprhub.eu/index.php?title=UODO_-_DKN.5112.1.2020","gdprhub",null,null,"PL: virgin mobile polska",null,null,null,null,null,null,null,null,null],["2020/RO/041","ANSPDCP (Romania) - Warning issued to Bucharest Municipality (District 4)","gdprhub","Romania","RO","ANSPDCP (Romania)","2020-12-11","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_2_22_12_2020&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Warning_issued_to_Bucharest_Municipality_%28District_4%29",null,"gdprhub",null,"Bucharest Municipality - District",null,null,null,null,null,null,null,null,null,null],["2020/RO/040","ANSPDCP (Romania) - Warning issued to Cluj-Napoca Municipality","gdprhub","Romania","RO","ANSPDCP (Romania)","2020-12-11","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 6(1)","Data principles, Unlawful processing",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_3_22_12_2020&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Warning_issued_to_Cluj-Napoca_Municipality",null,"gdprhub",null,"Cluj-Napoca Municipality",null,null,null,null,null,null,null,null,null,null],["2020/ES/004","ETid-481","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-11","day",5000000,null,"EUR","Banco Bilbao Vizcaya Argentaria, S.A.","Finance, Insurance and Consulting","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00070-2019.pdf","https://www.enforcementtracker.com/ETid-481",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2020/SE/002","ETid-482","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-11","day",54000,null,"EUR","Umeå University","Public Sector and Education","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/2020-12-10-beslut-tillsyn-umea-universitet.pdf","https://www.enforcementtracker.com/ETid-482",null,null,null,null,"SE: umea university",null,null,null,null,null,null,null,null,null],["2020/IM/001","ETid-847","cms_tracker","Isle of Man","IM","Information Commissioner of Isle of Man","2020-12-11","day",3250,null,"EUR","Cosmetic Medical Limited","Industry and Commerce","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.inforights.im/media/1903/cosmedltd_pn_11dec2020_website.pdf","https://www.enforcementtracker.com/ETid-847",null,null,null,null,"cosmetic medical ltd",null,null,null,null,null,null,null,null,null],["2020/ES/161","AEPD (Spain) - PS/00043/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-12-10","day",null,"None","EUR",null,null,"Art. 13, Art. 83(5)","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00043-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00043/2020",null,"gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2020/ES/178","AEPD (Spain) - PS/00366/2019","gdprhub","Spain","ES","AEPD (Spain)","2020-12-10","day",null,"None","EUR","AGENCIA ESTATAL DE ADMINISTRACIÓN TRIBUTARIA (AEAT)",null,"Art. 5(1)(d)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00366-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00366/2019",null,"gdprhub",null,null,"ES: agencia estatal de administracion tributaria",null,null,null,null,null,null,null,null,null],["2020/SE/024","Datainspektionen - DI-2019-9432","gdprhub","Sweden","SE","Datainspektionen (Sweden)","2020-12-10","day",null,"550000","SEK","Umeå University",null,"Art. 32(1), Art. 32(2), Art. 33(1), Art. 33(5), Art. 5(1)(f)","Data breach, Data principles, Data security",null,"Violation found","https://www.datainspektionen.se/nyheter/university-failed-to-sufficiently-protect-sensitive-personal-data/","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-9432",null,"gdprhub",null,null,"SE: umea university",null,550000.0,53714,"day 2020-12-10|10.2395|SEK",null,null,null,null,null],["2020/ES/005","ETid-480","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-10","day",4000,null,"EUR","Borjamotor, S.A.","Industry and Commerce","Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00332-2020.pdf","https://www.enforcementtracker.com/ETid-480",null,null,null,null,"borjamotor sa",null,null,null,null,null,null,null,null,null],["2020/HU/001","ETid-569","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-12-10","day",22200,null,"EUR","Budapesti Műszaki és Gazdaságtudományi Egyetem (Budapest University of Technology and Economics)","Public Sector and Education","Art. 12, Art. 13, Art. 6(1), Art. 9(2)","Special categories, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://naih.hu/hatarozatok-vegzesek?download=325:1-rendszeres-szocialis-osztondijakkal-kapcsolatos-adatkezeles-a-budapesti-muszaki-es-gazdasagtudomanyi-egyetemen-modositasokkal-egyseges-szerkezetben","https://www.enforcementtracker.com/ETid-569",null,null,null,null,"HU: budapesti muszaki es gazdasagtudomanyi egyetem",null,null,null,null,null,null,null,null,null],["2020/NL/007","ETid-612","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2020-12-10","day",475000,null,"EUR","Booking.com B.V.","Accommodation and Hospitality","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/besluit_boete_booking.pdf","https://www.enforcementtracker.com/ETid-612","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_10.12.2020_%28Booking.com%29","gdprhub",null,null,"booking com bv",null,null,null,null,null,null,null,null,null],["2020/ES/007","ETid-477","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-09","day",40000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00262-2020.pdf","https://www.enforcementtracker.com/ETid-477",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/ES/006","ETid-478","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-09","day",10000,null,"EUR",null,null,"Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00324-2020.pdf","https://www.enforcementtracker.com/ETid-478",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/PL/002","ETid-510","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-12-09","day",18850,null,"EUR","TUiR Warta S.A.","Finance, Insurance and Consulting","Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://uodo.gov.pl/decyzje/DKN.5131.5.20200","https://www.enforcementtracker.com/ETid-510",null,null,null,null,"tuir warta sa",null,null,null,null,null,null,null,null,null],["2020/PL/001","ETid-538","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-12-09","day",2850,null,"EUR","Smart Cities Sp. z o.o.","Industry and Commerce","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/decyzje/DKE.561.13.2020%20","https://www.enforcementtracker.com/ETid-538","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.13.2020","gdprhub",null,null,"smart cities spzoo",null,null,null,null,null,null,null,null,null],["2020/SI/022","IP - 07121-1/2020/2187","gdprhub","Slovenia","SI","IP (Slovenia)","2020-12-09","day",null,"None","EUR",null,null,"Art. 6(1)(c), Art. 9(2)(h)","Special categories, Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=2171","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/2187",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/FR/016","CNIL (France) - SAN-2020-018","gdprhub","France","FR","CNIL (France)","2020-12-08","day",20000,"20000","EUR","Nestor SAS",null,"Art. 12, Art. 12(4), Art. 13, Art. 15(1), Art. 15(3), Art. 32","Data security, Data subject rights, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042848036","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-018",null,"gdprhub",null,null,"nestor sas",null,null,null,null,null,null,null,null,null],["2020/FR/013","CNIL (France) - SAN-2020-012","gdprhub","France","FR","CNIL (France)","2020-12-07","day",100000000,"100000000","EUR","Google LLC",null,"Art. 26(1), Art. 4(7), Art. 56, Art. 60",null,null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-012",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2020/FR/012","CNIL (France) - SAN-2020-013","gdprhub","France","FR","CNIL (France)","2020-12-07","day",35000000,"35000000","EUR","Amazon Europe Core",null,"Art. 6, Art. 83, Art. 9, Art. 94","Special categories, Unlawful processing",null,"Violation found","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-013",null,"gdprhub",null,null,"FR: amazon europe core","Amazon",null,null,null,null,null,null,null,null],["2020/NO/021","Datatilsynet (Norway) - 20/01896","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-12-07","day",null,"75000","NOK","Gveik AS",null,"Art. 24, Art. 32, Art. 5(2), Art. 6(1)(f)","Accountability, Data principles, Data security, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2021/gveik-as-far-gebyr-for-ulovleg-kredittvurdering/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01896",null,"gdprhub",null,null,"gveik as",null,75000.0,7054,"day 2020-12-07|10.6328|NOK",null,null,null,null,null],["2020/FR/001","ETid-508","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2020-12-07","day",7300,null,"EUR","Perfomeclic","Industry and Commerce","Art. 14, Art. 21, Art. 28","Data subject rights, Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042774286?isSuggest=true","https://www.enforcementtracker.com/ETid-508","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-016","gdprhub",null,null,"FR: perfomeclic",null,null,null,null,null,null,null,null,null],["2020/SI/023","IP - 07120-1/2020/628","gdprhub","Slovenia","SI","IP (Slovenia)","2020-12-04","day",null,"None","EUR",null,null,"Art. 6(1)","Unlawful processing",null,null,"https://www.ip-rs.si/mnenja-gdpr/6048a641360b6","https://gdprhub.eu/index.php?title=IP_-_07120-1/2020/628",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/024","IP - 07121-1/2020/2166","gdprhub","Slovenia","SI","IP (Slovenia)","2020-12-04","day",null,"None","EUR",null,null,null,null,null,null,"https://www.ip-rs.si/mnenja-gdpr/6048a6413604e","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/2166",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SE/009","ETid-466","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-03","day",1463000,null,"EUR","Aleris Sjukvård AB","Health Care","Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-aleris-sjukvard-di-2019-3844.pdf","https://www.enforcementtracker.com/ETid-466","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-3844","gdprhub",null,null,"aleris sjukvard ab",null,null,null,null,null,null,null,null,null],["2020/SE/008","ETid-467","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-03","day",1168000,null,"EUR","Aleris Sjukvård AB","Health Care","Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-aleris-narsjukvard-di-2019-3842.pdf","https://www.enforcementtracker.com/ETid-467",null,null,null,null,"aleris sjukvard ab",null,null,null,null,null,null,null,null,null],["2020/ES/010","ETid-468","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-03","day",2400,null,"EUR","Dr Marín Cirugia Plástica, S.L.P.","Health Care","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00317-2020.pdf","https://www.enforcementtracker.com/ETid-468",null,null,null,null,"dr marin cirugia plastica slp",null,null,null,null,null,null,null,null,null],["2020/SE/007","ETid-469","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-03","day",243800,null,"EUR","Östergötland Region","Health Care","Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-region-ostergotland-di-2019-3843.pdf","https://www.enforcementtracker.com/ETid-469",null,null,null,null,"SE: ostergotland region",null,null,null,null,null,null,null,null,null],["2020/SE/006","ETid-470","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-03","day",243800,null,"EUR","Västerbotten Region","Health Care","Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-region-vasterbotten-di-2019-3841.pdf","https://www.enforcementtracker.com/ETid-470",null,null,null,null,"SE: vasterbotten region",null,null,null,null,null,null,null,null,null],["2020/SE/005","ETid-471","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-03","day",341300,null,"EUR","Sahlgrenska University Hospital","Health Care","Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-sahlgrenska-universitetssjukhuset-di-2019-3840.pdf","https://www.enforcementtracker.com/ETid-471","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-3840","gdprhub",null,null,"SE: sahlgrenska university hospital",null,null,null,null,null,null,null,null,null],["2020/SE/004","ETid-472","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-03","day",390100,null,"EUR","Karolinska University Hospital of Solna","Health Care","Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-karolinska-universitetssjukhuset-di-2019-3839.pdf","https://www.enforcementtracker.com/ETid-472","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-3839","gdprhub",null,null,"SE: karolinska university hospital of solna",null,null,null,null,null,null,null,null,null],["2020/SE/003","ETid-473","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-12-03","day",2900000,null,"EUR","Capio St. Göran AB","Health Care","Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-capio-st-gorans-sjukhus-di-2019-3846.pdf","https://www.enforcementtracker.com/ETid-473",null,null,null,null,"capio st goran ab",null,null,null,null,null,null,null,null,null],["2020/NO/001","ETid-474","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-12-03","day",18840,null,"EUR","Municipality of Indre Østfold","Public Sector and Education","Art. 32(1)(b), Art. 6","Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/1679986c04f54694b734ab883eebfde1/endelig-vedtak-til-indre-ostfold-kommune.pdf","https://www.enforcementtracker.com/ETid-474",null,null,null,null,"NO: municipality of indre stfold",null,null,null,null,null,null,null,null,null],["2020/SE/026","Datainspektionen - DI-2019-3841","gdprhub","Sweden","SE","Datainspektionen (Sweden)","2020-12-02","day",null,"2500000","SEK","Hälso- och sjukvårdsnämnden, Region Västerbotten",null,"Art. 32(1), Art. 32(2), Art. 5(1)(f), Art. 5(2)","Data principles, Data security",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/beslut-tillsyn-region-vasterbotten-di-2019-3841.pdf","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-3841",null,"gdprhub",null,null,"SE: halso och sjukvardsnamnden region vasterbotten",null,2500000.0,243160,"day 2020-12-02|10.2813|SEK",null,null,null,null,null],["2020/SE/025","Datainspektionen - DI-2019-3845","gdprhub","Sweden","SE","Datainspektionen (Sweden)","2020-12-02","day",null,"None","EUR","Kry",null,"Art. 32(1), Art. 32(2), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.imy.se/globalassets/dokument/beslut/beslut-tillsyn-digital-medical-supply-sweden-di-2019-3845.pdf","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-3845",null,"gdprhub",null,null,"SE: kry",null,null,null,null,null,null,null,null,null],["2020/ES/013","ETid-463","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-02","day",6000,null,"EUR","Servicio de Alojamientos Responsables, S.L.","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00320-2020.pdf","https://www.enforcementtracker.com/ETid-463",null,null,null,null,"servicio de alojamientos responsables sl",null,null,null,null,null,null,null,null,null],["2020/ES/012","ETid-464","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-02","day",3000,null,"EUR","Comercio Online Levante, S.L.","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00287-2020.pdf","https://www.enforcementtracker.com/ETid-464",null,null,null,null,"comercio online levante sl",null,null,null,null,null,null,null,null,null],["2020/ES/011","ETid-465","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-02","day",5000,null,"EUR","Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA)","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00141-2020.pdf","https://www.enforcementtracker.com/ETid-465","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00141/2020","gdprhub",null,null,"ES: asociacion de victimas por arbitrariedades judiciales",null,null,null,null,null,null,null,null,null],["2020/ES/008","ETid-476","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-12-02","day",10000,null,"EUR","Losada Advocats S.L.","Finance, Insurance and Consulting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00322-2020.pdf","https://www.enforcementtracker.com/ETid-476",null,null,null,null,"losada advocats sl",null,null,null,null,null,null,null,null,null],["2020/GR/024","HDPA (Greece) - 8/2021","gdprhub","Greece","GR","HDPA (Greece)","2020-12-02","day",2000,"2000","EUR",null,null,"Art. 4(7)",null,null,"Violation found","https://www.dpa.gr/sites/default/files/2021-04/8_2021anonym_0.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_8/2021",null,"gdprhub",null,"Political candidate",null,null,null,null,null,"person",null,null,null,null],["2020/CZ/006","ETid-2821","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-12-01","day",800,null,"EUR","Legal Person",null,"Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/134-cj-uoou-0134320-18-dokument-c-134.pdf","https://www.enforcementtracker.com/ETid-2821",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/EE/004","ETid-516","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2020-12-01","day",100000,null,"EUR","Apotheka e-apteek","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aki.ee/et/uudised/andmekaitse-inspektsioon-kohustas-e-apteeke-lopetama-koheselt-ligipaas-teise-inimese","https://www.enforcementtracker.com/ETid-516",null,null,null,null,"EE: apotheka e apteek",null,null,null,null,null,null,null,null,null],["2020/EE/003","ETid-517","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2020-12-01","day",100000,null,"EUR","Südameapteegi e-apteek","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aki.ee/et/uudised/andmekaitse-inspektsioon-kohustas-e-apteeke-lopetama-koheselt-ligipaas-teise-inimese","https://www.enforcementtracker.com/ETid-517",null,null,null,null,"EE: sudameapteegi e apteek",null,null,null,null,null,null,null,null,null],["2020/EE/002","ETid-518","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2020-12-01","day",100000,null,"EUR","Azeta.ee e-apteek","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aki.ee/et/uudised/andmekaitse-inspektsioon-kohustas-e-apteeke-lopetama-koheselt-ligipaas-teise-inimesee","https://www.enforcementtracker.com/ETid-518",null,null,null,null,"EE: azeta ee e apteek",null,null,null,null,null,null,null,null,null],["2020/CZ/012","ETid-2811","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-11-30","day",2000,null,"EUR","Legal Person","Industry and Commerce","Art. 17(1)(a)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/153-cj-uoou-0305820-9-dokument-c-153.pdf","https://www.enforcementtracker.com/ETid-2811",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/009","ETid-2814","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-11-30","day",1200,null,"EUR","Legal Person",null,"Art. 17(1)(c)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/139-cj-uoou-0216520-13-dokument-c-139.pdf","https://www.enforcementtracker.com/ETid-2814",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/009","ETid-475","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-27","day",1200,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00278-2020.pdf","https://www.enforcementtracker.com/ETid-475","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00278/2020","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2020/IS/026","Persónuvernd - 2020010702","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-11-27","day",null,"None","EUR","Skeljung hf.",null,"Art. 5","Data principles",null,"Violation found","https://www.personuvernd.is/urlausnir/medferd-skeljungs-hf.-a-tolvupostholfi-starfsmanns-vid-starfslok","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010702",null,"gdprhub",null,null,"skeljung hf",null,null,null,null,null,null,null,null,null],["2020/IT/011","ETid-502","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-11-26","day",10000,null,"EUR","Reti Televisive Italiane S.p.a.","Media, Telecoms and Broadcasting","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9509558","https://www.enforcementtracker.com/ETid-502","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9509558","gdprhub",null,null,"reti televisive italiane spa",null,null,null,null,null,null,null,null,null],["2020/IT/010","ETid-503","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-11-26","day",20000,null,"EUR","Concentrix Cvg Italy s.r.l.","Employment","Art. 9(1)(b)","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9509515","https://www.enforcementtracker.com/ETid-503","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9509515","gdprhub",null,null,"concentrix cvg italy srl",null,null,null,null,null,null,null,null,null],["2020/IT/004","ETid-543","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-11-26","day",3000,null,"EUR","Charly Mike s.r.l.","Accommodation and Hospitality","Art. 13, Art. 5(1)(a)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9533587","https://www.enforcementtracker.com/ETid-543",null,null,null,null,"charly mike srl",null,null,null,null,null,null,null,null,null],["2020/SE/010","ETid-456","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-11-25","day",19500,null,"EUR","Gnosjö Municipality","Health Care","Art. 13, Art. 35, Art. 36, Art. 5, Art. 6","DPIA, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-gnosjo-2020-11-25.pdf","https://www.enforcementtracker.com/ETid-456","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-7782","gdprhub",null,null,"SE: gnosjo municipality",null,null,null,null,null,null,null,null,null],["2020/ES/014","ETid-458","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-25","day",40000,null,"EUR","Miraclia Telecomunicaciones S.L.","Media, Telecoms and Broadcasting","Art. 13, Art. 14, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00416-2019.pdf","https://www.enforcementtracker.com/ETid-458",null,null,null,null,"miraclia telecomunicaciones sl",null,null,null,null,null,null,null,null,null],["2020/BE/004","ETid-460","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-11-25","day",1500,null,"EUR",null,"Individuals and Private Associations","Art. 25, Art. 6","Accountability, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-74-2020.pdf","https://www.enforcementtracker.com/ETid-460","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_74/2020","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2020/IS/025","Persónuvernd - 2020010671","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-11-25","day",null,"None","EUR","Heilbrigðiseftirlit Suðurlands",null,"Art. 18, Art. 5, Art. 6(1)(e), Art. 6(1)(f)","Data principles, Data subject rights, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/urskurdur-um-vinnslu-personuupplysinga-hja-heilbrigdiseftirliti-sudurlands.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010671",null,"gdprhub",null,null,"IS: heilbrigiseftirlit suurlands",null,null,null,null,null,null,null,null,null],["2020/SE/017","Datainspektionen - DI-2019-7024","gdprhub","Sweden","SE","Datainspektionen (Sweden)","2020-11-24","day",null,"4000000","SEK","Educational Board of Stockholm",null,"Art. 32(1), Art. 35, Art. 5(1)(f)","DPIA, Data principles, Data security",null,"Violation found","https://www.datainspektionen.se/nyheter/allvarliga-brister-i-skolplattformen-i-stockholm/#:~:text=Granskningen%20visar%20p%C3%A5%20brister%20i,mot%20utbildningsn%C3%A4mnden%20i%20Stockholm%20stad.&text=Datainspektionen%20har%20tagit%20emot%20ett,fr%C3%A5n%20utbildningsn%C3%A4mnden%20i%20Stockholm%20stad.","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2019-7024",null,"gdprhub",null,null,"SE: educational board of stockholm",null,4000000.0,392003,"day 2020-11-24|10.2040|SEK",null,null,null,null,null],["2020/RO/005","ETid-453","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-11-24","day",5000,null,"EUR","Dada Creation S.R.L.","Industry and Commerce","Art. 32, Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_24_11_2020&lang=ro","https://www.enforcementtracker.com/ETid-453",null,null,null,null,"dada creation srl",null,null,null,null,null,null,null,null,null],["2020/SE/011","ETid-455","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-11-24","day",394000,null,"EUR","City of Stockholm","Public Sector and Education","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-stockholms-stad.pdf","https://www.enforcementtracker.com/ETid-455",null,null,null,null,"SE: city of stockholm",null,null,null,null,null,null,null,null,null],["2020/AT/015","DSB (Austria) - 2020-0.759.615","gdprhub","Austria","AT","DSB (Austria)","2020-11-23","day",null,"None","EUR",null,null,"Art. 6(1)(f), Art. 9(1)","Special categories, Unlawful processing",null,"Rejected","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20201123_2020_0_759_615_00/DSBT_20201123_2020_0_759_615_00.pdf","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.759.615",null,"gdprhub",null,"Ski lift operator",null,null,null,null,null,null,null,null,null,null],["2020/ES/016","ETid-450","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-23","day",12000,null,"EUR","Recambios Villalegre S.L.","Industry and Commerce","Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00227-2020.pdf","https://www.enforcementtracker.com/ETid-450","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00227/2020","gdprhub",null,null,"recambios villalegre sl",null,null,null,null,null,null,null,null,null],["2020/RO/006","ETid-451","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-11-23","day",4000,null,"EUR","Vodafone România SA","Media, Telecoms and Broadcasting","Art. 12, Art. 15, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/?page=Comunicat_de_presa_23_/_11_/_2020&lang=ro","https://www.enforcementtracker.com/ETid-451","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Vodafone_Rom%C3%A2nia_S.A._3","gdprhub",null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2020/IT/012","ETid-459","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-11-23","day",20000,null,"EUR","Burgo Group S.p.A","Employment","Art. 13, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9474649","https://www.enforcementtracker.com/ETid-459",null,null,null,null,"burgo group spa",null,null,null,null,null,null,null,null,null],["2020/DE/028","HBDI (Hesse) - 90.20.77:0245","gdprhub","Germany","DE","HBDI (Hesse)","2020-11-20","day",null,"None","EUR","ABIS GmbH",null,"Art. 12(6)","Transparency",null,"Violation found","https://www.datenanfragen.de/blog/abis-unterschrift-dsgvo-anfragen/","https://gdprhub.eu/index.php?title=HBDI_%28Hesse%29_-_90.20.77%3A0245",null,"gdprhub",null,null,"abis gmbh",null,null,null,null,null,null,null,null,null],["2020/AT/013","DSB (Austria) - 2020-0.743.659","gdprhub","Austria","AT","DSB (Austria)","2020-11-19","day",null,"None","EUR","X*** Gaststätten GmbH",null,"Art. 4(15), Art. 5(1)(a), Art. 6(1)(c), Art. 9(1), Art. 9(2), Art. 9(2)(a), Art. 9(2)(i)","Data principles, Special categories, Unlawful processing",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20201119_2020_0_743_659_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.743.659",null,"gdprhub",null,null,"x gaststatten gmbh",null,null,null,null,null,null,null,null,null],["2020/CZ/018","ETid-2796","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-11-19","day",4800,null,"EUR","Legal Person",null,"Art. 12(3), Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/164-cj-uoou-0407720-6-dokument-c-164.pdf","https://www.enforcementtracker.com/ETid-2796",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/024","ETid-437","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-19","day",36000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00308-2020.pdf","https://www.enforcementtracker.com/ETid-437","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00308/2020","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/015","ETid-452","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-18","day",2000,null,"EUR","Anmavas 61, S.L.","Industry and Commerce","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00189-2020.pdf","https://www.enforcementtracker.com/ETid-452",null,null,null,null,"anmavas 61 sl",null,null,null,null,null,null,null,null,null],["2020/FR/005","ETid-454","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2020-11-18","day",800000,null,"EUR","Carrefour Banque","Finance, Insurance and Consulting","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042564657","https://www.enforcementtracker.com/ETid-454","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-009","gdprhub",null,null,"FR: carrefour banque","Carrefour",null,null,null,null,null,null,null,null],["2020/FR/004","ETid-457","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2020-11-18","day",2250000,null,"EUR","Carrefour France","Industry and Commerce","Art. 12, Art. 13, Art. 15, Art. 17, Art. 21, Art. 32, Art. 33, Art. 5","Data breach, Data principles, Data security, Data subject rights, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042563756","https://www.enforcementtracker.com/ETid-457","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-008","gdprhub",null,null,"FR: carrefour france","Carrefour",null,null,null,null,null,null,null,null],["2020/HU/003","ETid-523","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-11-18","day",28,null,"EUR",null,"Industry and Commerce","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.naih.hu/files/NAIH-2020-3479-hatarozat.pdf","https://www.enforcementtracker.com/ETid-523","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/3479","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/014","ETid-447","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-11-17","day",30000,null,"EUR","Provincial Health Authority of Cosenza","Public Sector and Education","Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9483375","https://www.enforcementtracker.com/ETid-447",null,null,null,null,"IT: provincial health authority of cosenza",null,null,null,null,null,null,null,null,null],["2020/IT/013","ETid-448","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-11-17","day",2000,null,"EUR","Comune di Collegno","Public Sector and Education","Art. 12, Art. 13, Art. 14","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9486531","https://www.enforcementtracker.com/ETid-448",null,null,null,null,"IT: comune di collegno",null,null,null,null,null,null,null,null,null],["2020/ES/156","AEPD (Spain) - PS/00187/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-11-16","day",null,"None","EUR","Secretaría General para la Innovación y Calidad del Servicio Público de Justicia",null,"Art. 25, Art. 32, Art. 34, Art. 5(1)(f)","Accountability, Data breach, Data principles, Data security",null,"Violation found","https://www.aepd.es/es/documento/ps-00187-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00187/2020",null,"gdprhub",null,null,"ES: secretaria general para la innovacion y calidad del servicio publico de justicia",null,null,null,null,null,null,null,null,null],["2020/NO/020","Datatilsynet (Norway) - 20/01984","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-11-16","day",null,"200000","NOK","Indre Østfold kommune (municipality)",null,"Art. 32(1)(b), Art. 5, Art. 6","Data principles, Data security, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/regelverk-og-verktoy/lover-og-regler/avgjorelser-fra-datatilsynet/2020/overtredelsesgebyr-til-indre-ostfold-kommune/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01984",null,"gdprhub",null,null,"NO: indre stfold kommune",null,200000.0,18638,"day 2020-11-16|10.7310|NOK",null,null,null,null,null],["2020/ES/018","ETid-445","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-16","day",1600,null,"EUR","Homeowners Association","Real Estate","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00353-2019.pdf","https://www.enforcementtracker.com/ETid-445",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/017","ETid-446","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-16","day",42000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00356-2020.pdf","https://www.enforcementtracker.com/ETid-446","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00356/2020","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/GB/001","ETid-440","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2020-11-13","day",1405000,null,"EUR","Ticketmaster UK Limited","Industry and Commerce","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media/action-weve-taken/2618609/ticketmaster-uk-limited-mpn.pdf","https://www.enforcementtracker.com/ETid-440","https://gdprhub.eu/index.php?title=ICO_-_Monetary_Penalty_on_Ticketmaster_UK_Limited","gdprhub",null,null,"ticketmaster uk ltd",null,null,null,null,null,null,null,null,null],["2020/BE/003","ETid-479","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-11-13","day",1500,null,"EUR",null,"Real Estate","Art. 12, Art. 13, Art. 30, Art. 37(5), Art. 37(7), Art. 5, Art. 6","Data principles, Data protection officer, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-73-2020.pdf","https://www.enforcementtracker.com/ETid-479","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_73/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/015","ETid-438","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-11-12","day",12251601,null,"EUR","Vodafone Italia S.p.A.","Media, Telecoms and Broadcasting","Art. 15(1), Art. 16, Art. 21, Art. 24, Art. 25(1), Art. 32, Art. 33, Art. 6(1), Art. 7","Accountability, Consent, Data breach, Data principles, Data security, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9485681","https://www.enforcementtracker.com/ETid-438",null,null,null,null,"vodafone italia spa","Vodafone",null,null,null,null,null,null,null,null],["2020/IT/068","Garante per la protezione dei dati personali (Italy) - 9485681","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-11-12","day",12250601,"12250601.00","EUR","Vodafone Italy S.p.A",null,"Art. 15(1), Art. 16, Art. 21, Art. 24, Art. 25(1), Art. 32, Art. 33(1), Art. 5, Art. 6, Art. 7","Accountability, Consent, Data breach, Data principles, Data security, Data subject rights, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9485754","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9485681",null,"gdprhub",null,null,"vodafone italy spa","Vodafone",null,null,null,null,null,null,null,null],["2020/PL/022","UODO (Poland) - DKN.5101.25.2020","gdprhub","Poland","PL","UODO (Poland)","2020-11-12","day",null,"None","EUR","Urbis sp. z o.o.",null,"Art. 24(1), Art. 25(1), Art. 32(1)(d), Art. 32(2), Art. 33(1), Art. 34(1), Art. 5(1)(f)","Accountability, Data breach, Data principles, Data security",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5101.25.2020","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5101.25.2020",null,"gdprhub",null,null,"urbis spzoo",null,null,null,null,null,null,null,null,null],["2020/ES/177","AEPD (Spain) - PS/00326/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-11-11","day",null,"None","EUR","Ayuntamiento de Mejorada del Campo",null,"Art. 37(1)(a)","Data protection officer",null,"Violation found","https://www.aepd.es/es/documento/ps-00326-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00326/2020",null,"gdprhub",null,null,"ES: ayuntamiento de mejorada del campo",null,null,null,null,null,null,null,null,null],["2020/DE/027","ETid-128","cms_tracker","Germany","DE","The Federal Commissioner for Data Protection and Freedom of Information (BfDI)","2020-11-11","day",900000,null,"EUR","1&1 Telecom GmbH","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.bfdi.bund.de/DE/Infothek/Pressemitteilungen/2019/30_BfDIverh%C3%A4ngtGeldbu%C3%9Fe1u1.html","https://www.enforcementtracker.com/ETid-128",null,null,null,"Telecoms provider","1 and 1 telecom gmbh",null,null,null,null,null,null,null,null,null],["2020/ES/019","ETid-444","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-11","day",42000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00348-2020.pdf","https://www.enforcementtracker.com/ETid-444",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/IE/011","DPC - C-19-X-XXX Ryanair DAC - November 2020","gdprhub","Ireland","IE","DPC (Ireland)","2020-11-10","day",null,"None","EUR","Ryanair DAC",null,"Art. 12(3), Art. 15, Art. 24(1), Art. 32(1), Art. 32(4), Art. 4(22), Art. 58(2)(b), Art. 60, Art. 60(3), Art. 60(4)","Accountability, Data security, Data subject rights, Transparency",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2021-02/10.11.2020_Decision_Complaint_RyanairDAC.pdf","https://gdprhub.eu/index.php?title=DPC_-_C-19-X-XXX_Ryanair_DAC_-_November_2020",null,"gdprhub",null,null,"ryanair dac",null,null,null,null,null,null,null,null,null],["2020/NO/017","Datatilsynet (Norway) - 20/01868","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-11-10","day",null,"None","EUR","Sbanken ASA",null,"Art. 16, Art. 5(1)(d)","Data principles, Data subject rights",null,"Rejected","https://pvn.no/pvn-2020-15","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01868",null,"gdprhub",null,null,"sbanken asa",null,null,null,null,null,null,null,null,null],["2020/ES/022","ETid-441","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-10","day",3000,null,"EUR","Miguel Ibáñez Bezanilla, S.L.","Industry and Commerce","Art. 13, Art. 32","Data security, Transparency","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00185-2020.pdf","https://www.enforcementtracker.com/ETid-441",null,null,null,null,"miguel ibanez bezanilla sl",null,null,null,null,null,null,null,null,null],["2020/BE/037","APD/GBA (Belgium) - 72/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-11-09","day",null,"None","EUR",null,null,"Art. 24(1), Art. 5(1)(b), Art. 7(3), Art. 9(2)","Accountability, Consent, Data principles, Special categories",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-72-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_72/2020",null,"gdprhub",null,"Hospital",null,null,null,null,null,null,null,null,null,null],["2020/NO/019","Datatilsynet (Norway) - 20/01949","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-11-09","day",null,"None","EUR","Arendal kommune",null,"Art. 12, Art. 13, Art. 13(2)(f), Art. 14, Art. 15, Art. 16, Art. 17(1)(d), Art. 24, Art. 30, Art. 32(2), Art. 35(1), Art. 35(10), Art. 35(7), Art. 5, Art. 5(1)(a), Art. 5(1)(d), Art. 6, Art. 6(1)(c), Art. 6(1)(e), Art. 6(2), Art. 6(3), Art. 9","Accountability, DPIA, Data principles, Data security, Data subject rights, Special categories, Transparency, Unlawful processing",null,"Violation found","https://pvn.no/pvn-2020-13","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01949",null,"gdprhub",null,null,"NO: arendal kommune",null,null,null,null,null,null,null,null,null],["2020/EU/001","EDPB - Binding Decision 1/2020 - 'Twitter'","gdprhub","European Union","EU","EDPB","2020-11-09","day",null,"None","EUR",null,null,"Art. 28, Art. 33(1), Art. 33(5), Art. 4(24), Art. 5(1)(f), Art. 60(4), Art. 65(1)(a)","Data breach, Data principles, Processor obligations",null,null,"https://edpb.europa.eu/sites/default/files/files/file1/edpb_bindingdecision01_2020_en.pdf","https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_1/2020_-_%27Twitter%27",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/023","ETid-439","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-06","day",20000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 31","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00365-2019.pdf","https://www.enforcementtracker.com/ETid-439","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00365/2019","gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/AT/017","DSB (Austria) - DSB-D124.1749","gdprhub","Austria","AT","DSB (Austria)","2020-11-05","day",null,null,null,"Public Employment Service Austria",null,"Art. 4(15), Art. 9(1), Art. 9(2)","Special categories",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20201105_2020_0_714_215_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_DSB-D124.1749",null,"gdprhub",null,null,"AT: public employment service austria",null,null,null,null,null,null,null,null,null],["2020/ES/025","ETid-436","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-05","day",75000,null,"EUR","Telefonica Moviles Espana, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00182-2020.pdf","https://www.enforcementtracker.com/ETid-436",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2020/DK/013","Datatilsynet (Denmark) - 2020-441-4364","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2020-11-04","day",null,"None","EUR","Copenhagen Zoo",null,"Art. 32, Art. 33, Art. 34, Art. 5(1)(a)","Data breach, Data principles, Data security",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/sikkerhedsbrud-hos-zoo","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-441-4364",null,"gdprhub",null,null,"DK: copenhagen zoo",null,null,null,null,null,null,null,null,null],["2020/ES/153","AEPD (Spain) - PS/00274/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-11-03","day",1500,"1500","EUR","Raise Marketing SL",null,"Art. 21","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00274-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00274/2020",null,"gdprhub",null,null,"raise marketing sl",null,null,null,null,null,null,null,null,null],["2020/ES/026","ETid-435","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-11-03","day",30000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00341-2020.pdf","https://www.enforcementtracker.com/ETid-435","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00341/2020","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/BE/032","APD/GBA (Belgium) - 71/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-10-30","day",null,"None","EUR",null,null,"Art. 4(1), Art. 6(1)","Unlawful processing",null,"Violation found","https://gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-71-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_71/2020",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2020/GB/002","ETid-60","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2020-10-30","day",20450000,null,"EUR","Marriott International, Inc","Accommodation and Hospitality","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media/action-weve-taken/mpns/2618524/marriott-international-inc-mpn-20201030.pdf","https://www.enforcementtracker.com/ETid-60","https://gdprhub.eu/index.php?title=ICO_-_Monetary_Penalty_on_Marriott_International_Inc.","gdprhub",null,null,"marriott international inc",null,null,null,null,null,null,null,null,null],["2020/ES/154","AEPD (Spain) - PS/00120/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-10-29","day",null,"None","EUR",null,null,"Art. 13","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00120-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00120/2020",null,"gdprhub",null,"Nursery school",null,null,null,null,null,null,null,null,null,null],["2020/ES/150","AEPD (Spain) - PS/00245/2019","gdprhub","Spain","ES","AEPD (Spain)","2020-10-29","day",null,"None","EUR","Departamento de Educación del Gobierno de Navarra",null,"Art. 13, Art. 5(1)(a), Art. 83(5)(a), Art. 83(5)(b), Art. 9(1)","Data principles, Special categories, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00245-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00245/2019",null,"gdprhub",null,null,"ES: departamento de educacion del gobierno de navarra",null,null,null,null,null,null,null,null,null],["2020/GR/002","ETid-484","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-10-29","day",1000,null,"EUR","American College of Greece","Public Sector and Education",null,"Transparency","Insufficient fulfilment of information obligations","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=89,72,206,138,129,101,238,220","https://www.enforcementtracker.com/ETid-484",null,null,null,null,"GR: american college of greece",null,null,null,null,null,null,null,null,null],["2020/IT/009","ETid-520","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-10-29","day",20000,null,"EUR","Gaypa s.r.l.","Employment","Art. 12, Art. 13","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9518890","https://www.enforcementtracker.com/ETid-520","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9518890","gdprhub",null,null,"gaypa srl",null,null,null,null,null,null,null,null,null],["2020/IT/008","ETid-521","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-10-29","day",4000,null,"EUR","Borgo Fonte Scura s.r.l.","Employment","Art. 13, Art. 5(1)(a)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9518849","https://www.enforcementtracker.com/ETid-521",null,null,null,null,"borgo fonte scura srl",null,null,null,null,null,null,null,null,null],["2020/ES/028","ETid-431","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-28","day",36000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00303-2020.pdf","https://www.enforcementtracker.com/ETid-431",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/027","ETid-434","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-28","day",4000,null,"EUR","Play Orenes, S.L.","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00003-2020.pdf","https://www.enforcementtracker.com/ETid-434","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00003/2020","gdprhub",null,null,"play orenes sl",null,null,null,null,null,null,null,null,null],["2020/IS/024","Persónuvernd - 2020010673","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-10-27","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 5(1)(e), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/urskurdur-um-vinnslu-personuupplysinga-af-halfu-elisu-gudrunar-ehf.-lifandi-visinda","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010673",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/016","ETid-433","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-10-26","day",20000,null,"EUR","Università Campus Bio-medico di Roma (Polyclinic)","Public Sector and Education","Art. 9","Data principles, Special categories","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9469345","https://www.enforcementtracker.com/ETid-433",null,null,null,null,"IT: universita campus bio medico di roma",null,null,null,null,null,null,null,null,null],["2020/ES/021","ETid-442","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-26","day",4000,null,"EUR","Organic Natur 03 S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00247-2020.pdf","https://www.enforcementtracker.com/ETid-442","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00247/2020","gdprhub",null,null,"organic natur 03 sl",null,null,null,null,null,null,null,null,null],["2020/ES/020","ETid-443","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-26","day",50000,null,"EUR","Conseguridad SL","Industry and Commerce","Art. 37","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.aepd.es/es/documento/ps-00251-2020.pdf","https://www.enforcementtracker.com/ETid-443","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00251/2020","gdprhub",null,null,"conseguridad sl",null,null,null,null,null,null,null,null,null],["2020/DE/001","ETid-1091","cms_tracker","Germany","DE","Data Protection Authority of Sachsen-Anhalt","2020-10-24","day",200,null,"EUR",null,"Individuals and Private Associations","Art. 32, Art. 5","Data principles, Data security","Non-compliance with general data processing principles","Fine issued","https://twitter.com/einrobert1/status/1320069240494432260?s=21","https://www.enforcementtracker.com/ETid-1091",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2020/HU/007","ETid-430","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-10-23","day",54800,null,"EUR","Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak","Industry and Commerce","Art. 12, Art. 15, Art. 18(1)(c), Art. 25","Accountability, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/files/NAIH-2020-2204-8-hatarozat.pdf","https://www.enforcementtracker.com/ETid-430","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH-2020/2204/8","gdprhub",null,null,"HU: deichmann cipokereskedelmi korlatolt felelossegu tarsasagnak",null,null,null,null,null,null,null,null,null],["2020/NO/015","Datatilsynet (Norway) - 20/02291","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-10-22","day",null,"750000","NOK","Sykehuset Østfold HF",null,"Art. 24, Art. 32, Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security",null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2020/overtredelsesgebyr-til-sykehuset-ostfold-hf/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02291",null,"gdprhub",null,null,"sykehuset stfold hf",null,750000.0,68603,"day 2020-10-22|10.9325|NOK",null,null,null,null,null],["2020/CY/001","ETid-432","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2020-10-22","day",6000,null,"EUR","Cyprus Police","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/B64595978C98EFCEC2258606003EC47E/$file/ΠΕΡΙΛΗΨΗ%20ΑΠΟΦΑΣΗΣ%20ΑΣΤΥΝΟΜΙΑΣ%2068-2017.pdf?openelement","https://www.enforcementtracker.com/ETid-432",null,null,null,null,"CY: cyprus police",null,null,null,null,null,null,null,null,null],["2020/ES/146","AEPD (Spain) - PS/00143/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-10-21","day",null,"None","EUR",null,null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00143-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00143/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/LT/002","ETid-429","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2020-10-21","day",15000,null,"EUR","Vilnius City Municipality Administration","Public Sector and Education","Art. 5(1)(d), Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/Savivaldybes%20administracija%20(viesasis)%202020.pdf","https://www.enforcementtracker.com/ETid-429","https://gdprhub.eu/index.php?title=VDAI_-_N/A","gdprhub",null,null,"LT: vilnius city municipality administration",null,null,null,null,null,null,null,null,null],["2020/RO/007","ETid-425","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-10-20","day",2000,null,"EUR","Globus Score SRL","Industry and Commerce","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Alta_amenda_pentru_incalcarea_RGPD_oct_2020&lang=ro","https://www.enforcementtracker.com/ETid-425",null,null,null,null,"globus score srl",null,null,null,null,null,null,null,null,null],["2020/SI/021","IP - 07121-1/2020/1869","gdprhub","Slovenia","SI","IP (Slovenia)","2020-10-20","day",null,"None","EUR",null,null,"Art. 6(1)(c)","Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=2010","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/1869",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2020/CY/003","ETid-421","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2020-10-19","day",1000,null,"EUR","Grant Ideas Ltd","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/B64595978C98EFCEC2258606003EC47E?OpenDocument","https://www.enforcementtracker.com/ETid-421",null,null,null,null,"grant ideas ltd",null,null,null,null,null,null,null,null,null],["2020/CY/002","ETid-422","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2020-10-19","day",15000,null,"EUR","Bank of Cyprus Public Company Ltd","Finance, Insurance and Consulting","Art. 15, Art. 32, Art. 33, Art. 5(1)(f), Art. 5(2)","Data breach, Data principles, Data security, Data subject rights","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/B64595978C98EFCEC2258606003EC47E?OpenDocument","https://www.enforcementtracker.com/ETid-422",null,null,null,null,"bank of cyprus public company ltd",null,null,null,null,null,null,null,null,null],["2020/AT/002","ETid-461","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2020-10-19","day",600,null,"EUR",null,"Health Care","Art. 5(1)(a), Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20201019_2020_0_111_488_00","https://www.enforcementtracker.com/ETid-461","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.111.488","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2020/AT/001","ETid-462","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2020-10-19","day",150,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20201019_2020_0_550_322_00","https://www.enforcementtracker.com/ETid-462","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.550.322","gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2020/HU/025","NAIH (Hungary) - NAIH/2020/5911/7","gdprhub","Hungary","HU","NAIH (Hungary)","2020-10-19","day",null,"None","EUR","MarkMyProfessor",null,"Art. 12, Art. 17","Data subject rights, Transparency",null,"Violation found","https://www.naih.hu/files/NAIH-2020-5911-7-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/5911/7",null,"gdprhub",null,null,"HU: markmyprofessor",null,null,null,null,null,null,null,null,null],["2020/ES/163","AEPD (Spain) - PS/00032/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-10-16","day",30000,"30000","EUR","IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA UNIPERSONAL",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00032-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00032/2020",null,"gdprhub",null,null,"iberia lineas aereas de espana sa operadora unipersonal",null,null,null,null,null,null,null,null,null],["2020/GB/003","ETid-58","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2020-10-16","day",22046000,null,"EUR","British Airways","Transportation and Energy","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/action-weve-taken/enforcement/british-airways/","https://www.enforcementtracker.com/ETid-58",null,null,null,null,"GB: british airways",null,null,null,null,null,null,null,null,null],["2020/GB/007","ICO - British Airways","gdprhub","United Kingdom","GB","ICO (UK)","2020-10-16","day",null,"20000000","GBP","British Airways",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2618421/ba-penalty-20201016.pdf","https://gdprhub.eu/index.php?title=ICO_-_British_Airways",null,"gdprhub",null,null,"GB: british airways",null,20000000.0,21998570,"day 2020-10-16|0.9092|GBP",null,null,null,null,null],["2020/RO/008","ETid-420","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-10-15","day",3000,null,"EUR","S.C. Marsorom S.R.L.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Amenda_pentru_incalcarea_RGPD_15_/_10_/_2020&lang=ro","https://www.enforcementtracker.com/ETid-420","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_S.C._Marsorom_S.R.L.","gdprhub",null,null,"marsorom srl",null,null,null,null,null,null,null,null,null],["2020/CY/012","Commissioner (Cyprus) - 11.17.001.008.029","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-10-14","day",null,"None","EUR",null,null,"Art. 24(1), Art. 24(2), Art. 25(1), Art. 25(2), Art. 32(1), Art. 32(2), Art. 5(1)","Accountability, Data principles, Data security",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/B0CED3EDDC2EE5EDC225868D0037E7A4/$file/%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20(%CE%91%CE%BD)%20%CE%A4%CE%B1%CE%BC%CE%B5%CE%AF%CE%BF%20%CE%95%CF%85%CE%B7%CE%BC%CE%B5%CF%81%CE%AF%CE%B1%CF%82%20%CE%A5%CF%80%CE%B1%CE%BB%CE%BB%CE%AE%CE%BB%CF%89%CE%BD%20%CE%91%CE%A4%CE%97%CE%9A.pdf?openelement","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.008.029",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/008","ETid-2819","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-10-14","day",12030,null,"EUR","Legal Person",null,"Art. 6(1)","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/137-cj-uoou-0184220-20-dokument-c-137.pdf","https://www.enforcementtracker.com/ETid-2819",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/147","AEPD (Spain) - PS/00023/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-10-13","day",null,"None","EUR",null,null,"Art. 5(1)(c), Art. 58(2)(b), Art. 83(5)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00023-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00023/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/GB/008","ICO - Enforcement Notice against Experian","gdprhub","United Kingdom","GB","ICO (UK)","2020-10-12","day",null,"None","EUR","Experian Limited",null,"Art. 14, Art. 5(1), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://ico.org.uk/media/action-weve-taken/enforcement-notices/2618467/experian-limited-enforcement-report.pdf","https://gdprhub.eu/index.php?title=ICO_-_Enforcement_Notice_against_Experian",null,"gdprhub",null,null,"experian ltd","Experian",null,null,null,null,null,null,null,null],["2020/ES/035","ETid-415","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-09","day",900,null,"EUR","Café Restaurante B.B.B","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00035-2020.pdf","https://www.enforcementtracker.com/ETid-415",null,null,null,null,"ES: cafe restaurante bbb",null,null,null,null,null,null,null,null,null],["2020/ES/034","ETid-417","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-09","day",2000,null,"EUR",null,"Individuals and Private Associations","Art. 5(1)(c), Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00312-2019.pdf","https://www.enforcementtracker.com/ETid-417","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00194/2020","gdprhub",null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2020/ES/033","ETid-418","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-09","day",50000,null,"EUR","Centro de Investigación y Estudio para la Obesidad, SL","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00206-2019.pdf","https://www.enforcementtracker.com/ETid-418",null,null,null,null,"centro de investigacion y estudio para la obesidad sl",null,null,null,null,null,null,null,null,null],["2020/ES/032","ETid-419","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-09","day",5000,null,"EUR","Caja Rural San José de Nules S. Cooperativa de Crédito","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00058-2019.pdf","https://www.enforcementtracker.com/ETid-419",null,null,null,null,"ES: caja rural san jose de nules s cooperativa de credito",null,null,null,null,null,null,null,null,null],["2020/ES/037","ETid-411","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-06","day",60000,null,"EUR","Lycamobile","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00069-2020.pdf","https://www.enforcementtracker.com/ETid-411","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00069/2020","gdprhub",null,null,"ES: lycamobile",null,null,null,null,null,null,null,null,null],["2020/ES/030","ETid-424","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-06","day",4000,null,"EUR","Callesgarcia, S.L.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00028-2020.pdf","https://www.enforcementtracker.com/ETid-424",null,null,null,null,"callesgarcia sl",null,null,null,null,null,null,null,null,null],["2020/GB/021","ICO - Studios MG Limited (Monetary Penalty)","gdprhub","United Kingdom","GB","ICO (UK)","2020-10-06","day",null,"40000","GBP","Studios MG Limited",null,null,null,null,null,"https://ico.org.uk/media/action-weve-taken/mpns/2618388/studios-mg-limited-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_-_Studios_MG_Limited_%28Monetary_Penalty%29",null,"gdprhub",null,null,"studios mg ltd",null,40000.0,43928,"day 2020-10-06|0.9106|GBP",null,null,null,null,null],["2020/IS/021","Persónuvernd - 2020082249","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-10-05","day",null,"None","EUR",null,null,"Art. 85",null,null,null,"https://www.personuvernd.is/urlausnir/alit-personuvernd-og-tjaningarfrelsi-fjolmidla","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020082249",null,"gdprhub",null,"Media company",null,null,null,null,null,null,null,null,null,null],["2020/ES/031","ETid-423","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-10-03","day",3000,null,"EUR","Avata Hispania, S.L.","Industry and Commerce","Art. 28(3)(g), Art. 5, Art. 6","Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00245-2020.pdf","https://www.enforcementtracker.com/ETid-423",null,null,null,null,"avata hispania sl",null,null,null,null,null,null,null,null,null],["2020/DE/025","ETid-405","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020-10-01","day",35258708,null,"EUR","H&M Hennes & Mauritz Online Shop A.B. & Co. KG","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/pressemitteilungen/2020/10/2020-10-01-h-m-verfahren","https://www.enforcementtracker.com/ETid-405",null,null,null,null,"h and m hennes and mauritz online shop ab and co kg",null,null,null,null,null,null,null,null,null],["2020/RO/010","ETid-412","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-10-01","day",3000,null,"EUR","Megareduceri TV S.R.L.","Industry and Commerce","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_01_/_10_/_2020&lang=ro","https://www.enforcementtracker.com/ETid-412",null,null,null,null,"megareduceri tv srl",null,null,null,null,null,null,null,null,null],["2020/RO/009","ETid-413","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-10-01","day",2000,null,"EUR","Asociația de proprietari Militari R","Real Estate","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_01_/_10_/_2020&lang=ro","https://www.enforcementtracker.com/ETid-413",null,null,null,null,"RO: asociatia de proprietari militari r",null,null,null,null,null,null,null,null,null],["2020/CY/013","Commissioner (Cyprus) - Α/Π 68/2017","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-09-30","day",6000,"6000","EUR","Cyprus Police",null,"Art. 32(1)(b), Art. 32(1)(d), Art. 32(4), Art. 58(2)(a), Art. 58(2)(b), Art. 58(2)(e), Art. 58(2)(i)","Data security",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/B64595978C98EFCEC2258606003EC47E/$file/%CE%A0%CE%95%CE%A1%CE%99%CE%9B%CE%97%CE%A8%CE%97%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%CE%A3%20%CE%91%CE%A3%CE%A4%CE%A5%CE%9D%CE%9F%CE%9C%CE%99%CE%91%CE%A3%2068-2017.pdf?openelement","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_%CE%91/%CE%A0_68/2017",null,"gdprhub",null,null,"CY: cyprus police",null,null,null,null,null,null,null,null,null],["2020/CZ/003","ETid-2828","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-09-30","day",20050,null,"EUR","Legal Person","Industry and Commerce","Art. 14, Art. 15, Art. 5(1)(a), Art. 6(1)","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/165-cj-uoou-0415320-4-dokument-c-165.pdf","https://www.enforcementtracker.com/ETid-2828",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/019","ETid-406","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-09-30","day",80000,null,"EUR","Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital)","Health Care","Art. 13, Art. 28, Art. 32, Art. 5(1)(a), Art. 6","Data principles, Data security, Processor obligations, Transparency, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9461168","https://www.enforcementtracker.com/ETid-406","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9461168","gdprhub",null,null,"IT: azienda ospedaliera di rilievo nazionale antonio cardarelli",null,null,null,null,null,null,null,null,null],["2020/IT/018","ETid-407","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-09-30","day",60000,null,"EUR","Scanshare s.r.l.","Industry and Commerce","Art. 32, Art. 5(1)(a), Art. 6, Art. 9","Data principles, Data security, Special categories, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9461321","https://www.enforcementtracker.com/ETid-407",null,null,null,null,"scanshare srl",null,null,null,null,null,null,null,null,null],["2020/ES/036","ETid-414","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-30","day",3000,null,"EUR","Venu Sanz Chef, S.L.","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00249-2020.pdf","https://www.enforcementtracker.com/ETid-414","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00249/2020","gdprhub",null,null,"venu sanz chef sl",null,null,null,null,null,null,null,null,null],["2020/GB/020","ICO - IC-46167-S7N1","gdprhub","United Kingdom","GB","ICO (UK)","2020-09-30","day",null,"None","EUR","Neath Port Talbot Council",null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2618378/ic-46167-s7n1.pdf","https://gdprhub.eu/index.php?title=ICO_-_IC-46167-S7N1",null,"gdprhub",null,null,"GB: neath port talbot council",null,null,null,null,null,null,null,null,null],["2020/BE/031","APD/GBA (Belgium) - 64/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-09-29","day",15000,"15000","EUR",null,null,"Art. 12(3), Art. 17(1)(a), Art. 5(1), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-64-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_64/2020",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/IE/013","DPC - Health Service Executive (IN-19-9-2)","gdprhub","Ireland","IE","DPC (Ireland)","2020-09-29","day",null,"None","EUR",null,null,"Art. 32(1), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.dataprotection.ie/sites/default/files/uploads/2021-02/18.08.2020_%26_29.09.2020_Decisions_IN-19-9-1_%26_IN-19-9-2_HSE.pdf","https://gdprhub.eu/index.php?title=DPC_-_Health_Service_Executive_%28IN-19-9-2%29",null,"gdprhub",null,"HSE",null,null,null,null,null,null,null,null,null,null],["2020/IS/023","Persónuvernd - 2020010628","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-09-29","day",null,"None","EUR",null,null,"Art. 32, Art. 5, Art. 6, Art. 6(1)(c), Art. 9(1), Art. 9(2), Art. 9(2)(b)","Data principles, Data security, Special categories, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/urskurdur-um-vinnslu-vidkvaemra-personuupplysinga-af-halfu-opinberrar-stofnunar-og-sveitarfelags","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010628",null,"gdprhub",null,"Municipality",null,null,null,null,null,null,null,null,null,null],["2020/ES/172","AEPD (Spain) - TD/00129/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-09-28","day",null,"None","EUR","Xfera Móviles SA",null,"Art. 12, Art. 15, Art. 4(1), Art. 4(2)","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/es/documento/td-00129-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00129/2020",null,"gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/AT/009","DSB (Austria) - 2020-0.605.768","gdprhub","Austria","AT","DSB (Austria)","2020-09-28","day",null,"None","EUR",null,null,"Art. 40, Art. 41(1), Art. 41(2)(c), Art. 57(1)(p), Art. 57(1)(q), Art. 70(1)(n)",null,null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200928_2020_0_605_768_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.605.768",null,"gdprhub","A*** GmbH (commercial register code: FN *5*1*91r)",null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/020","ETid-2794","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-09-25","day",400,null,"EUR","Legal Person",null,"Art. 13(1), Art. 28(3), Art. 30","Processor obligations, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/158-cj-uoou-0343220-3-dokument-c-158.pdf","https://www.enforcementtracker.com/ETid-2794",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/019","ETid-2795","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-09-25","day",400,null,"EUR","Legal Person","Media, Telecoms and Broadcasting","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/157-cj-uoou-0336620-2-dokument-c-157.pdf","https://www.enforcementtracker.com/ETid-2795",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/038","ETid-408","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-25","day",60000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00024-2020.pdf","https://www.enforcementtracker.com/ETid-408",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/NO/002","ETid-416","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-09-25","day",13900,null,"EUR","Odin Flissenter AS","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/44c6c9df0ee64fdc9f704f8ca930d4ce/vedtak-om-otg-odin-flissenter.pdf","https://www.enforcementtracker.com/ETid-416",null,null,null,null,"odin flissenter as",null,null,null,null,null,null,null,null,null],["2020/BE/029","APD/GBA (Belgium) - 63/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-09-22","day",null,"None","EUR","Google",null,"Art. 12(4), Art. 17","Data subject rights, Transparency",null,"Other Outcome","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-63-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_63/2020",null,"gdprhub",null,null,"BE: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2020/DK/012","Datatilsynet (Denmark) - 2019-431-0037","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2020-09-22","day",null,"None","EUR","Kombit A/S",null,"Art. 28(1), Art. 32","Data security, Processor obligations",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/sep/sikkerhedsbrud-i-systemet-flis","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-431-0037",null,"gdprhub",null,null,"kombit as",null,null,null,null,null,null,null,null,null],["2020/ES/039","ETid-404","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-22","day",60000,null,"EUR","GLP Instalaciones 86, SL","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00079-2020.pdf","https://www.enforcementtracker.com/ETid-404","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00079/2020","gdprhub",null,null,"glp instalaciones 86 sl",null,null,null,null,null,null,null,null,null],["2020/ES/029","ETid-426","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-22","day",7800,null,"EUR","Iweb Internet Learning, S.L.","Industry and Commerce","Art. 12, Art. 13, Art. 7","Consent, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00234-2020.pdf","https://www.enforcementtracker.com/ETid-426",null,null,null,null,"iweb internet learning sl",null,null,null,null,null,null,null,null,null],["2020/GB/006","ICO - Digital Growth Experts Limited","gdprhub","United Kingdom","GB","ICO (UK)","2020-09-22","day",null,"60000","GBP","Digital Growth Experts Limited",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2618330/dgel-mpn-20200922.pdf","https://gdprhub.eu/index.php?title=ICO_-_Digital_Growth_Experts_Limited",null,"gdprhub",null,null,"digital growth experts ltd",null,60000.0,65400,"day 2020-09-22|0.9174|GBP",null,null,null,null,null],["2020/BE/035","APD/GBA (Belgium) - 80/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-09-17","day",null,"None","EUR",null,null,null,null,null,"Rejected","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-80-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_80/2020",null,"gdprhub",null,"Car wash",null,null,null,null,null,null,null,null,null,null],["2020/CZ/010","ETid-2813","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-09-17","day",3200,null,"EUR","Legal Person","Media, Telecoms and Broadcasting","Art. 15(1), Art. 17(1), Art. 6(1)","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/149-cj-uoou-0280720-3-dokument-c-149.pdf","https://www.enforcementtracker.com/ETid-2813",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/043","ETid-396","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-17","day",60000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00186-2020.pdf","https://www.enforcementtracker.com/ETid-396",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/042","ETid-397","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-17","day",3000,null,"EUR","Grupo Carolizan","Industry and Commerce","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00311-2019.pdf","https://www.enforcementtracker.com/ETid-397",null,null,null,null,"ES: grupo carolizan",null,null,null,null,null,null,null,null,null],["2020/ES/171","AEPD (Spain) - TD/00085/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-09-16","day",null,"None","EUR","Baby Palace S.L.",null,"Art. 12, Art. 13, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/es/documento/td-00085-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00085/2020",null,"gdprhub",null,null,"baby palace sl",null,null,null,null,null,null,null,null,null],["2020/NO/016","Datatilsynet (Norway) - 17/01281","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-09-16","day",null,"None","EUR",null,null,"Art. 58(2)(b), Art. 6(1)(f)","Unlawful processing",null,null,"https://pvn.no/pvn-2020-11","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_17/01281",null,"gdprhub",null,"Missionary organisation",null,null,null,null,null,null,null,null,null,null],["2020/ES/041","ETid-398","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-16","day",10000,null,"EUR","Property owners community","Real Estate","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00034-2020.pdf","https://www.enforcementtracker.com/ETid-398","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00034/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/065","Garante per la protezione dei dati personali (Italy) - 9451049","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-09-15","day",null,"None","EUR",null,null,null,null,null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9451049","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9451049",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/ES/040","ETid-399","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-11","day",1500,null,"EUR","Political Party","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00051-2020.pdf","https://www.enforcementtracker.com/ETid-399",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/GR/003","ETid-400","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-09-11","day",8000,null,"EUR",null,"Individuals and Private Associations","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=44,255,240,178,22,240,143,187","https://www.enforcementtracker.com/ETid-400",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2020/SI/020","IP - 07121-1/2020/1570","gdprhub","Slovenia","SI","IP (Slovenia)","2020-09-11","day",null,"None","EUR",null,null,"Art. 58, Art. 6(3)","Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1911","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/1570",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/IS/018","Persónuvernd - 2020010592","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-09-11","day",null,"None","EUR","Creditinfo Lánstraust",null,"Art. 15, Art. 4(1), Art. 4(2), Art. 4(4), Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-creditinfo-lanstrausts-hf.-a-personuupplysingum-i-tengslum-vid-gerd-lanshaefismats-og-adgangs-og-upplysingarettur","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010592",null,"gdprhub",null,null,"IS: creditinfo lanstraust",null,null,null,null,null,null,null,null,null],["2020/BE/030","APD/GBA (Belgium) - 61/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-09-08","day",null,"None","EUR",null,null,"Art. 5(1)(c), Art. 5(1)(d), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-61-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_61/2020",null,"gdprhub",null,"Environmental regulation enforcement agency",null,null,null,null,null,null,null,null,null,null],["2020/AT/014","DSB (Austria) - 2020-0.436.002","gdprhub","Austria","AT","DSB (Austria)","2020-09-08","day",null,"None","EUR","N***AdressverlagsgmbH",null,"Art. 12(1), Art. 15(1), Art. 15(1)(h), Art. 22(1), Art. 22(4), Art. 4(1), Art. 4(4)","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200908_2020_0_436_002_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.436.002",null,"gdprhub",null,null,"AT: n adressverlagsgmbh",null,null,null,null,null,null,null,null,null],["2020/CZ/007","ETid-2820","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-09-08","day",2000,null,"EUR","Legal Person",null,"Art. 17(1), Art. 6(1)","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/136-cj-uoou-0157420-14-dokument-c-136.pdf","https://www.enforcementtracker.com/ETid-2820",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/PL/007","ETid-392","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-09-08","day",11200,null,"EUR","Warsaw University of Life Sciences","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uodo.gov.pl/decyzje/ZSOŚS.421.25.2019","https://www.enforcementtracker.com/ETid-392",null,null,null,null,"PL: warsaw university of life sciences",null,null,null,null,null,null,null,null,null],["2020/RO/011","ETid-401","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-09-08","day",2000,null,"EUR","Sanatatea Press Group S.R.L.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_08_/_09_/_20&lang=ro","https://www.enforcementtracker.com/ETid-401","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Sanatatea_Press_Group_S.R.L.","gdprhub",null,null,"sanatatea press group srl",null,null,null,null,null,null,null,null,null],["2020/NO/014","Datatilsynet (Norway)- 20/02254","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-09-07","day",null,"None","EUR","OpenX Software Ltd., OpenX Ltd. og OpenX Technologies, Inc.",null,"Art. 57(1)(a), Art. 57(1)(f), Art. 58(1)",null,null,"Rejected","https://pvn.no/pvn-2020-12","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29-_20/02254",null,"gdprhub",null,null,"openx software ltd openx ltd og openx technologies inc",null,null,null,null,null,null,null,null,null],["2020/ES/044","ETid-390","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-07","day",3000,null,"EUR","Barcelona Airport Security Guard Association ('AVSAB')","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00188-2020.pdf","https://www.enforcementtracker.com/ETid-390",null,null,null,null,"ES: barcelona airport security guard association",null,null,null,null,null,null,null,null,null],["2020/IT/020","ETid-402","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-09-07","day",2000,null,"EUR","Istituto Comprensivo Statale Crucoli Torretta","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9451734","https://www.enforcementtracker.com/ETid-402","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9451734","gdprhub",null,null,"IT: istituto comprensivo statale crucoli torretta",null,null,null,null,null,null,null,null,null],["2020/BE/005","ETid-403","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-09-07","day",5000,null,"EUR","Former mayor of a community","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-53-2020.pdf","https://www.enforcementtracker.com/ETid-403","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_53/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/GR/021","HDPA (Greece) - 32/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-09-07","day",null,"None","EUR","Ministry of Education and Religious Affairs",null,"Art. 5(1), Art. 9","Data principles, Special categories",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema=PORTAL","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_32/2020",null,"gdprhub",null,null,"GR: ministry of education and religious affairs",null,null,null,null,null,null,null,null,null],["2020/GR/023","HDPA (Greece) - 31/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-09-04","day",null,"None","EUR",null,null,"Art. 4(1), Art. 4(2), Art. 5, Art. 6","Data principles, Unlawful processing",null,"Rejected","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=171,95,100,79,195,12,73,95","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_31/2020",null,"gdprhub",null,"Shop (employer)",null,null,null,null,null,null,null,null,null,null],["2020/GB/005","ICO - CPS Advisory Limited","gdprhub","United Kingdom","GB","ICO (UK)","2020-09-04","day",null,"130000","GBP","CPS Advisory Limited",null,null,null,null,null,"https://ico.org.uk/media/action-weve-taken/mpns/2618232/cps-advisory-limited-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_-_CPS_Advisory_Limited",null,"gdprhub",null,null,"cps advisory ltd",null,130000.0,145536,"day 2020-09-04|0.8932|GBP",null,null,null,null,null],["2020/IS/019","Persónuvernd - 2020010649","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-09-04","day",null,"None","EUR","Íslandsbanki",null,"Art. 24, Art. 25, Art. 25(2), Art. 32, Art. 5(1)(f)","Accountability, Data principles, Data security",null,"Violation found","https://www.personuvernd.is/urlausnir/ovidkomandi-veittur-lesadgangur-i-heimabanka-ad-vorslusafni-verdbrefaeignar-vidskiptamanns-hja-islandsbanka#","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010649",null,"gdprhub",null,null,"IS: islandsbanki",null,null,null,null,null,null,null,null,null],["2020/NO/008","ETid-292","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-09-03","day",276000,null,"EUR","Bergen Municipality","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/fd5c454b4eae4924af94943ba68002bf/20_02181-3-vedtak-om-overtredelsesgebyr---bergen-kommune.pdf","https://www.enforcementtracker.com/ETid-292",null,null,null,null,"NO: bergen municipality",null,null,null,null,null,null,null,null,null],["2020/IT/017","ETid-428","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-09-03","day",2000,null,"EUR","Comune di Casaloldo","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9468523","https://www.enforcementtracker.com/ETid-428","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9468523","gdprhub",null,null,"IT: comune di casaloldo",null,null,null,null,null,null,null,null,null],["2020/ES/140","AEPD (Spain) - PS/00086/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-09-01","day",null,"None","EUR","ASOCIACIÓN DE TÉCNICOS Y PROFESIONALES DEL SECTOR AEROESPACIAL",null,"Art. 5(1)(f), Art. 83(5)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00086-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00086/2020",null,"gdprhub",null,null,"ES: asociacion de tecnicos y profesionales del sector aeroespacial",null,null,null,null,null,null,null,null,null],["2020/AT/010","DSB (Austria) - 2020-0.303.727","gdprhub","Austria","AT","DSB (Austria)","2020-09-01","day",null,"None","EUR","Verein N***",null,"Art. 17(1), Art. 85(1), Art. 85(2)","Data subject rights",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200901_2020_0_303_727_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.303.727",null,"gdprhub",null,null,"AT: verein n",null,null,null,null,null,null,null,null,null],["2020/NO/018","Datatilsynet (Norway) - 20/02006","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-09-01","day",null,"400000","NOK","Norwegian Customs",null,null,null,null,"Violation found","https://www.datatilsynet.no/contentassets/bf78561e4fc948c0a417658f1cf76cca/tolldirektoratet-vedtak.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02006",null,"gdprhub",null,null,"NO: norwegian customs",null,400000.0,38322,"day 2020-09-01|10.4378|NOK",null,null,null,null,null],["2020/ES/045","ETid-389","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-09-01","day",75000,null,"EUR","Telefónica Móviles España, SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00198-2020.pdf","https://www.enforcementtracker.com/ETid-389",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2020/RO/012","ETid-395","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-09-01","day",500,null,"EUR","Apartment building owners association","Real Estate","Art. 12, Art. 13, Art. 25, Art. 32, Art. 5, Art. 6","Accountability, Data principles, Data security, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_01_09_2020&lang=ro","https://www.enforcementtracker.com/ETid-395","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Asocia%C8%9Bia_de_proprietari_Bl._FC_5%2C_ora%C8%99ul_N%C4%83vodari%2C_jude%C8%9Bul_Constan%C8%9Ba","gdprhub",null,null,"RO: apartment building owners association",null,null,null,null,null,null,null,null,null],["2020/CZ/005","ETid-2822","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-08-31","day",1200,null,"EUR","Legal Person","Finance, Insurance and Consulting","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/131-cj-uoou-0107620-11-dokument-c-131.pdf","https://www.enforcementtracker.com/ETid-2822",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/PL/008","ETid-387","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-08-31","day",22700,null,"EUR","Surveyor General of Poland ('GKK')","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/decyzje/DKN.5112.13.2020","https://www.enforcementtracker.com/ETid-387","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.13.2020","gdprhub",null,null,"PL: surveyor general of poland",null,null,null,null,null,null,null,null,null],["2020/CZ/017","ETid-2800","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-08-28","day",2000,null,"EUR","Legal Person","Industry and Commerce","Art. 12(3)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/152-cj-uoou-0299920-3-dokument-c-152.pdf","https://www.enforcementtracker.com/ETid-2800",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/048","ETid-385","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-08-28","day",50000,null,"EUR","Bankia S.A.","Finance, Insurance and Consulting","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00076-2020.pdf","https://www.enforcementtracker.com/ETid-385","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00076/2020","gdprhub",null,null,"bankia sa",null,null,null,null,null,null,null,null,null],["2020/ES/047","ETid-386","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-08-28","day",5000,null,"EUR","Basketball Federation of Castilla and Leon","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00200-2020.pdf","https://www.enforcementtracker.com/ETid-386","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00200/2020","gdprhub",null,null,"ES: basketball federation of castilla and leon",null,null,null,null,null,null,null,null,null],["2020/GB/019","ICO - IC-45844-V2X8","gdprhub","United Kingdom","GB","ICO (UK)","2020-08-28","day",null,"None","EUR","NHS West Sussex Clinical Commissioning Group",null,"Art. 5(1)(a), Art. 6(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2618241/ic-45844-v2x8.pdf","https://gdprhub.eu/index.php?title=ICO_-_IC-45844-V2X8",null,"gdprhub",null,null,"GB: nhs west sussex clinical commissioning group",null,null,null,null,null,null,null,null,null],["2020/IS/008","Persónuvernd - 2020010343","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-08-27","day",null,"None","EUR","Húsasmiðjan",null,"Art. 4(2), Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 58(2)(f), Art. 9(1)","Data principles, Special categories",null,"Violation found","https://www.personuvernd.is/urlausnir/akvordun-um-notkun-husasmidjunnar-ehf.-a-fingrafaraskanna-vid-inn-og-utskraningu-starfsmanna-i-launakerfi-felagsins","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010343",null,"gdprhub",null,null,"IS: husasmijan",null,null,null,null,null,null,null,null,null],["2020/IS/009","Persónuvernd - 2020010550","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-08-27","day",null,"None","EUR",null,null,"Art. 4(1), Art. 6","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/birting-personuupplysinga-a-facebook-sidu-einstaklings-1","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010550",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2020/IS/020","Persónuvernd - 2020010610","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-08-27","day",null,"None","EUR",null,null,"Art. 4(1), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/birting-personuupplysinga-a-facebook-sidu-einstaklings","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010610",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["2020/GR/022","HDPA (Greece) - 30/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-08-26","day",8000,"8000","EUR",null,null,"Art. 2(2)(c), Art. 24(1), Art. 32, Art. 4(1), Art. 5(1), Art. 5(2), Art. 58(2), Art. 6, Art. 83","Accountability, Data principles, Data security, Unlawful processing",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema=PORTAL","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_30/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SI/019","IP - 07126-1/2020/29","gdprhub","Slovenia","SI","IP (Slovenia)","2020-08-25","day",null,"None","EUR",null,null,"Art. 4(7), Art. 4(8)",null,null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1855","https://gdprhub.eu/index.php?title=IP_-_07126-1/2020/29",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/018","IP - 07121-1/2020/1159","gdprhub","Slovenia","SI","IP (Slovenia)","2020-08-23","day",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1831","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/1159",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/ES/145","AEPD (Spain) - PS/00075/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-08-21","day",3000,"3000","EUR",null,null,"Art. 13, Art. 6(1)(a), Art. 83(5)(a), Art. 83(5)(b)","Transparency, Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00075-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00075/2020",null,"gdprhub",null,"Gas installation company",null,null,null,null,null,null,null,null,null,null],["2020/ES/143","AEPD (Spain) - PS/00095/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-08-21","day",null,"None","EUR","Ayuntamiento de Burgos (Burgos City Hall)",null,"Art. 5(1)(b), Art. 5(1)(f), Art. 83(5)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00095-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00095/2020",null,"gdprhub",null,null,"ES: ayuntamiento de burgos",null,null,null,null,null,null,null,null,null],["2020/NO/013","Datatilsynet (Norway) - 20/01865","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-08-21","day",null,"None","EUR","Bodø Kommunale Pensjonskasse (BKP)",null,"Art. 2, Art. 4(1), Art. 5, Art. 57, Art. 58(2)(b), Art. 6, Art. 9","Data principles, Special categories, Unlawful processing",null,"Violation found","https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&ved=2ahUKEwj6uv6X3urrAhXBFXcKHQK0AkIQFjAAegQIBxAB&url=https%3A%2F%2Fwww.datatilsynet.no%2Fcontentassets%2F01bfcb0a153743eea534fa4795ddbeaa%2F~-20_01865-1-varsel-om-irettesettelse-207774_1_0.pdf&usg=AOvVaw2NXRkn_TdOnluKaFp0gRFE","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/01865",null,"gdprhub",null,null,"NO: bod kommunale pensjonskasse",null,null,null,null,null,null,null,null,null],["2020/PL/021","UODO (Poland) - ZSOŚS.421.25.2019","gdprhub","Poland","PL","UODO (Poland)","2020-08-21","day",null,"50000","PLN","The Warsaw University of Life Sciences",null,"Art. 24(1), Art. 25(1), Art. 30(1)(d), Art. 32(1)(b), Art. 32(1)(d), Art. 32(2), Art. 38(1), Art. 39(1)(b), Art. 39(2), Art. 5(1)(e), Art. 5(1)(f), Art. 5(2), Art. 83(1), Art. 83(2), Art. 83(3), Art. 83(4)(a), Art. 83(5)(a)","Accountability, Data principles, Data protection officer, Data security",null,"Violation found","https://www.uodo.gov.pl/decyzje/ZSO%C5%9AS.421.25.2019","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSO%C5%9AS.421.25.2019",null,"gdprhub",null,null,"PL: the warsaw university of life sciences",null,50000.0,11369,"day 2020-08-21|4.3979|PLN",null,null,null,null,null],["2020/IE/004","ETid-449","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2020-08-18","day",65000,null,"EUR","Cork University Maternity Hospital","Health Care","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.irishexaminer.com/news/arid-40075673.html","https://www.enforcementtracker.com/ETid-449","https://gdprhub.eu/index.php?title=DPC_-_Health_Service_Executive_-_August_2020_%28IN-19-9-1%29","gdprhub",null,null,"IE: cork university maternity hospital",null,null,null,null,null,null,null,null,null],["2020/IS/022","Persónuvernd - 2020010601","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-08-18","day",null,"None","EUR",null,null,"Art. 15, Art. 4(1)","Data subject rights",null,"Violation found","https://www.personuvernd.is/urlausnir/urskurdur-um-rett-einstaklings-til-upplysinga-um-uppflettingar-i-malaskrarkerfi-rikislogreglustjora-loke","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010601",null,"gdprhub",null,"Police",null,null,null,null,null,null,null,null,null,null],["2020/EE/001","ETid-1427","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2020-08-17","day",56,null,"EUR","Health care worker","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aki.ee/et/uudised/uudishimuparing-toi-vaarteotrahvi","https://www.enforcementtracker.com/ETid-1427",null,null,null,null,"EE: health care worker",null,null,null,null,null,null,null,null,null],["2020/ES/049","ETid-383","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-08-17","day",5000,null,"EUR","Party of the Socialists of Catalonia","Public Sector and Education","Art. 5(1)(b)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00449-2019.pdf","https://www.enforcementtracker.com/ETid-383",null,null,null,null,"ES: party of the socialists of catalonia",null,null,null,null,null,null,null,null,null],["2020/EE/005","ETid-384","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2020-08-17","day",48,null,"EUR","Police Officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aki.ee/et/uudised/uudishimuparing-toi-vaarteotrahvi","https://www.enforcementtracker.com/ETid-384",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/IS/017","Persónuvernd - 2020010678","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-08-17","day",null,"None","EUR","Creditinfo",null,"Art. 5(1), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-creditinfo-lanstrausts-hf.-a-upplysingum-um-fyrri-skraningar-a-vanskilaskra-vid-gerd-skyrslna-um-lanshaefi","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010678",null,"gdprhub",null,null,"IS: creditinfo",null,null,null,null,null,null,null,null,null],["2020/FI/013","Tietosuojavaltuutetun toimisto (Finland) - 6652/154/19","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2020-08-13","day",null,null,null,null,null,"Art. 17(3)(b), Art. 17(3)(e)","Data subject rights",null,"Rejected","https://www.finlex.fi/fi/viranomaiset/tsv/2020/20202143","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_6652/154/19",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2020/IE/001","ETid-570","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2020-08-12","day",85000,null,"EUR","Tusla Child and Family Agency","Public Sector and Education","Art. 32(1)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ie/sites/default/files/uploads/2021-02/12.08.2020_Decision_Tusla_IN-18-11-04.pdf","https://www.enforcementtracker.com/ETid-570",null,null,null,null,"IE: tusla child and family agency",null,null,null,null,null,null,null,null,null],["2020/ES/170","AEPD (Spain) - PS/00452/2019","gdprhub","Spain","ES","AEPD (Spain)","2020-08-11","day",80000,"80000","EUR","ORANGE ESPAGNE S.A.U.",null,"Art. 6(1)(a), Art. 83(5)(a)","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/reposicion-ps-00452-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00452/2019",null,"gdprhub",null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2020/GR/019","HDPA (Greece) - 27/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-08-11","day",null,"None","EUR","Ministry of Foreign Affairs",null,"Art. 32, Art. 58(2)(d)","Data security",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2020&_piref33_15473_33_15453_15453.arithmosApofasis=27%2F2020&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_27/2020",null,"gdprhub",null,null,"GR: ministry of foreign affairs",null,null,null,null,null,null,null,null,null],["2020/IT/031","ETid-366","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-08-10","day",10000,null,"EUR","Cavauto S.R.L.","Employment","Art. 5, Art. 6, Art. 7","Consent, Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9446730","https://www.enforcementtracker.com/ETid-366",null,null,null,null,"cavauto srl",null,null,null,null,null,null,null,null,null],["2020/IT/030","ETid-367","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-08-10","day",10000,null,"EUR","Community of Baronissi","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9446659","https://www.enforcementtracker.com/ETid-367","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9446659","gdprhub",null,null,"IT: community of baronissi",null,null,null,null,null,null,null,null,null],["2020/ES/138","AEPD (Spain) - PS/00188/2020","gdprhub","Spain","ES","AEPD (Spain)","2020-08-06","day",1800,"1800","EUR","ASOCIACIÓN DE VIGILANTES DE SEGURIDAD DEL AEROPUERTO DE BARCELONA",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://gdprhub.eu/index.php?title=AEPD_-_PS/000453/2019","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00188/2020",null,"gdprhub",null,null,"ES: asociacion de vigilantes de seguridad del aeropuerto de barcelona",null,null,null,null,null,null,null,null,null],["2020/CY/011","Commissioner (Cyprus) - 11.17.001.007.220","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-08-06","day",null,"None","EUR","ΚΕΟ PLC",null,"Art. 35(9), Art. 7(4)","Consent, DPIA",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/B64595978C98EFCEC2258606003EC47E/$file/%CE%91%CE%9D%CE%9F%CE%9D%CE%A5%CE%9C%CE%9F%CE%A0%CE%9F%CE%99%CE%97%CE%9C%CE%95%CE%9D%CE%97%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20%CE%95%CE%9D%CE%A4%CE%9F%CE%9B%CE%97%CE%A3%20%CE%95%CE%9D%CE%91%CE%9D%CE%A4%CE%99%CE%9F%CE%9D%20%CE%9A%CE%95%CE%9F%20PLC.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.007.220",null,"gdprhub",null,null,"plc",null,null,null,null,null,null,null,null,null],["2020/ES/054","ETid-364","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-08-06","day",3000,null,"EUR","GROW BEATS SL","Industry and Commerce","Art. 12, Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00092-2020.pdf","https://www.enforcementtracker.com/ETid-364",null,null,null,null,"grow beats sl",null,null,null,null,null,null,null,null,null],["2020/IT/029","ETid-368","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-08-06","day",3000,null,"EUR","GTL S.R.L.","Industry and Commerce","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9445710","https://www.enforcementtracker.com/ETid-368","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9445710","gdprhub",null,null,"gtl srl",null,null,null,null,null,null,null,null,null],["2020/ES/052","ETid-369","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-08-06","day",3000,null,"EUR","Just Landed S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00036-2020.pdf","https://www.enforcementtracker.com/ETid-369",null,null,null,null,"just landed sl",null,null,null,null,null,null,null,null,null],["2020/FR/006","ETid-362","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2020-08-05","day",250000,null,"EUR","Spartoo","Industry and Commerce","Art. 13, Art. 14, Art. 5(1)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.cnil.fr/fr/spartoo-sanction-de-250-000-euros-et-injonction-sous-astreinte-de-se-conformer-au-rgpd","https://www.enforcementtracker.com/ETid-362",null,null,null,null,"spartoo sas",null,null,null,null,null,null,null,null,null],["2020/FI/001","ETid-370","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2020-08-05","day",7000,null,"EUR","Acc Consulting Varsinais-Suomi","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://tietosuoja.fi/-/yritykselle-seuraamusmaksu-sahkoisen-suoramarkkinoinnin-harjoittamisesta-ilman-ennalta-annettua-suostumusta-ja-rekisteroidyn-oikeuksien-laiminlyonnista","https://www.enforcementtracker.com/ETid-370",null,null,null,null,"FI: acc consulting varsinais suomi",null,null,null,null,null,null,null,null,null],["2020/ES/051","ETid-371","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-08-05","day",3000,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 12, Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00479-2019.pdf","https://www.enforcementtracker.com/ETid-371",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/AT/003","ETid-372","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2020-08-05","day",100,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dsb.gv.at/documents/22758/115212/Newsletter_DSB_3_2020.pdf/90579856-6cb5-4206-823a-cacc724cf94e","https://www.enforcementtracker.com/ETid-372",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/028","ETid-373","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-08-05","day",2000,null,"EUR","School","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9445324","https://www.enforcementtracker.com/ETid-373","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9445324","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/DK/001","ETid-363","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2020-08-04","day",20100,null,"EUR","PrivatBo A.M.B.A.","Real Estate","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2020/aug/datatilsynet-indstiller-privatbo-til-boede","https://www.enforcementtracker.com/ETid-363","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-441-1480","gdprhub",null,null,"DK: privatbo amba",null,null,null,null,null,null,null,null,null],["2020/ES/053","ETid-365","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-08-04","day",60000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00009-2020.pdf","https://www.enforcementtracker.com/ETid-365",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/IT/027","ETid-374","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-08-04","day",15000,null,"EUR","Mapei S.p.A.","Industry and Commerce","Art. 12, Art. 13, Art. 15, Art. 17, Art. 5, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9445180","https://www.enforcementtracker.com/ETid-374",null,null,null,null,"mapei spa",null,null,null,null,null,null,null,null,null],["2020/IT/026","ETid-375","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-08-04","day",5000,null,"EUR","National Institute for Social Security - Department of the Province of Brescia","Public Sector and Education","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9445550","https://www.enforcementtracker.com/ETid-375","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9445550","gdprhub",null,null,"IT: national institute for social security department of the province of brescia",null,null,null,null,null,null,null,null,null],["2020/IT/025","ETid-376","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-08-04","day",1000,null,"EUR","Supermarket","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9445567","https://www.enforcementtracker.com/ETid-376","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9445567","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/011","ETid-2812","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-08-03","day",2000,null,"EUR","Legal Person","Industry and Commerce","Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/150-cj-uoou-0280820-3-dokument-c-150.pdf","https://www.enforcementtracker.com/ETid-2812",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/GR/004","ETid-393","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-08-03","day",3000,null,"EUR","Candidate for parliamentary elections","Public Sector and Education","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dpa.gr/portal/page?_pageid=33,15048&_dad=portal&_schema=PORTAL","https://www.enforcementtracker.com/ETid-393","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_24/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/HU/020","NAIH (Hungary) - NAIH/2020/2000/5","gdprhub","Hungary","HU","NAIH (Hungary)","2020-08-03","day",null,"None","EUR",null,null,"Art. 12(2), Art. 13, Art. 5(1)(a), Art. 58(2)(d)","Data principles, Transparency",null,"Violation found","https://www.naih.hu/files/NAIH-2020-2000-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/2000/5",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/050","ETid-382","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-31","day",45000,null,"EUR","Vodafone España SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00168-2020.pdf","https://www.enforcementtracker.com/ETid-382",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/046","ETid-388","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-31","day",1500,null,"EUR","Tour & People Max S.L.","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00031-2020.pdf","https://www.enforcementtracker.com/ETid-388",null,null,null,null,"tour and people max sl",null,null,null,null,null,null,null,null,null],["2020/RO/015","ETid-358","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-07-30","day",2000,null,"EUR","SC Viva Credit IFN SA","Finance, Insurance and Consulting","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Amenda_pentru_incalcarea_RGPD_Viva_Credit_IFN&lang=ro","https://www.enforcementtracker.com/ETid-358",null,null,null,null,"viva credit ifn sa",null,null,null,null,null,null,null,null,null],["2020/RO/014","ETid-359","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-07-30","day",2000,null,"EUR","Romanian Post National Company","Transportation and Energy","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Sanctiune_pentru_incalcarea_RGPD_Posta_Romana&lang=ro","https://www.enforcementtracker.com/ETid-359",null,null,null,null,"RO: romanian post national company",null,null,null,null,null,null,null,null,null],["2020/IT/024","ETid-377","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-07-30","day",2000,null,"EUR","Community of Manduria","Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9440000","https://www.enforcementtracker.com/ETid-377","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9440000","gdprhub",null,null,"IT: community of manduria",null,null,null,null,null,null,null,null,null],["2020/GR/020","HDPA (Greece) - 23/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-07-30","day",null,"None","EUR","Hellenic Electricity Distribution Network Operator",null,"Art. 12, Art. 15, Art. 23, Art. 4(1), Art. 4(7), Art. 5, Art. 51, Art. 55, Art. 57(1)(f), Art. 58","Data principles, Data subject rights, Transparency",null,"Other Outcome","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=-1&_piref33_15473_33_15453_15453.arithmosApofasis=23%2F2020&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_23/2020",null,"gdprhub",null,null,"GR: hellenic electricity distribution network operator",null,null,null,null,null,null,null,null,null],["2020/GB/017","ICO - FS50912491","gdprhub","United Kingdom","GB","ICO (UK)","2020-07-30","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2618121/fs50912491.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50912491",null,"gdprhub",null,"Public authority",null,null,null,null,null,null,null,null,null,null],["2020/BE/026","APD/GBA (Belgium) - 41/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-07-29","day",null,"None","EUR",null,null,"Art. 12, Art. 13, Art. 14, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-41-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_41/2020",null,"gdprhub",null,"Hospital",null,null,null,null,null,null,null,null,null,null],["2020/IT/023","ETid-378","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-07-29","day",3000,null,"EUR","Community of San Giorgio Jonico","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9361186","https://www.enforcementtracker.com/ETid-378",null,null,null,null,"IT: community of san giorgio jonico",null,null,null,null,null,null,null,null,null],["2020/IT/022","ETid-379","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-07-29","day",4000,null,"EUR","Region of Campania","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9440075","https://www.enforcementtracker.com/ETid-379","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9440075","gdprhub",null,null,"IT: region of campania",null,null,null,null,null,null,null,null,null],["2020/GB/018","ICO - IC-44531-X9L7","gdprhub","United Kingdom","GB","ICO (UK)","2020-07-29","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2618125/ic-44531-x9l7.pdf","https://gdprhub.eu/index.php?title=ICO_-_IC-44531-X9L7",null,"gdprhub",null,"Public authority",null,null,null,null,null,null,null,null,null,null],["2020/SI/017","IP - 07121-1/2020/1180","gdprhub","Slovenia","SI","IP (Slovenia)","2020-07-29","day",null,"None","EUR","Informacijski Pooblaščenec",null,"Art. 49(1), Art. 58, Art. 6(1)(a)","International transfers, Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1835","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/1180",null,"gdprhub",null,null,"SI: informacijski pooblascenec",null,null,null,null,null,null,null,null,null],["2020/FI/009","Tietosuojavaltuutetun toimisto (Finland) - 1809/452/18","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2020-07-29","day",null,"None","EUR",null,null,"Art. 58(2)(d)",null,null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200661","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_1809/452/18",null,"gdprhub",null,"Housing cooperative",null,null,null,null,null,null,null,null,null,null],["2020/FR/009","CNIL (France) - SAN-2020-003","gdprhub","France","FR","CNIL (France)","2020-07-28","day",250000,"250.000","EUR","SPARTOO SAS",null,"Art. 13, Art. 32(1), Art. 5(1)(c), Art. 5(1)(e), Art. 56(1)","Data principles, Data security, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000042203965&fastReqId=655302508&fastPos=1","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-003",null,"gdprhub",null,null,"spartoo sas",null,null,null,null,null,null,null,null,null],["2020/DK/002","ETid-361","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2020-07-28","day",147800,null,"EUR","Arp Hansen Hotel Group A/S","Accommodation and Hospitality","Art. 5(1)(e)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2020/jul/arp-hansen-hotel-group-a/s-indstilles-til-boede","https://www.enforcementtracker.com/ETid-361",null,null,null,null,"arp hansen hotel group as",null,null,null,null,null,null,null,null,null],["2020/BE/006","ETid-380","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-07-28","day",3000,null,"EUR","Communal political association","Public Sector and Education","Art. 14, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-39-2020.pdf","https://www.enforcementtracker.com/ETid-380","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_39/2020","gdprhub",null,null,"BE: communal political association",null,null,null,null,null,null,null,null,null],["2020/SI/016","IP - 07121-1/2020/1242","gdprhub","Slovenia","SI","IP (Slovenia)","2020-07-28","day",null,"None","EUR",null,null,"Art. 58",null,null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1833","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/1242",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/RO/013","ETid-360","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-07-27","day",5000,null,"EUR","SC Cntar Tarom SA","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Sanctiune%20pentru%20incalcare%20RGPD%2027_07_20&lang=ro","https://www.enforcementtracker.com/ETid-360","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_SC_CNTAR_TAROM_SA","gdprhub",null,null,"cntar tarom sa",null,null,null,null,null,null,null,null,null],["2020/GB/004","ICO - FS50865947","gdprhub","United Kingdom","GB","ICO (UK)","2020-07-27","day",null,"None","EUR","Department of Health and Social Care",null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2618110/fs50865947.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50865947",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/060","ETid-351","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-23","day",10000,null,"EUR","El Periódico de Catalunya, S.L.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-000422-2019.pdf","https://www.enforcementtracker.com/ETid-351",null,null,null,null,"el periodico de catalunya slu",null,null,null,null,null,null,null,null,null],["2020/ES/059","ETid-352","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-23","day",55000,null,"EUR","Telefónica Móviles España, SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-000114-2019.pdf","https://www.enforcementtracker.com/ETid-352",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2020/ES/058","ETid-353","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-23","day",70000,null,"EUR","Telefónica Móviles España, SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00010-2020.pdf","https://www.enforcementtracker.com/ETid-353",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2020/ES/057","ETid-354","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-23","day",75000,null,"EUR","Telefónica Móviles España, SAU","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00014-2020.pdf","https://www.enforcementtracker.com/ETid-354",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2020/ES/056","ETid-355","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-23","day",5000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00115-2020.pdf","https://www.enforcementtracker.com/ETid-355",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/ES/055","ETid-356","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-23","day",5000,null,"EUR","El Real Sporting de Gijón S.A.D.","Individuals and Private Associations","Art. 6, Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00134-2020.pdf","https://www.enforcementtracker.com/ETid-356",null,null,null,null,"ES: el real sporting de gijon sad",null,null,null,null,null,null,null,null,null],["2020/HU/010","ETid-394","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-07-23","day",560,null,"EUR","Forbes Hungary","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2020-1154-9-hatarozat.pdf","https://www.enforcementtracker.com/ETid-394","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/1154/9","gdprhub",null,null,"HU: forbes hungary",null,null,null,null,null,null,null,null,null],["2020/HU/008","ETid-427","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-07-23","day",1700,null,"EUR","Employer","Employment","Art. 12, Art. 15, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/files/NAIH-2020-193-hatarozat.pdf","https://www.enforcementtracker.com/ETid-427",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/FI/007","Tietosuojavaltuutetun toimisto (Finland) - 3425/157/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2020-07-23","day",null,"None","EUR",null,null,"Art. 21","Data subject rights",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200621","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3425/157/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/FI/011","Tietosuojavaltuutetun toimisto (Finland) - 3425/157/2019, 3578/157/2019, 3846/157/2019, 3871/157/2019, 3891/152/2019, 3918/157/2019, 4338/157/2019, 4666/154/2019, 5973/157/2019, 6773/157/2019 ja 7022/157/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2020-07-23","day",7000,"7000","EUR",null,null,"Art. 4(11), Art. 58(2)(c), Art. 58(2)(d)",null,null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200632","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3425/157/2019%2C_3578/157/2019%2C_3846/157/2019%2C_3871/157/2019%2C_3891/152/2019%2C_3918/157/2019%2C_4338/157/2019%2C_4666/154/2019%2C_5973/157/2019%2C_6773/157/2019_ja_7022/157/2019",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2020/FI/008","Tietosuojavaltuutetun toimisto (Finland) - 3846/157/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2020-07-23","day",null,"None","EUR",null,null,"Art. 17, Art. 21","Data subject rights",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200622","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3846/157/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/004","ETid-2824","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-07-20","day",400,null,"EUR","Legal Person",null,"Art. 12(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/155-cj-uoou-0309720-3-dokument-c-155.pdf","https://www.enforcementtracker.com/ETid-2824",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/065","ETid-345","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-20","day",24000,null,"EUR","Banco Bilbao Vizcaya Argentaria, SA","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00068-2020.pdf","https://www.enforcementtracker.com/ETid-345",null,null,null,null,"banco bilbao vizcaya argentaria sa","BBVA",null,null,null,null,null,null,null,null],["2020/ES/064","ETid-346","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-20","day",40000,null,"EUR","Iberia Lae SA Operadora Unipersonal","Transportation and Energy","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00060-2020.pdf","https://www.enforcementtracker.com/ETid-346",null,null,null,null,"iberia lae sa operadora unipersonal",null,null,null,null,null,null,null,null,null],["2020/ES/063","ETid-347","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-20","day",1500,null,"EUR","Comercial Vigobrandy, SL","Industry and Commerce","Art. 12, Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00459-2019.pdf","https://www.enforcementtracker.com/ETid-347",null,null,null,null,"comercial vigobrandy sl",null,null,null,null,null,null,null,null,null],["2020/ES/062","ETid-349","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-20","day",80000,null,"EUR","Orange Espagne S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00452-2019.pdf","https://www.enforcementtracker.com/ETid-349",null,null,null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["2020/ES/061","ETid-350","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-20","day",70000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-000450-2019.pdf","https://www.enforcementtracker.com/ETid-350",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/HU/009","ETid-409","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-07-16","day",28,null,"EUR","Google Ireland Ltd.","Media, Telecoms and Broadcasting","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/files/NAIH-2020-5553-hatarozat.pdf","https://www.enforcementtracker.com/ETid-409",null,null,null,null,"google ireland ltd","Google (Alphabet)",null,null,null,null,null,null,null,null],["2020/RO/031","ANSPDCP (Romania) - Compania Națională Poșta Română","gdprhub","Romania","RO","ANSPDCP (Romania)","2020-07-15","day",null,"9,686.60","RON","Compania Națională Poșta Română",null,"Art. 32","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Sanctiune_pentru_incalcarea_RGPD_Posta_Romana&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Compania_Na%C8%9Bional%C4%83_Po%C8%99ta_Rom%C3%A2n%C4%83",null,"gdprhub",null,null,"RO: compania nationala posta romana",null,9686.6,2000,"day 2020-07-15|4.8439|RON",null,null,null,null,null],["2020/FR/008","CNIL (France) - MED-2020-015","gdprhub","France","FR","CNIL (France)","2020-07-15","day",null,"None","EUR","French Ministry of Health",null,"Art. 13, Art. 28, Art. 35, Art. 5(1)(a)","DPIA, Data principles, Processor obligations, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000042125452&fastReqId=1658623954&fastPos=2","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_MED-2020-015",null,"gdprhub",null,null,"FR: french ministry of health",null,null,null,null,null,null,null,null,null],["2020/PL/009","ETid-381","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-07-15","day",22300,null,"EUR","Office for geodesy and cartography","Public Sector and Education","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.3.2020","https://www.enforcementtracker.com/ETid-381","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.3.2020","gdprhub",null,null,"PL: office for geodesy and cartography",null,null,null,null,null,null,null,null,null],["2020/CZ/002","ETid-2830","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-07-14","day",400,null,"EUR","Legal Person","Industry and Commerce","Art. 13, Art. 15, Art. 21, Art. 5(1)(c), Art. 6(1)(a), Art. 7(1)","Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/151-cj-uoou-0287820-3-dokument-c-151.pdf","https://www.enforcementtracker.com/ETid-2830",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/008","ETid-344","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-07-14","day",600000,null,"EUR","Google Belgium SA","Media, Telecoms and Broadcasting","Art. 12, Art. 17(1)(a), Art. 5, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-37-2020.pdf","https://www.enforcementtracker.com/ETid-344","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_37/2020","gdprhub",null,null,"google belgium sa","Google (Alphabet)",null,null,null,null,null,null,null,null],["2020/BE/007","ETid-357","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-07-14","day",5000,null,"EUR","Operator of CCTV of a residential building","Industry and Commerce","Art. 6, Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-36-2020.pdf","https://www.enforcementtracker.com/ETid-357",null,null,null,null,"BE: operator of cctv of a residential building",null,null,null,null,null,null,null,null,null],["2020/IT/034","ETid-335","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-07-13","day",200000,null,"EUR","Merlini s.r.l.","Industry and Commerce","Art. 28, Art. 29, Art. 5, Art. 6, Art. 7","Consent, Data principles, Processor obligations, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9435774","https://www.enforcementtracker.com/ETid-335",null,null,null,null,"merlini srl",null,null,null,null,null,null,null,null,null],["2020/IT/033","ETid-336","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-07-13","day",16700000,null,"EUR","Wind Tre S.p.A.","Media, Telecoms and Broadcasting","Art. 12, Art. 24, Art. 25, Art. 5, Art. 6","Accountability, Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9435753","https://www.enforcementtracker.com/ETid-336","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9435753","gdprhub",null,null,"wind tre spa",null,null,null,null,null,null,null,null,null],["2020/IT/032","ETid-337","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-07-13","day",800000,null,"EUR","Iliad Italia S.p.A.","Media, Telecoms and Broadcasting","Art. 25, Art. 5","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9435807","https://www.enforcementtracker.com/ETid-337","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9435807","gdprhub",null,null,"iliad italia spa",null,null,null,null,null,null,null,null,null],["2020/PL/010","ETid-332","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-07-10","day",3400,null,"EUR","East Power Sp. z o.o.","Transportation and Energy","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.1.2020","https://www.enforcementtracker.com/ETid-332","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.1.2020","gdprhub",null,null,"east power spzoo",null,null,null,null,null,null,null,null,null],["2020/NO/003","ETid-333","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-07-10","day",46660,null,"EUR","Municipality of Rælingen","Public Sector and Education","Art. 32, Art. 35","DPIA, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/9d5792264c884f3a903d3981c38812ac/~-20_02191-1-vedtak-om-overtredelsesgebyr---ralingen-kommune-202444_10_1.pdf","https://www.enforcementtracker.com/ETid-333","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02191","gdprhub",null,null,"NO: municipality of rlingen",null,null,null,null,null,null,null,null,null],["2020/ES/071","ETid-338","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-10","day",1500,null,"EUR","Auto Desguaces Iglesias S.L.","Industry and Commerce","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00004-2020.pdf","https://www.enforcementtracker.com/ETid-338",null,null,null,null,"auto desguaces iglesias sl",null,null,null,null,null,null,null,null,null],["2020/ES/070","ETid-339","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-10","day",1000,null,"EUR","Centro Internacional De Crecimiento Laboral Y Profesional S.L.","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00149-2020.pdf","https://www.enforcementtracker.com/ETid-339",null,null,null,null,"centro internacional de crecimiento laboral y profesional sl",null,null,null,null,null,null,null,null,null],["2020/ES/069","ETid-340","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-10","day",12000,null,"EUR","Vodafone España, SAU","Media, Telecoms and Broadcasting","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00139-2020.pdf","https://www.enforcementtracker.com/ETid-340",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/068","ETid-341","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-10","day",5000,null,"EUR","Global Business Travel Spain SLU","Transportation and Energy","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00296-2020.pdf","https://www.enforcementtracker.com/ETid-341",null,null,null,null,"global business travel spain slu",null,null,null,null,null,null,null,null,null],["2020/ES/067","ETid-342","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-10","day",5000,null,"EUR","School Fitness Holiday & Franchising S.L.","Industry and Commerce","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00135-2020.pdf","https://www.enforcementtracker.com/ETid-342",null,null,null,null,"school fitness holiday and franchising sl",null,null,null,null,null,null,null,null,null],["2020/ES/066","ETid-343","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-10","day",55000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-000104-2020.pdf","https://www.enforcementtracker.com/ETid-343",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/FI/010","Tietosuojavaltuutetun toimisto (Finland) - 9401/163/18","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2020-07-10","day",null,"None","EUR","Euroclear Finland Oy",null,"Art. 5(1)(a), Art. 58(2)(b), Art. 58(2)(d)","Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200641","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_9401/163/18",null,"gdprhub",null,null,"euroclear finland oy",null,null,null,null,null,null,null,null,null],["2020/RO/016","ETid-331","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-07-09","day",15000,null,"EUR","Proleasing Motors SRL","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_09_07_20&lang=ro","https://www.enforcementtracker.com/ETid-331",null,null,null,null,"proleasing motors srl",null,null,null,null,null,null,null,null,null],["2020/CY/007","Commissioner (Cyprus) - 11.17.001.007.219","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-07-08","day",null,"None","EUR","Pop Life Electric Shops Ltd",null,"Art. 12(3), Art. 15, Art. 4(1), Art. 53(3)","Data subject rights, Transparency",null,"Other Outcome","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/D9EDB20F259B7F76C2258596003B9748/$file/Pop%20life%20access%20request%20%CE%91%CE%9D%CE%A9%CE%9D%CE%A5%CE%9C%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.007.219",null,"gdprhub",null,null,"pop life electric shops ltd",null,null,null,null,null,null,null,null,null],["2020/NL/008","ETid-334","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2020-07-06","day",830000,null,"EUR","Bureau Krediet Registration ('BKR')","Finance, Insurance and Consulting","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/besluit_bkr_30_juli_2019.pdf","https://www.enforcementtracker.com/ETid-334",null,null,null,null,"NL: bureau krediet registration",null,null,null,null,null,null,null,null,null],["2020/PL/017","UODO (Poland) - DKE.561.2.2020","gdprhub","Poland","PL","UODO (Poland)","2020-07-06","day",1170,"1170","EUR",null,null,"Art. 58(1)(e)",null,null,null,"https://uodo.gov.pl/en/553/1145","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKE.561.2.2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/075","ETid-326","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-02","day",24000,null,"EUR","Iberdrola Clientes","Transportation and Energy","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00102-2020.pdf","https://www.enforcementtracker.com/ETid-326",null,null,null,null,"ES: iberdrola clientes","Iberdrola",null,null,null,null,null,null,null,null],["2020/ES/074","ETid-327","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-02","day",4000,null,"EUR","De Vere Spain S.L.","Industry and Commerce","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00475-2019.pdf","https://www.enforcementtracker.com/ETid-327",null,null,null,null,"de vere spain sl",null,null,null,null,null,null,null,null,null],["2020/NO/004","ETid-328","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-07-02","day",null,null,"EUR","Odin Flissenter AS","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2020/varsel-om-overtredelsesgebyr-til-odin-flissenter-as/","https://www.enforcementtracker.com/ETid-328",null,null,null,null,"odin flissenter as",null,null,null,null,null,null,null,null,null],["2020/ES/073","ETid-329","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-02","day",3600,null,"EUR","Saunier-Tec Mantenimientos de Calor y Frio, SL.","Industry and Commerce","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.aepd.es/es/documento/ps-00122-2020.pdf","https://www.enforcementtracker.com/ETid-329",null,null,null,null,"saunier tec mantenimientos de calor y frio sl",null,null,null,null,null,null,null,null,null],["2020/ES/072","ETid-330","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-07-02","day",5000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00090-2020.pdf","https://www.enforcementtracker.com/ETid-330","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00090/2020","gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/IT/021","ETid-391","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-07-02","day",15000,null,"EUR","Mapei S.p.A.","Industry and Commerce","Art. 12, Art. 13, Art. 15, Art. 5","Data principles, Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9445180","https://www.enforcementtracker.com/ETid-391","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9445180","gdprhub",null,null,"mapei spa",null,null,null,null,null,null,null,null,null],["2020/GB/015","ICO - Monetary Penalty against Decision Technologies Limited","gdprhub","United Kingdom","GB","ICO (UK)","2020-07-01","day",null,"90.000","GBP","Decision Technologies Limited (DTL)",null,null,null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2617912/decision-technologies-limited-mpn.pdf","https://gdprhub.eu/index.php?title=ICO_-_Monetary_Penalty_against_Decision_Technologies_Limited",null,"gdprhub",null,null,"decision technologies ltd",null,90000.0,99524,"day 2020-07-01|0.9043|GBP",null,null,null,null,null],["2020/BE/024","APD/GBA (Belgium) - 42/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-06-30","day",null,"None","EUR",null,null,"Art. 2(1), Art. 4(7), Art. 6(1)(f)","Unlawful processing",null,"Rejected","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-42-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_42/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/026","ETid-306","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2020-06-30","day",1240000,null,"EUR","Allgemeine Ortskrankenkasse (\"AOK\") (health insurance company)","Finance, Insurance and Consulting","Art. 32, Art. 5, Art. 6","Data principles, Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-bussgeld-gegen-aok-baden-wuerttemberg-wirksamer-datenschutz-erfordert-regelmaessige-kontrolle-und-anpassung/","https://www.enforcementtracker.com/ETid-306",null,null,null,null,"DE: allgemeine ortskrankenkasse",null,null,null,null,null,null,null,null,null],["2020/DK/003","ETid-319","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2020-06-30","day",6700,null,"EUR","Lejre Municipality","Public Sector and Education","Art. 33, Art. 34, Art. 5, Art. 6","Data breach, Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2020/jun/lejre-kommune-indstilles-til-boede","https://www.enforcementtracker.com/ETid-319","https://gdprhub.eu/index.php?title=Datatilsynet_-_Fine_against_Lejre_Municipality","gdprhub",null,null,"DK: lejre municipality",null,null,null,null,null,null,null,null,null],["2020/IE/005","ETid-320","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2020-06-30","day",40000,null,"EUR","Tusla Child and Family Agency","Public Sector and Education","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.irishlegal.com/article/tusla-fined-40-000-in-second-gdpr-breach","https://www.enforcementtracker.com/ETid-320",null,null,null,null,"IE: tusla child and family agency",null,null,null,null,null,null,null,null,null],["2020/GB/016","ICO - FS50883133","gdprhub","United Kingdom","GB","ICO (UK)","2020-06-30","day",null,"None","EUR","Gloucestershire County Council",null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617947/fs50883133.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50883133",null,"gdprhub",null,null,"GB: gloucestershire county council",null,null,null,null,null,null,null,null,null],["2020/PL/019","UODO (Poland) - DKN.5112.7.2020","gdprhub","Poland","PL","UODO (Poland)","2020-06-30","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 58(2)(b), Art. 6(1)(c)","Data principles, Unlawful processing",null,"Violation found","https://uodo.gov.pl/decyzje/DKN.5112.7.2020%20%09","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DKN.5112.7.2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/GR/005","ETid-348","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-06-29","day",5000,null,"EUR","New York College S.A.","Public Sector and Education","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=252,140,181,222,128,166,229,159","https://www.enforcementtracker.com/ETid-348","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_18/2020","gdprhub",null,null,"new york college sa",null,null,null,null,null,null,null,null,null],["2020/GR/015","HDPA (Greece) - 19/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-06-29","day",2500,"2500","EUR",null,null,"Art. 5(2)","Data principles",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2020&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_19/2020",null,"gdprhub",null,"Politician",null,null,null,null,null,"person",null,null,null,null],["2020/AT/008","DSB (Austria) - 2020-0.349.984","gdprhub","Austria","AT","DSB (Austria)","2020-06-26","day",null,"None","EUR",null,null,"Art. 13, Art. 4(2), Art. 5(1)(f), Art. 51(1), Art. 57(1)(f), Art. 6(1)(c), Art. 6(1)(f), Art. 77(1)","Data principles, Transparency, Unlawful processing",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200626_2020_0_349_984_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.349.984",null,"gdprhub",null,"Post office",null,null,null,null,null,null,null,null,null,null],["2020/IM/002","ETid-318","cms_tracker","Isle of Man","IM","Information Commissioner of Isle of Man","2020-06-25","day",13500,null,"EUR","Department of Home Affairs","Public Sector and Education","Art. 12, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.inforights.im/media/1840/dha_penaltynotice_20mar2020_website.pdf","https://www.enforcementtracker.com/ETid-318",null,null,null,null,"IM: department of home affairs",null,null,null,null,null,null,null,null,null],["2020/IS/007","Persónuvernd - 2020010425","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-06-25","day",null,"None","EUR",null,null,"Art. 58(1)(b), Art. 6(1)(a), Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/akvordun-um-fyrirhugada-birtingu-arion-banka-a-ljosmyndum-af-lidum-a-fotboltamoti-barna-a-facebook-sidu-bankans-1","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010425",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2020/IS/015","Persónuvernd - 2020010616","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-06-25","day",null,"None","EUR",null,null,"Art. 5(1)(c), Art. 9(1), Art. 9(2)(a), Art. 9(2)(f)","Data principles, Special categories",null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-sjovar-almennra-trygginga-hf.-a-upplysingum-ur-sjukraskra-einstaklings","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010616",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/023","APD/GBA (Belgium) - 34/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-06-23","day",null,"None","EUR",null,null,"Art. 12, Art. 13, Art. 14, Art. 5(1)(b), Art. 6(1)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-34-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_34/2020",null,"gdprhub",null,"Insurance companies",null,null,null,null,null,null,null,null,null,null],["2020/ES/080","ETid-307","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-23","day",7500,null,"EUR","Miraclia (telecommunications company)","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.poderjudicial.es/cgpj/es/Poder-Judicial/Noticias-Judiciales/El-Tribunal-Supremo-confirma-la-multa-de-7-500-euros-a-una-empresa-de-bromas-telefonicas-por-infraccion-de-la-ley-de-Proteccion-Datos","https://www.enforcementtracker.com/ETid-307",null,null,null,null,"ES: miraclia",null,null,null,null,null,null,null,null,null],["2020/ES/079","ETid-308","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-22","day",2000,null,"EUR","Comunidad de propietarios demelza beach","Real Estate","Art. 13, Art. 14, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00273-2019.pdf","https://www.enforcementtracker.com/ETid-308",null,null,null,null,"ES: comunidad de propietarios demelza beach",null,null,null,null,null,null,null,null,null],["2020/NO/006","ETid-321","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-06-22","day",112000,null,"EUR","Østfold HF Hospital","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/a42cee6c37084047ac14489dcc318c75/varsel-om-palegg-og-overtredelsesgebyr-200653_13_1.pdf","https://www.enforcementtracker.com/ETid-321",null,null,null,null,"stfold hf hospital",null,null,null,null,null,null,null,null,null],["2020/IS/016","Persónuvernd - 2020010677","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-06-22","day",null,"None","EUR",null,null,"Art. 5(1)(e), Art. 5(1)(f), Art. 6(1)(c), Art. 6(1)(e)","Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-sambands-islenskra-sveitarfelaga-a-aliti-umbodsmanns-althingis","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010677",null,"gdprhub",null,"Ombudsman",null,null,null,null,null,null,null,null,null,null],["2020/BE/011","ETid-315","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-06-19","day",10000,null,"EUR",null,null,"Art. 15, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gegevensbeschermingsautoriteit.be/sites/privacycommission/files/documents/Beslissing_GK_33-2020_NL.pdf","https://www.enforcementtracker.com/ETid-315","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_33/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/NO/005","ETid-322","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-06-19","day",null,null,"EUR","Aquateknikk AS","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2020/varsel-om-gebyr-aquateknikk/","https://www.enforcementtracker.com/ETid-322",null,null,null,null,"aquateknikk as",null,null,null,null,null,null,null,null,null],["2020/ES/076","ETid-323","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-19","day",6000,null,"EUR","National Police Brigade","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00415-2019.pdf","https://www.enforcementtracker.com/ETid-323",null,null,null,null,"ES: national police brigade",null,null,null,null,null,null,null,null,null],["2020/RO/018","ETid-310","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-06-18","day",4000,null,"EUR","Enel Energie","Transportation and Energy","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Amenda_pentru%20incalcarea_RGPD_Enel_iunie2020&lang=ro","https://www.enforcementtracker.com/ETid-310",null,null,null,null,"RO: enel energie","Enel",null,null,null,null,null,null,null,null],["2020/CY/010","Commissioner (Cyprus) - 11.17.001.008.001","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-06-17","day",15000,"15.000","EUR",null,null,"Art. 15, Art. 32, Art. 33, Art. 5(1)(f), Art. 5(2)","Data breach, Data principles, Data security, Data subject rights",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/B64595978C98EFCEC2258606003EC47E/$file/%CE%91%CE%9D%CE%A9%CE%9D%CE%A5%CE%9C%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97%20%CE%A4%CE%A1%CE%91%CE%A0%CE%95%CE%96%CE%91%20%CE%9A%CE%A5%CE%A0%CE%A1%CE%9F%CE%A5%20%CE%91%CE%A0%CE%A9%CE%9B%CE%95%CE%99%CE%91%20%CE%95%CE%93%CE%93%CE%A1%CE%91%CE%A6%CE%9F%CE%A5.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.008.001",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/021","APD/GBA (Belgium) - 31/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-06-16","day",2000,"2000","EUR",null,null,"Art. 12(1), Art. 13, Art. 35, Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)(a), Art. 6(1)(c), Art. 8","Consent, DPIA, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/sites/privacycommission/files/documents/Beslissing_GK_31-2020_NL.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_31/2020",null,"gdprhub",null,"Schoolboard",null,null,null,null,null,null,null,null,null,null],["2020/ES/078","ETid-309","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-16","day",2000,null,"EUR","Café Bar","Accommodation and Hospitality","Art. 13, Art. 14, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00306-2019.pdf","https://www.enforcementtracker.com/ETid-309",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/SE/012","ETid-314","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-06-16","day",1900,null,"EUR","Housing Association","Real Estate","Art. 5, Art. 6","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/2020-06-16-kamerabevakning-hos-brf.pdf","https://www.enforcementtracker.com/ETid-314",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/010","ETid-316","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-06-16","day",1000,null,"EUR",null,null,"Art. 17, Art. 21, Art. 31","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Décision_CC_32-2020_FR.pdf","https://www.enforcementtracker.com/ETid-316",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/NL/009","ETid-672","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2020-06-16","day",7500,null,"EUR","PVV Overijssel","Public Sector and Education","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boete_pvv_overijssel.pdf","https://www.enforcementtracker.com/ETid-672","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_16.06.2020","gdprhub",null,null,"NL: pvv overijssel",null,null,null,null,null,null,null,null,null],["2020/GB/014","ICO - FS50895772","gdprhub","United Kingdom","GB","ICO (UK)","2020-06-16","day",null,"None","EUR","The Cabinet Office",null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617881/fs50895772.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50895772",null,"gdprhub",null,null,"GB: the cabinet office",null,null,null,null,null,null,null,null,null],["2020/ES/168","AEPD (Spain) - PS/00415/2019","gdprhub","Spain","ES","AEPD (Spain)","2020-06-15","day",75000,"75000","EUR","Xfera Móviles S.A.",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00451-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00415/2019",null,"gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/ES/077","ETid-311","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-15","day",75000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00415-2019.pdf","https://www.enforcementtracker.com/ETid-311",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/AT/007","DSB (Austria) - 2020-0.225.643","gdprhub","Austria","AT","DSB (Austria)","2020-06-12","day",null,"None","EUR",null,null,null,null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200612_2020_0_225_643_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.225.643",null,"gdprhub",null,"Insurance company",null,null,null,null,null,null,null,null,null,null],["2020/NO/011","Datatilsynet (Norway) - 20/02058","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-06-12","day",null,"None","EUR","Folkehelseinstituttet",null,"Art. 15, Art. 5(1)(a), Art. 5(1)(c)","Data principles, Data subject rights",null,"Violation found","https://www.datatilsynet.no/contentassets/1c72ac62cac145efa242942ca34c2cd0/20-02058-9-varsel-om-vedtak-om-midlertidig-forbud-mot-a-behandle-personopplysninger---smittestopp.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_20/02058",null,"gdprhub",null,null,"NO: folkehelseinstituttet",null,null,null,null,null,null,null,null,null],["2020/HU/011","ETid-313","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-06-12","day",288000,null,"EUR","Digi Távközlési Szolgáltató Kft. (\"Digi\") (electronic communication service provider)","Media, Telecoms and Broadcasting",null,"Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.naih.hu/files/NAIH-2020-1160-10-hatarozat.pdf","https://www.enforcementtracker.com/ETid-313",null,null,null,null,"digi tavkozlesi szolgaltato kft","Digi",null,null,null,null,null,null,null,null],["2020/CZ/001","ETid-2835","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-06-11","day",4010,null,"EUR","Legal Person",null,"Art. 17(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/130-cj-uoou-0103920-11-dokument-c-130.pdf","https://www.enforcementtracker.com/ETid-2835",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/RO/017","ETid-312","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-06-11","day",3000,null,"EUR","Telekom Romania","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=O_noua_sanctiune_pentru_incalcarea_RGPD_iunie_2020&lang=ro","https://www.enforcementtracker.com/ETid-312",null,null,null,null,"RO: telekom romania",null,null,null,null,null,null,null,null,null],["2020/IT/051","Garante per la protezione dei dati personali (Italy) - 9429195","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-06-10","day",600000,"600000","EUR","Unicredit S.p.A.",null,"Art. 32","Data security",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9429195","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9429195",null,"gdprhub",null,null,"unicredit spa","UniCredit",null,null,null,null,null,null,null,null],["2020/GR/017","HDPA (Greece) - 10/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-06-10","day",3000,"3000","EUR",null,null,null,null,null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2020&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_10/2020",null,"gdprhub",null,"Parliamentary candidate",null,null,null,null,null,"person",null,null,null,null],["2020/ES/167","AEPD (Spain) - PS/00451/2019","gdprhub","Spain","ES","AEPD (Spain)","2020-06-09","day",75000,"75000","EUR","Equifax",null,"Art. 6(1)(f)","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00451-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00451/2019",null,"gdprhub",null,null,"ES: equifax","Equifax",null,null,null,null,null,null,null,null],["2020/ES/091","ETid-285","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",5000,null,"EUR","Consulting de Seguridad e Investigacion Mira Dp Madrid S.L.","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00434-2019.pdf","https://www.enforcementtracker.com/ETid-285",null,null,null,null,"consulting de seguridad e investigacion mira dp madrid sl",null,null,null,null,null,null,null,null,null],["2020/ES/090","ETid-286","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",540,null,"EUR","Chenming Ye (Bazar Real)","Industry and Commerce","Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00433-2019.pdf","https://www.enforcementtracker.com/ETid-286",null,null,null,null,"ES: chenming ye",null,null,null,null,null,null,null,null,null],["2020/ES/089","ETid-287","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",1000,null,"EUR","Property Owner","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00373-2019.pdf","https://www.enforcementtracker.com/ETid-287",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/088","ETid-288","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",75000,null,"EUR","Equifax Iberica, S.L.","Finance, Insurance and Consulting","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/es/documento/ps-00451-2019.pdf","https://www.enforcementtracker.com/ETid-288",null,null,null,null,"equifax iberica sl","Equifax",null,null,null,null,null,null,null,null],["2020/ES/087","ETid-289","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",39000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00033-2020.pdf","https://www.enforcementtracker.com/ETid-289",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/ES/086","ETid-290","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",25000,null,"EUR","Glovoapp23","Industry and Commerce","Art. 37","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.aepd.es/es/documento/ps-00417-2019.pdf","https://www.enforcementtracker.com/ETid-290",null,null,null,null,"glovoapp23 sa",null,null,null,null,null,null,null,null,null],["2020/ES/084","ETid-293","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",40000,null,"EUR","TELEFONICA MOVILES ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00453-2019.pdf","https://www.enforcementtracker.com/ETid-293",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2020/ES/083","ETid-298","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",3000,null,"EUR","Salad Market S.L. (Catering Company)","Industry and Commerce","Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00048-2020.pdf","https://www.enforcementtracker.com/ETid-298",null,null,null,null,"salad market sl",null,null,null,null,null,null,null,null,null],["2020/ES/082","ETid-299","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",2000,null,"EUR","Attorney","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00390-2019.pdf","https://www.enforcementtracker.com/ETid-299",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/ES/081","ETid-300","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-09","day",2000,null,"EUR","Property Owner","Individuals and Private Associations","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00359-2019.pdf","https://www.enforcementtracker.com/ETid-300",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/009","ETid-317","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-06-08","day",5000,null,"EUR","Municipal employee","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/Decision_CC_30-2020_FR.pdf","https://www.enforcementtracker.com/ETid-317",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/HU/019","NAIH (Hungary) - NAIH/2020/34/3","gdprhub","Hungary","HU","NAIH (Hungary)","2020-06-08","day",null,"200000","HUF",null,null,"Art. 12(2), Art. 15, Art. 83(2)(a), Art. 83(2)(c), Art. 83(2)(d), Art. 83(2)(k)","Data subject rights, Transparency",null,"Violation found","https://www.naih.hu/files/NAIH-2020-34-3-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/34/3",null,"gdprhub",null,null,null,null,200000.0,581,"day 2020-06-08|344.1600|HUF",null,null,null,null,null],["2020/ES/085","ETid-291","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-06-04","day",4000,null,"EUR","Iberdrola Clientes","Transportation and Energy","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00444-2019.pdf","https://www.enforcementtracker.com/ETid-291",null,null,null,null,"ES: iberdrola clientes","Iberdrola",null,null,null,null,null,null,null,null],["2020/IS/006","Persónuvernd - 2020010373","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-06-04","day",null,"None","EUR",null,null,"Art. 10, Art. 32, Art. 5(1)(f), Art. 6(1)(c)","Data principles, Data security, Special categories, Unlawful processing",null,null,"https://www.personuvernd.is/urlausnir/alit-a-gagnkvaemri-midlun-personuupplysinga-fangelsismalastofnunar-og-utlendingastofnunar","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010373",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/PL/006","ETid-410","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-06-03","day",1168,null,"EUR","Entrepreneur running a non-public nursery and pre-school","Individuals and Private Associations","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/DKE.561.2.2020","https://www.enforcementtracker.com/ETid-410",null,null,null,null,"PL: entrepreneur running a non public nursery and pre school",null,null,null,null,null,null,null,null,null],["2020/FI/012","Tietosuojavaltuutetun toimisto (Finland) - 918/154/2019","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)","2020-06-03","day",null,null,null,"Google LLC",null,"Art. 17(1), Art. 58(2)(c)","Data subject rights",null,"Violation found","https://tietosuoja.fi/documents/6927448/204092115/P%25C3%25A4%25C3%25A4t%25C3%25B6s_918.154.2019_verkkoon.pdf/8f7ae20b-bfd8-1060-6da8-1a930ee32171/P%25C3%25A4%25C3%25A4t%25C3%25B6s_918.154.2019_verkkoon.pdf?t=1710926261537","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_918/154/2019",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2020/CY/006","Commissioner (Cyprus) - 11.17.001.007.125","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-06-02","day",null,"None","EUR","GAIJIN NETWORK LTD",null,"Art. 12(2), Art. 12(6), Art. 17, Art. 58(2)(d)","Data subject rights, Transparency",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/D9EDB20F259B7F76C2258596003B9748/$file/Decision%20-%20Gaijin%20network%2004-2019.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.007.125",null,"gdprhub",null,null,"gaijin network ltd",null,null,null,null,null,null,null,null,null],["2020/IT/050","Garante per la protezione dei dati personali (Italy) - 9356568","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-06-01","day",null,"None","EUR","Ministry of Health",null,"Art. 36, Art. 36(5)","DPIA",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9356568","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9356568",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/013","ETid-282","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-05-29","day",1000,null,"EUR","Non-profit organisation","Individuals and Private Associations","Art. 21, Art. 6","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.gegevensbeschermingsautoriteit.be/sites/privacycommission/files/documents/Beslissing_GK_28-2020_NL.pdf","https://www.enforcementtracker.com/ETid-282","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_28/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/FI/002","ETid-283","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2020-05-29","day",72000,null,"EUR","Taksi Helsinki","Transportation and Energy","Art. 35, Art. 5, Art. 6","DPIA, Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://tietosuoja.fi/documents/6927448/22406974/Päätös+henkilötietojen+käsittelyn+lainmukaisuudesta/60115710-2513-a359-6261-e821818b9ee1/Päätös+henkilötietojen+käsittelyn+lainmukaisuudesta.pdf","https://www.enforcementtracker.com/ETid-283","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_8393/161/2019","gdprhub",null,null,"FI: taksi helsinki",null,null,null,null,null,null,null,null,null],["2020/AT/016","DSB (Austria) - 2020-0.280.699","gdprhub","Austria","AT","DSB (Austria)","2020-05-28","day",null,null,null,"N*** Bank",null,null,null,null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200528_2020_0_280_699_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.280.699",null,"gdprhub",null,null,"AT: n bank",null,null,null,null,null,null,null,null,null],["2020/IS/013","Persónuvernd - 2020010602","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-05-28","day",null,"None","EUR","Miðlun Arion banka hf.",null,"Art. 5(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://www.personuvernd.is/urlausnir/midlun-arion-banka-hf.-islandsbanka-og-landsbankans-hf.-a-upplysingum-um-logheimili-ur-thjodskra-gegnum-netbanka#","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010602",null,"gdprhub",null,null,"milun arion banka hf",null,null,null,null,null,null,null,null,null],["2020/IS/014","Persónuvernd - 2020010613","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-05-27","day",null,"None","EUR","Creditinfo Lánstraust hf.",null,"Art. 5","Data principles",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-creditinfo-lanstrausts-hf.-med-upplysingar-um-fyrri-skraningar-a-vanskilaskra-vid-gerd-skyrslna-um-lanshaefi","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010613",null,"gdprhub",null,null,"IS: creditinfo lanstraust",null,null,null,null,null,null,null,null,null],["2020/CZ/038","ETid-640","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020-05-26","day",null,null,"EUR",null,"Industry and Commerce","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-pri-telemarketingu/ds-6269/archiv=1&p1=5649","https://www.enforcementtracker.com/ETid-640",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/FR/007","CNIL (France) - SAN-2020-056","gdprhub","France","FR","CNIL (France)","2020-05-25","day",null,"None","EUR",null,null,"Art. 11, Art. 12, Art. 13, Art. 14, Art. 15(4), Art. 23(1), Art. 5(1)(a), Art. 5(1)(d), Art. 5(1)(e), Art. 6(1)(e), Art. 9(2)(i)","Data principles, Data subject rights, Special categories, Transparency, Unlawful processing",null,null,"https://www.legifrance.gouv.fr/affichCnil.do?id=CNILTEXT000041940832","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2020-056",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/CY/009","Commissioner (Cyprus) - 11.17.001.007.251","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-05-25","day",null,"None","EUR","Nicosia General Hospital",null,"Art. 15, Art. 32(1)(b), Art. 32(1)(d), Art. 32(4)","Data security, Data subject rights",null,"Rejected","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/D9EDB20F259B7F76C2258596003B9748/$file/%CE%9F%CE%9A%CE%A5%CE%A0%CE%A5%20%CE%91%CE%9D%CE%9F%CE%9D%CE%A5%CE%9C%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_11.17.001.007.251",null,"gdprhub",null,null,"CY: nicosia general hospital",null,null,null,null,null,null,null,null,null],["2020/AT/006","DSB (Austria) - 2020-0.191.240","gdprhub","Austria","AT","DSB (Austria)","2020-05-25","day",null,"None","EUR","Bundesamt für Sicherheit im Gesundheitswesen (BASG)",null,"Art. 4(1), Art. 9(1)","Special categories",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200525_2020_0_191_240_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.191.240",null,"gdprhub",null,null,"AT: bundesamt fur sicherheit im gesundheitswesen",null,null,null,null,null,null,null,null,null],["2020/FI/005","ETid-279","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2020-05-22","day",100000,null,"EUR","Posti Group Oyj","Transportation and Energy","Art. 12, Art. 13, Art. 14, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://tietosuoja.fi/documents/6927448/22406974/Henkilötietojen+käsittelyn+läpinäkyvyys+ja+rekisteröidylle+toimitettavat+tiedot.pdf/b869b7ba-1a05-572e-d97a-9c8a56998fc1/Henkilötietojen+käsittelyn+läpinäkyvyys+ja+rekisteröidylle+toimitettavat+tiedot.pdf","https://www.enforcementtracker.com/ETid-279",null,null,null,null,"posti group oyj",null,null,null,null,null,null,null,null,null],["2020/FI/004","ETid-280","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2020-05-22","day",16000,null,"EUR","Kymen Vesi Oy","Employment","Art. 35","DPIA, Data principles","Non-compliance with general data processing principles","Fine issued","https://tietosuoja.fi/documents/6927448/22406974/Työntekijöiden+sijaintitietojen+käsittely+ja+vaikutustenarviointi.pdf/2d04e545-d427-8a0d-3f4d-967de7b428ac/Työntekijöiden+sijaintitietojen+käsittely+ja+vaikutustenarviointi.pdf","https://www.enforcementtracker.com/ETid-280",null,null,null,null,"kymen vesi oy",null,null,null,null,null,null,null,null,null],["2020/FI/003","ETid-281","cms_tracker","Finland","FI","Deputy Data Protection Ombudsman","2020-05-22","day",12500,null,"EUR",null,"Employment","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://tietosuoja.fi/documents/6927448/22406974/Työnhakijoiden+henkilötietojen+kerääminen+tarpeettomasti.pdf/6cedce13-60cd-c6f9-60cf-b9c8e17db10a/Työnhakijoiden+henkilötietojen+kerääminen+tarpeettomasti.pdf","https://www.enforcementtracker.com/ETid-281",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/IE/007","DPC - Tusla Child and Family Agency","gdprhub","Ireland","IE","DPC (Ireland)","2020-05-21","day",40000,"40000","EUR","Tusla",null,"Art. 32(1), Art. 33(1), Art. 58(2)(b), Art. 58(2)(d), Art. 58(2)(i)","Data breach, Data security",null,"Violation found","https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-fine-tusla-child-and-family-agency-confirmed-court","https://gdprhub.eu/index.php?title=DPC_-_Tusla_Child_and_Family_Agency",null,"gdprhub",null,null,"IE: tusla",null,null,null,null,null,null,null,null,null],["2020/IT/060","Garante per la protezione dei dati personali (Italy) - 9347280","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-05-19","day",null,"None","EUR",null,null,null,null,null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9347280","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9347280",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/015","IP - 07120-1/2020/358","gdprhub","Slovenia","SI","IP (Slovenia)","2020-05-18","day",null,"None","EUR",null,null,"Art. 5(1)(b), Art. 6(4), Art. 9(2)(c), Art. 9(2)(h), Art. 9(2)(j)","Data principles, Special categories, Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1634","https://gdprhub.eu/index.php?title=IP_-_07120-1/2020/358",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/IE/006","ETid-278","cms_tracker","Ireland","IE","Data Protection Authority of Ireland","2020-05-17","day",75000,null,"EUR","Tusla Child and Family Agency","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.irishtimes.com/news/crime-and-law/tusla-becomes-first-organisation-fined-for-gdpr-rule-breach-1.4255692?mode=amp","https://www.enforcementtracker.com/ETid-278",null,null,null,null,"IE: tusla child and family agency",null,null,null,null,null,null,null,null,null],["2020/DK/004","ETid-277","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2020-05-15","day",6700,null,"EUR","JobTeam A/S DKK","Employment","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2020/maj/jobteam-indstillet-til-boede/","https://www.enforcementtracker.com/ETid-277","https://gdprhub.eu/index.php?title=Datatilsynet_-_JobTeam_indstillet_til_b%C3%B8de","gdprhub",null,null,"jobteam as dkk",null,null,null,null,null,null,null,null,null],["2020/BE/012","ETid-296","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-05-14","day",50000,null,"EUR","Social Media Provider","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotectionauthority.be/sites/privacycommission/files/documents/Beslissing_GK_25-2020_EN.pdf","https://www.enforcementtracker.com/ETid-296","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_25/2020","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/049","Garante per la protezione dei dati personali (Italy) - 9344061","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-05-14","day",null,"None","EUR","Italian National Social Security Institute (“INPS”) vs. anonymous",null,"Art. 34, Art. 58(2)(e)","Data breach",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9344061","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9344061",null,"gdprhub",null,null,"IT: italian national social security institute vs anonymous",null,null,null,null,null,null,null,null,null],["2020/IS/012","Persónuvernd - 2020010598","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-05-13","day",null,"None","EUR",null,null,"Art. 12(3), Art. 15(1), Art. 2(1)","Data subject rights, Transparency",null,"Rejected","https://www.personuvernd.is/urlausnir/aetlud-vinnsla-personuupplysinga-hja-simanum-hf.-og-afgreidsla-a-adgangsbeidni","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010598",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SE/013","ETid-276","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-05-12","day",11200,null,"EUR","Health and Medical Board of the Region of Örebro County","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-region-orebro-2020-05-11.pdf","https://www.enforcementtracker.com/ETid-276","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2020-1539","gdprhub",null,null,"SE: health and medical board of the region of orebro county",null,null,null,null,null,null,null,null,null],["2020/BE/017","APD/GBA (Belgium) - 22/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-05-08","day",null,"None","EUR",null,null,"Art. 24(1), Art. 28(3), Art. 32, Art. 33, Art. 34, Art. 5(1)(f), Art. 5(2)","Accountability, Data breach, Data principles, Data security, Processor obligations",null,null,"https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-22-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_22/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/RO/021","ETid-275","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-05-05","day",5000,null,"EUR","Banca Comercială Română SA","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Sanctiune_pentru_incalcarea_RGPD_BCR&lang=ro","https://www.enforcementtracker.com/ETid-275","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Banca_Comercial%C4%83_Rom%C3%A2n%C4%83_S.A.","gdprhub",null,null,"banca comerciala romana sa",null,null,null,null,null,null,null,null,null],["2020/CY/008","Commissioner (Cyprus) - 12.10.001.011.001","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2020-05-04","day",null,"None","EUR","Hellenic Bank PLC",null,"Art. 32, Art. 33, Art. 34(3), Art. 34(4), Art. 38, Art. 39","Data breach, Data protection officer, Data security",null,"Violation found","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/D9EDB20F259B7F76C2258596003B9748/$file/%CE%95%CE%BB%CE%BB%CE%B7%CE%BD%CE%B9%CE%BA%CE%AE%20%CE%A4%CF%81%CE%AC%CF%80%CE%B5%CE%B6%CE%B1%20%CE%91%CE%9D%CE%A9%CE%9D%CE%A5%CE%9C%20%CE%91%CE%A0%CE%9F%CE%A6%CE%91%CE%A3%CE%97.pdf","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_12.10.001.011.001",null,"gdprhub",null,null,"CY: hellenic bank",null,null,null,null,null,null,null,null,null],["2020/NO/007","ETid-294","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-05-03","day",134000,null,"EUR","Telenor Norge AS","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2020/varsel-om-irettesettelse-mot-telenor-norge-as/","https://www.enforcementtracker.com/ETid-294",null,null,null,null,"telenor norge as",null,null,null,null,null,null,null,null,null],["2020/NL/010","ETid-274","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2020-04-30","day",725000,null,"EUR",null,"Employment","Art. 5, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boetebesluit_vingerafdrukken_personeel.pdf","https://www.enforcementtracker.com/ETid-274",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/EE/006","ETid-302","cms_tracker","Estonia","EE","Estonian Data Protection Authority (AKI)","2020-04-30","day",500,null,"EUR","Housing Association","Real Estate","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aki.ee/sites/default/files/ettekirjutused/2019/ettekirjutus-hoiatus_isikuandmete_kaitse_asjas_30.04.2020_nr_2.1.-6-20-19_korteriuhistu_outokumpu_19.pdf","https://www.enforcementtracker.com/ETid-302","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-6/20/19","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/018","APD/GBA (Belgium) - 19/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-04-29","day",null,"None","EUR",null,null,"Art. 24, Art. 32, Art. 5(1)(b), Art. 5(1)(f), Art. 5(2)","Accountability, Data principles, Data security",null,"Violation found","https://autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-19-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_19/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SE/014","ETid-273","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-04-29","day",18700,null,"EUR","National Government Service Centre (NGSC)","Public Sector and Education","Art. 33, Art. 34","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-ssc-20200428.pdf","https://www.enforcementtracker.com/ETid-273",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/BE/014","ETid-272","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2020-04-28","day",50000,null,"EUR","Proximus SA","Media, Telecoms and Broadcasting","Art. 31, Art. 37, Art. 58","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-18-2020.pdf","https://www.enforcementtracker.com/ETid-272","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_18/2020","gdprhub",null,null,"proximus sa",null,null,null,null,null,null,null,null,null],["2020/RO/020","ETid-297","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-04-23","day",3000,null,"EUR","Estee Lauder Romania","Industry and Commerce","Art. 6, Art. 7, Art. 9","Consent, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Amenda_pentru_incalcarea_RGPD_iunie_2020&lang=ro","https://www.enforcementtracker.com/ETid-297",null,null,null,null,"RO: estee lauder romania",null,null,null,null,null,null,null,null,null],["2020/RO/019","ETid-301","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-04-23","day",3000,null,"EUR","Telekom Romania Communications SA","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=O_noua_sanctiune_pentru_incalcarea_RGPD_iunie_2020&lang=ro","https://www.enforcementtracker.com/ETid-301",null,null,null,null,"telekom romania communications sa",null,null,null,null,null,null,null,null,null],["2020/SI/013","IP - 07121-1/2020/693","gdprhub","Slovenia","SI","IP (Slovenia)","2020-04-23","day",null,"None","EUR",null,null,"Art. 13, Art. 58","Transparency",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1579","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/693",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/014","IP - 07121-1/2020/701","gdprhub","Slovenia","SI","IP (Slovenia)","2020-04-23","day",null,"None","EUR",null,null,"Art. 4(1), Art. 58",null,null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1568","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/701",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/009","IP - 07120-1/2020/290","gdprhub","Slovenia","SI","IP (Slovenia)","2020-04-22","day",null,"None","EUR",null,null,"Art. 58",null,null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1520","https://gdprhub.eu/index.php?title=IP_-_07120-1/2020/290",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/011","IP - 07121-1/2020/519","gdprhub","Slovenia","SI","IP (Slovenia)","2020-04-22","day",null,"None","EUR",null,null,"Art. 13, Art. 14, Art. 57","Transparency",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1560","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/519",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/BE/015","APD/GBA (Belgium) - 16/2020","gdprhub","Belgium","BE","APD/GBA (Belgium)","2020-04-20","day",null,"None","EUR",null,null,"Art. 24, Art. 30(1), Art. 30(5), Art. 5(2)","Accountability, Data principles",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-16-2020.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_16/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SI/010","IP - 07121-1/2020/638","gdprhub","Slovenia","SI","IP (Slovenia)","2020-04-17","day",null,"None","EUR",null,null,"Art. 13, Art. 32, Art. 58, Art. 6(1)(c), Art. 7(3)","Consent, Data security, Transparency, Unlawful processing",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1509","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/638",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/BG/001","ETid-295","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2020-04-14","day",2000,null,"EUR","Political Party","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/?p=element&aid=1247","https://www.enforcementtracker.com/ETid-295","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PNN-01-433/2019","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/GB/013","ICO - FS50897723","gdprhub","United Kingdom","GB","ICO (UK)","2020-04-14","day",null,"None","EUR","The Insolvency Service",null,"Art. 10, Art. 5(1)(a)","Data principles, Special categories",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617657/fs50897723.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50897723",null,"gdprhub",null,null,"GB: the insolvency service",null,null,null,null,null,null,null,null,null],["2020/SI/008","IP - 07120-1/2020/278","gdprhub","Slovenia","SI","IP (Slovenia)","2020-04-10","day",null,"None","EUR",null,null,null,null,null,"Violation found","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1504","https://gdprhub.eu/index.php?title=IP_-_07120-1/2020/278",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/GR/012","HDPA (Greece) - Opinion 2/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-04-08","day",null,"None","EUR","Supreme Council For Civil Personnel Selection (ASEP)",null,"Art. 35(1), Art. 36(1)","DPIA",null,null,"https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2020&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_Opinion_2/2020",null,"gdprhub",null,null,"GR: supreme council for civil personnel selection",null,null,null,null,null,null,null,null,null],["2020/GR/001","ETid-634","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-04-07","day",2000,null,"EUR","Ιγνατιάδης Νικόλαος και ΣΙΑ Ε.Ε.","Employment","Art. 5(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dpa.gr/sites/default/files/2021-04/12_2021anonym.pdf","https://www.enforcementtracker.com/ETid-634","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_12/2021","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SI/012","IP - 07121-1/2020/527","gdprhub","Slovenia","SI","IP (Slovenia)","2020-04-07","day",null,"None","EUR",null,null,"Art. 58(3)",null,null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1480","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/527",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/PL/013","UODO (Poland) - DS.523.1470.2020","gdprhub","Poland","PL","UODO (Poland)","2020-04-06","day",null,"None","EUR","Ombudsman",null,"Art. 6(1)(c)","Unlawful processing",null,"Other Outcome","https://uodo.gov.pl/pl/138/1493","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_DS.523.1470.2020",null,"gdprhub",null,null,"PL: ombudsman",null,null,null,null,null,null,null,null,null],["2020/ES/169","AEPD (Spain) - PS/00473/2019","gdprhub","Spain","ES","AEPD (Spain)","2020-04-02","day",1500,"1500","EUR",null,null,"Art. 32, Art. 5","Data principles, Data security",null,"Violation found","https://www.aepd.es/es/documento/ps-00473-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00473/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/GB/012","ICO - FS50881277","gdprhub","United Kingdom","GB","ICO (UK)","2020-04-02","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617597/fs50881277.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50881277",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SI/005","IP - 07121-1/2020/428","gdprhub","Slovenia","SI","IP (Slovenia)","2020-03-29","day",null,"None","EUR",null,null,"Art. 58, Art. 6","Unlawful processing",null,null,"https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1456","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/428",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/GR/013","HDPA (Greece) - 6/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-03-27","day",null,"None","EUR","AXA Insurance",null,"Art. 17(1), Art. 17(3), Art. 40(5), Art. 5, Art. 58(2)(b)","Data principles, Data subject rights",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema=PORTAL","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_6/2020",null,"gdprhub",null,null,"GR: axa insurance",null,null,null,null,null,null,null,null,null],["2020/HU/014","ETid-303","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-03-26","day",2890,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2020-32-4-hatarozat.pdf","https://www.enforcementtracker.com/ETid-303",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/RO/025","ETid-261","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-03-25","day",2000,null,"EUR","SOS Infertility Association","Health Care","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_amenda_asociatia_sos_infertilitatea&lang=ro","https://www.enforcementtracker.com/ETid-261",null,null,null,null,"RO: sos infertility association",null,null,null,null,null,null,null,null,null],["2020/RO/024","ETid-262","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-03-25","day",3000,null,"EUR","Enel Energie","Transportation and Energy","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_amenda_enel_martie_2020&lang=ro","https://www.enforcementtracker.com/ETid-262",null,null,null,null,"RO: enel energie","Enel",null,null,null,null,null,null,null,null],["2020/RO/023","ETid-263","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-03-25","day",4150,null,"EUR","Vodafone Romania","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_noua_amenda_vodafone&lang=ro","https://www.enforcementtracker.com/ETid-263",null,null,null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2020/RO/022","ETid-264","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-03-25","day",3000,null,"EUR","Dante International","Industry and Commerce","Art. 21, Art. 6","Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/index.jsp?page=Comunicat_amenda_dante_international_martie_2020&lang=ro","https://www.enforcementtracker.com/ETid-264",null,null,null,null,"dante international sa",null,null,null,null,null,null,null,null,null],["2020/ES/092","ETid-266","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-25","day",5000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00436-2019.pdf","https://www.enforcementtracker.com/ETid-266","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00436/2019","gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/NO/025","Datatilsynet (Norway) - 19/02450","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-03-24","day",null,"None","EUR",null,null,"Art. 12(1), Art. 12(2), Art. 12(4), Art. 13(1)(d), Art. 24, Art. 5(1), Art. 5(1)(a), Art. 5(1)(b), Art. 5(2), Art. 57(1)(b), Art. 57(2), Art. 6, Art. 6(1)(f), Art. 70(1)","Accountability, Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.no","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_19/02450",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/NL/011","ETid-687","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2020-03-24","day",15000,null,"EUR","CP&A","Employment","Art. 32, Art. 9","Data security, Special categories","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boete_cpa_verzuimregistratie.pdf","https://www.enforcementtracker.com/ETid-687","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Boete_CP%26A_verzuimregistratie","gdprhub",null,null,"NL: cp and a",null,null,null,null,null,null,null,null,null],["2020/IT/048","Garante per la protezione dei dati personali (Italy) - 9304448","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-03-23","day",null,"None","EUR","Udine City Council",null,"Art. 5(1)(b), Art. 5(1)(c)","Data principles",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9304448","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9304448",null,"gdprhub",null,null,"IT: udine city council",null,null,null,null,null,null,null,null,null],["2020/SI/004","IP - 07121-1/2020/390","gdprhub","Slovenia","SI","IP (Slovenia)","2020-03-23","day",null,"None","EUR",null,null,"Art. 6(1)(c)","Unlawful processing",null,"n/a","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1441","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/390",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/GR/006","ETid-250","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-03-20","day",8000,null,"EUR","Speech and Special Education Centre - Mihou Dimitra","Health Care","Art. 15, Art. 58","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=89,253,106,96,141,223,198,107","https://www.enforcementtracker.com/ETid-250",null,null,null,null,"GR: speech and special education centre mihou dimitra",null,null,null,null,null,null,null,null,null],["2020/GR/011","HDPA (Greece) - 4/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-03-20","day",5000,"5000","EUR","Centre for speech therapy",null,"Art. 15(1), Art. 15(3), Art. 5(2)","Data principles, Data subject rights",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema=PORTAL","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_4/2020",null,"gdprhub",null,null,"GR: centre for speech therapy",null,null,null,null,null,null,null,null,null],["2020/SI/006","IP - 07121-1/2020/387","gdprhub","Slovenia","SI","IP (Slovenia)","2020-03-20","day",null,"None","EUR",null,null,"Art. 9","Special categories",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1374","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/387",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/SI/007","IP - 7121-1/2020/369","gdprhub","Slovenia","SI","IP (Slovenia)","2020-03-20","day",null,"None","EUR",null,null,"Art. 13, Art. 6, Art. 7, Art. 8","Consent, Transparency, Unlawful processing",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1375","https://gdprhub.eu/index.php?title=IP_-_7121-1/2020/369",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/ES/093","ETid-248","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-19","day",6000,null,"EUR","Oliveros Ustrell, S.L.","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00008-2020.pdf","https://www.enforcementtracker.com/ETid-248","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00008/2020","gdprhub",null,null,"oliveros ustrell sl",null,null,null,null,null,null,null,null,null],["2020/HU/013","ETid-304","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-03-19","day",5800,null,"EUR",null,null,"Art. 15, Art. 6","Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/files/NAIH-2020-200-hatarozat.pdf","https://www.enforcementtracker.com/ETid-304",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/047","Garante per la protezione dei dati personali (Italy) - 9296257","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-03-19","day",null,"None","EUR",null,null,"Art. 36(4)","DPIA",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9296257","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9296257",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/ES/099","ETid-240","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-18","day",30000,null,"EUR","Telefónica","Media, Telecoms and Broadcasting","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00351-2019.pdf","https://www.enforcementtracker.com/ETid-240","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00351/2019","gdprhub",null,null,"ES: telefonica","Telefonica",null,null,null,null,null,null,null,null],["2020/ES/098","ETid-243","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-16","day",5000,null,"EUR","Centro De Estudio Dirigidos Delta, S.L.","Public Sector and Education","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00425-2019.pdf","https://www.enforcementtracker.com/ETid-243","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00425/2019","gdprhub",null,null,"centro de estudio dirigidos delta sl",null,null,null,null,null,null,null,null,null],["2020/ES/097","ETid-244","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-16","day",4000,null,"EUR",null,"Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00335-2019.pdf","https://www.enforcementtracker.com/ETid-244","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00335/2019","gdprhub",null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2020/ES/094","ETid-247","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-16","day",6000,null,"EUR","Amalfi Servicios de Restauracion S.L.","Accommodation and Hospitality","Art. 13, Art. 14, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00317-2019.pdf","https://www.enforcementtracker.com/ETid-247",null,null,null,null,"amalfi servicios de restauracion sl",null,null,null,null,null,null,null,null,null],["2020/HR/001","ETid-239","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)","2020-03-13","day",null,null,"EUR",null,"Finance, Insurance and Consulting",null,"Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://azop.hr/aktualno/detaljnije/rjesenje-kojim-se-izrice-upravno-novcana","https://www.enforcementtracker.com/ETid-239","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_13-03-2020","gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2020/ES/095","ETid-246","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-12","day",2000,null,"EUR","Homeowners Association","Real Estate","Art. 13, Art. 14, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00272-2019.pdf","https://www.enforcementtracker.com/ETid-246",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/IS/011","Persónuvernd - 2020010738","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-03-12","day",null,"None","EUR","Creditinfo Lánstraust",null,null,null,null,"Rejected","https://www.personuvernd.is/urlausnir/vinnsla-personuupplysinga-i-tengslum-vid-gerd-skyrslu-um-lanshaefismat-hja-creditinfo-lanstrausti-hf.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010738",null,"gdprhub",null,null,"IS: creditinfo lanstraust",null,null,null,null,null,null,null,null,null],["2020/EE/011","AKI (Estonia) - 2.1-3/20/172","gdprhub","Estonia","EE","AKI (Estonia)","2020-03-11","day",null,"None","EUR",null,null,"Art. 16, Art. 17","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/vaideotsused/2020/vaideotsus_11.03.2020_isikuandmete_kaitse_asjas_nr_2.1.-3-20-172_-_andmekaitse_inspektsioon_-_eraisik.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-3/20/172",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/SE/015","ETid-232","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2020-03-11","day",5000000,null,"EUR","Google LLC","Media, Telecoms and Broadcasting","Art. 17, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/2020-03-11-beslut-google.pdf","https://www.enforcementtracker.com/ETid-232","https://gdprhub.eu/index.php?title=Datainspektionen_-_DI-2018-9274","gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2020/DK/006","ETid-230","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2020-03-10","day",7000,null,"EUR","Hørsholm Municipality","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2020/mar/to-kommuner-indstillet-til-boede/","https://www.enforcementtracker.com/ETid-230",null,null,null,null,"DK: hrsholm municipality",null,null,null,null,null,null,null,null,null],["2020/DK/005","ETid-231","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2020-03-10","day",14000,null,"EUR","Gladsaxe Municipality","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2020/mar/to-kommuner-indstillet-til-boede/","https://www.enforcementtracker.com/ETid-231",null,null,null,null,"DK: gladsaxe municipality",null,null,null,null,null,null,null,null,null],["2020/IS/002","ETid-233","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2020-03-10","day",20600,null,"EUR","National Center of Addiction Medicine ('SAA')","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.personuvernd.is/urlausnir/nr/2882","https://www.enforcementtracker.com/ETid-233","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010428","gdprhub",null,null,"IS: national center of addiction medicine",null,null,null,null,null,null,null,null,null],["2020/IS/001","ETid-234","cms_tracker","Iceland","IS","Icelandic data protection authority ('Persónuvernd')","2020-03-10","day",9000,null,"EUR","Breiðholt Upper Secondary School","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.personuvernd.is/urlausnir/nr/2885","https://www.enforcementtracker.com/ETid-234",null,null,null,null,"IS: breiholt upper secondary school",null,null,null,null,null,null,null,null,null],["2020/EE/010","AKI (Estonia) - 2.1-3/20/347","gdprhub","Estonia","EE","AKI (Estonia)","2020-03-09","day",null,"None","EUR",null,null,"Art. 15(1)","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/vaideotsused/2020/vaideotsus_09.03.2020_avaliku_teabe_asjas_nr_2.1.-3-20-347_-_politsei-_ja_piirivalveamet_-_as_eesti_ekspress.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-3/20/347",null,"gdprhub",null,"Police",null,null,null,null,null,null,null,null,null,null],["2020/ES/100","ETid-229","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-09","day",15000,null,"EUR","Gesthotel Activos Balagares","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00358-2019.pdf","https://www.enforcementtracker.com/ETid-229",null,null,null,null,"ES: gesthotel activos balagares",null,null,null,null,null,null,null,null,null],["2020/PL/011","ETid-267","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-03-09","day",4400,null,"EUR","Vis Consulting Sp. z o.o.","Finance, Insurance and Consulting","Art. 31, Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://uodo.gov.pl/decyzje/ZSPR.421.19.2019","https://www.enforcementtracker.com/ETid-267","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSPR.421.19.2019","gdprhub",null,null,"vis consulting spzoo",null,null,null,null,null,null,null,null,null],["2020/HU/015","ETid-284","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-03-09","day",870,null,"EUR","Creditor","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2020-2555-hatarozat.pdf","https://www.enforcementtracker.com/ETid-284","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/2555","gdprhub",null,null,"HU: creditor",null,null,null,null,null,null,null,null,null],["2020/IT/040","ETid-226","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-03-06","day",4000,null,"EUR","Liceo Artistico Statale di Napoli","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9283029","https://www.enforcementtracker.com/ETid-226","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9283029","gdprhub",null,null,"IT: liceo artistico statale di napoli",null,null,null,null,null,null,null,null,null],["2020/IT/039","ETid-227","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-03-06","day",4000,null,"EUR","Liceo Scientifico Nobel di Torre del Greco","Public Sector and Education","Art. 5, Art. 6, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9283014","https://www.enforcementtracker.com/ETid-227","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9283014","gdprhub",null,null,"IT: liceo scientifico nobel di torre del greco",null,null,null,null,null,null,null,null,null],["2020/ES/101","ETid-228","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-06","day",4000,null,"EUR",null,"Individuals and Private Associations","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00293-2019.pdf","https://www.enforcementtracker.com/ETid-228",null,null,null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["2020/ES/096","ETid-245","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-06","day",3200,null,"EUR","Retailer","Industry and Commerce","Art. 13, Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00360-2019.pdf","https://www.enforcementtracker.com/ETid-245",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/SI/003","IP - 07121-1/2020/305","gdprhub","Slovenia","SI","IP (Slovenia)","2020-03-06","day",null,"None","EUR",null,null,null,null,null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1351","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/305",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/DK/009","Datatilsynet (Denmark) - 2019-441-3399","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2020-03-05","day",null,"None","EUR",null,null,"Art. 32, Art. 33(2), Art. 34(1)","Data breach, Data security",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/mar/risikovurdering-ved-videregivelse-af-personoplysninger/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-441-3399",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/IT/035","ETid-325","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-03-05","day",3000,null,"EUR","San Giorgio Jonico","Public Sector and Education","Art. 17, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9361186","https://www.enforcementtracker.com/ETid-325","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9361186","gdprhub",null,null,"IT: san giorgio jonico",null,null,null,null,null,null,null,null,null],["2020/IS/003","Persónuvernd - 2020010382","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-03-05","day",null,"1300000","ISK","Breiðholt Multicultural School",null,"Art. 32, Art. 5(1)(f), Art. 83(2)(c)","Data principles, Data security",null,"Violation found","https://www.personuvernd.is/urlausnir/oryggisbrestur-hja-fjolbrautaskolanum-i-breidholti-sektarakvordun-1","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010382",null,"gdprhub",null,null,"IS: breiholt multicultural school",null,1300000.0,9142,"day 2020-03-05|142.2000|ISK",null,null,null,null,null],["2020/IS/005","Persónuvernd - 2020010591","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2020-03-05","day",null,"None","EUR",null,null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.personuvernd.is/urlausnir/alit-um-ofullnaegjandi-oryggi-personuupplysinga-sem-unnt-var-ad-midla-i-gegnum-vefsidu-umbodsmanns-borgarbua.","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010591",null,"gdprhub",null,"Citizens' Ombudsman",null,null,null,null,null,null,null,null,null,null],["2020/EE/008","AKI (Estonia) - 2.1-1/19/4627","gdprhub","Estonia","EE","AKI (Estonia)","2020-03-04","day",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,"Other Outcome","https://www.aki.ee/sites/default/files/vaideotsused/2020/vaideotsus_04.03.2020_isikuandmete_kaitse_asjas_nr_2.1.-3-20-287_-_andmekaitse_inspektsioon_-_eraisik.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-1/19/4627",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/PL/012","ETid-224","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2020-03-04","day",null,null,"EUR","School in Gdansk (Danzig) (fine imposed against town of Gdansk)","Public Sector and Education","Art. 5, Art. 9","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/decyzje/ZSZZS.440.768.2018,","https://www.enforcementtracker.com/ETid-224",null,null,null,null,"PL: school in gdansk",null,null,null,null,null,null,null,null,null],["2020/ES/102","ETid-225","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-04","day",60000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00429-2019.pdf","https://www.enforcementtracker.com/ETid-225","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00429/2019","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/HU/016","ETid-260","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-03-04","day",290,null,"EUR","Representative of a local government","Public Sector and Education","Art. 12, Art. 15, Art. 17, Art. 5, Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2020-32-4-hatarozat.pdf","https://www.enforcementtracker.com/ETid-260",null,null,null,null,"HU: representative of a local government",null,null,null,null,null,null,null,null,null],["2020/HU/017","NAIH (Hungary) - NAIH/2020/32/4","gdprhub","Hungary","HU","NAIH (Hungary)","2020-03-04","day",13136,"13,136","EUR",null,null,"Art. 12, Art. 17, Art. 5(1)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.naih.hu/files/NAIH-2020-32-4-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/32/4",null,"gdprhub",null,"Deputy mayor",null,null,null,null,null,"person",null,null,null,null],["2020/NL/012","ETid-218","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2020-03-03","day",525000,null,"EUR","Royal Dutch Tennis Association (\"KNLTB\")","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boetebesluit_knltb.pdf","https://www.enforcementtracker.com/ETid-218",null,null,null,null,"NL: royal dutch tennis association",null,null,null,null,null,null,null,null,null],["2020/ES/106","ETid-220","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-03","day",1800,null,"EUR","Solo Embrague","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00469-2019.pdf","https://www.enforcementtracker.com/ETid-220",null,null,null,null,"ES: solo embrague",null,null,null,null,null,null,null,null,null],["2020/ES/105","ETid-221","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-03","day",42000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00474-2019.pdf","https://www.enforcementtracker.com/ETid-221",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/104","ETid-222","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-03","day",40000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00421-2019.pdf","https://www.enforcementtracker.com/ETid-222",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/103","ETid-223","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-03-03","day",24000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00426-2019.pdf","https://www.enforcementtracker.com/ETid-223",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/GR/016","HDPA (Greece) - 20/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-03-03","day",null,"None","EUR","401 Athens General Military Hospital",null,"Art. 2(2)(a), Art. 37(1), Art. 37(3), Art. 4(15), Art. 45, Art. 51, Art. 55, Art. 58(2)(d), Art. 6(1)(e), Art. 9(2)(g)","Data protection officer, International transfers, Special categories, Unlawful processing",null,"Rejected","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema=PORTAL","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_20/2020",null,"gdprhub",null,null,"GR: 401 athens general military hospital",null,null,null,null,null,null,null,null,null],["2020/GB/024","ICO - Monetary penalty to CRDNN","gdprhub","United Kingdom","GB","ICO (UK)","2020-03-02","day",null,"500,000","£",null,null,null,null,null,"Violation found","https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/03/scottish-company-hit-with-maximum-fine-for-nuisance-calls/","https://gdprhub.eu/index.php?title=ICO_-_Monetary_penalty_to_CRDNN",null,"gdprhub",null,"Scottish company",null,null,500000.0,573967,"day 2020-03-02|0.8711|GBP",null,null,null,null,null],["2020/ES/110","ETid-215","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-28","day",48000,null,"EUR","Vodafone ONO, S.A.U.","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00212-2019.pdf","https://www.enforcementtracker.com/ETid-215","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00212/2019","gdprhub",null,null,"vodafone ono sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/107","ETid-219","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-28","day",3600,null,"EUR","AEMA Hispánica","Employment","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00455-2019.pdf","https://www.enforcementtracker.com/ETid-219",null,null,null,null,"ES: aema hispanica",null,null,null,null,null,null,null,null,null],["2020/NO/009","ETid-237","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-02-28","day",null,null,"EUR","Coop Finnmark SA","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datatilsynet.no/contentassets/8dbf5b4b2a33471aacf375b1f0032347/varsel-om-overtredelsesgebyr.pdf","https://www.enforcementtracker.com/ETid-237",null,null,null,null,"coop finnmark sa",null,null,null,null,null,null,null,null,null],["2020/RO/027","ANSPDCP (Romania) - Fine to Dante Internațional SA","gdprhub","Romania","RO","ANSPDCP (Romania)","2020-02-27","day",3000,"3.000","EUR","Dante Internațional SA",null,"Art. 21(3), Art. 58(2)(c), Art. 58(2)(d), Art. 6","Data subject rights, Unlawful processing",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_amenda_dante_international_martie_2020&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_to_Dante_Interna%C8%9Bional_SA",null,"gdprhub",null,null,"dante international sa",null,null,null,null,null,null,null,null,null],["2020/ES/111","ETid-214","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-27","day",120000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00235-2019.pdf","https://www.enforcementtracker.com/ETid-214","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00235/2019","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/DK/008","Datatilsynet (Denmark) - 2019-431-0044","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2020-02-26","day",null,"None","EUR","Bankernes EDB Central (BEC)",null,"Art. 32(1), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/feb/videregivelse-af-beskyttede-adresseoplysninger/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-431-0044",null,"gdprhub",null,null,"DK: bankernes edb central",null,null,null,null,null,null,null,null,null],["2020/NO/010","ETid-235","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2020-02-26","day",null,null,"EUR","Rælingen Municipality","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/bc26a2a8b78b4b30b4b060a4cac80d90/varsel-ralingen.pdf","https://www.enforcementtracker.com/ETid-235",null,null,null,null,"NO: rlingen municipality",null,null,null,null,null,null,null,null,null],["2020/GR/009","HDPA (Greece) - 3/2020","gdprhub","Greece","GR","HDPA (Greece)","2020-02-26","day",5000,"5,000","EUR","Golf Centre of the Municipality of Glyfada",null,"Art. 15","Data subject rights",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_3/2020",null,"gdprhub",null,null,"GR: golf centre of the municipality of glyfada",null,null,null,null,null,null,null,null,null],["2020/RO/028","ANSPDCP (Romania) - fine to Enel Energie Muntenia SA","gdprhub","Romania","RO","ANSPDCP (Romania)","2020-02-25","day",3000,"3.000","EUR","Enel Energie Muntenia SA",null,"Art. 32","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_amenda_enel_martie_2020&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_fine_to_Enel_Energie_Muntenia_SA",null,"gdprhub",null,null,"enel energie muntenia sa","Enel",null,null,null,null,null,null,null,null],["2020/AT/004","DSB (Austria) - 2020-0.103.803","gdprhub","Austria","AT","DSB (Austria)","2020-02-25","day",null,"None","EUR","Bundesministerium für Landesverteidigung/Abwehramt (Federal Ministry of Defence/Defence Department)",null,null,null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200225_2020_0_103_803_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.103.803",null,"gdprhub",null,null,"AT: bundesministerium fur landesverteidigung abwehramt",null,null,null,null,null,null,null,null,null],["2020/NO/024","Datatilsynet (Norway) - 18/04147","gdprhub","Norway","NO","Datatilsynet (Norway)","2020-02-25","day",null,"1,000,000","NOK","Public Roads Administration (Statens vegvesen)",null,"Art. 17(1)(a), Art. 17(1)(d), Art. 25(1), Art. 5(1)(a), Art. 5(1)(c), Art. 5(1)(d), Art. 5(1)(e), Art. 5(1)(f), Art. 6(1)","Accountability, Data principles, Data subject rights, Unlawful processing",null,"Violation found","https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2020/varsel-om-overtredelsesgebyr-til-statens-vegvesen/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_18/04147",null,"gdprhub",null,null,"NO: public roads administration",null,1000000.0,98425,"day 2020-02-25|10.1600|NOK",null,null,null,null,null],["2020/ES/109","ETid-216","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-25","day",48000,null,"EUR","HM Hospitales","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00187-2019.pdf","https://www.enforcementtracker.com/ETid-216","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00187/2019","gdprhub",null,null,"ES: hm hospitales",null,null,null,null,null,null,null,null,null],["2020/ES/108","ETid-217","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-25","day",6000,null,"EUR","Casa Gracio Operation","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00369-2019.pdf","https://www.enforcementtracker.com/ETid-217",null,null,null,null,"ES: casa gracio operation",null,null,null,null,null,null,null,null,null],["2020/AT/005","DSB (Austria) - 2020-0.083.190","gdprhub","Austria","AT","DSB (Austria)","2020-02-21","day",null,"None","EUR",null,null,"Art. 82(6), Art. 83",null,null,null,"https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20200221_2020_0_083_190_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2020-0.083.190",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/GR/007","ETid-242","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-02-21","day",5000,null,"EUR","Public Power Corporation S.A.","Transportation and Energy","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=158,220,63,69,45,69,224,53","https://www.enforcementtracker.com/ETid-242","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_2/2020","gdprhub",null,null,"public power corp sa",null,null,null,null,null,null,null,null,null],["2020/BG/004","ETid-268","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2020-02-20","day",2560,null,"EUR","T.K. EOOD","Industry and Commerce","Art. 25(1), Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.cpdp.bg/download.php?part=rubric_element&aid=4563","https://www.enforcementtracker.com/ETid-268",null,null,null,null,"tk eood",null,null,null,null,null,null,null,null,null],["2020/BG/003","ETid-269","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2020-02-20","day",2560,null,"EUR","L.E. EOOD","Industry and Commerce","Art. 25(1), Art. 32, Art. 6","Accountability, Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.cpdp.bg/download.php?part=rubric_element&aid=4563","https://www.enforcementtracker.com/ETid-269",null,null,null,null,"le eood",null,null,null,null,null,null,null,null,null],["2020/ES/115","ETid-208","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-18","day",1500,null,"EUR","Mymoviles Europa 2000, S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/es/documento/ps-00423-2019.pdf","https://www.enforcementtracker.com/ETid-208","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00423/2019","gdprhub",null,null,"mymoviles europa 2000 sl",null,null,null,null,null,null,null,null,null],["2020/PL/015","UODO (Poland) - ZSZZS.440.768.2018","gdprhub","Poland","PL","UODO (Poland)","2020-02-18","day",null,"20.000","PLN","Szkoła Podstawowa nr 2 w Gdańsku (Primary School in Gdańsk)",null,"Art. 5(1)(c), Art. 58(2)(f), Art. 58(2)(g), Art. 58(2)(i), Art. 83(2), Art. 83(3), Art. 83(5)(a), Art. 83(7), Art. 9(1)","Data principles, Special categories",null,"Violation found","https://uodo.gov.pl/decyzje/ZSZZS.440.768.2018","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSZZS.440.768.2018",null,"gdprhub",null,null,"PL: szkoa podstawowa nr 2w gdansku",null,20000.0,4679,"day 2020-02-18|4.2746|PLN",null,null,null,null,null],["2020/ES/117","ETid-206","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-14","day",2500,null,"EUR","Grupo Valsor Y Losan, S.L.","Real Estate","Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00298-2019.pdf","https://www.enforcementtracker.com/ETid-206",null,null,null,null,"grupo valsor y losan sl",null,null,null,null,null,null,null,null,null],["2020/ES/116","ETid-207","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-14","day",3000,null,"EUR","Colegio Arenales Carabanchel (School)","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00466-2019.pdf","https://www.enforcementtracker.com/ETid-207",null,null,null,null,"ES: colegio arenales carabanchel",null,null,null,null,null,null,null,null,null],["2020/ES/114","ETid-209","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-14","day",80000,null,"EUR","Iberdrola Clientes","Transportation and Energy","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00181-2019.pdf","https://www.enforcementtracker.com/ETid-209",null,null,null,null,"ES: iberdrola clientes","Iberdrola",null,null,null,null,null,null,null,null],["2020/ES/113","ETid-210","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-14","day",42000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00471-2019.pdf","https://www.enforcementtracker.com/ETid-210",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/112","ETid-211","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-14","day",30000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00385-2019.pdf","https://www.enforcementtracker.com/ETid-211",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/SI/002","IP - 07121-1/2020/197","gdprhub","Slovenia","SI","IP (Slovenia)","2020-02-14","day",null,"None","EUR",null,null,"Art. 58(3)",null,null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1292","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/197",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/RO/029","ANSPDCP (Romania) - Association SOS Infertility","gdprhub","Romania","RO","ANSPDCP (Romania)","2020-02-13","day",2000,"2.000","EUR","Association SOS Infertility",null,"Art. 58(1)(a), Art. 58(1)(e), Art. 83(5)(e)",null,null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_amenda_asociatia_sos_infertilitatea&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Association_SOS_Infertility",null,"gdprhub",null,null,"RO: association sos infertility",null,null,null,null,null,null,null,null,null],["2020/IT/037","ETid-265","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-02-13","day",4000,null,"EUR","Comune di Urago","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9285411","https://www.enforcementtracker.com/ETid-265","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9285411","gdprhub",null,null,"IT: comune di urago",null,null,null,null,null,null,null,null,null],["2020/DK/007","Datatilsynet (Denmark) - 2018-32-0357","gdprhub","Denmark","DK","Datatilsynet (Denmark)","2020-02-11","day",null,"None","EUR","DMI",null,"Art. 26, Art. 4(11), Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Reprimand","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2020/feb/dmis-behandling-af-personoplysninger-om-hjemmesidebesoegende","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2018-32-0357",null,"gdprhub",null,null,"DK: dmi",null,null,null,null,null,null,null,null,null],["2020/RO/026","ETid-241","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2020-02-11","day",3000,null,"EUR","Vodafone Romania","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=sanctiune_vodafone_februarie_2020&lang=ro","https://www.enforcementtracker.com/ETid-241","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Vodafone_Rom%C3%A2nia_SA_1","gdprhub",null,null,"vodafone romania sa","Vodafone",null,null,null,null,null,null,null,null],["2020/GB/011","ICO - Monetary penalty to Cathay Pacific Airways Limited","gdprhub","United Kingdom","GB","ICO (UK)","2020-02-10","day",null,"500,000","GBP","Cathay Pacific Airways Limited",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2617314/cathay-pacific-mpn-20200210.pdf","https://gdprhub.eu/index.php?title=ICO_-_Monetary_penalty_to_Cathay_Pacific_Airways_Limited",null,"gdprhub",null,null,"cathay pacific airways ltd",null,500000.0,590821,"day 2020-02-10|0.8463|GBP",null,null,null,null,null],["2020/IT/038","ETid-249","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-02-06","day",20000,null,"EUR","RTI - Reti Televisive Italiane s.p.a.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9283121","https://www.enforcementtracker.com/ETid-249","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9283121","gdprhub",null,null,"rti reti televisive italiane spa",null,null,null,null,null,null,null,null,null],["2020/LU/001","CNPD (Luxembourg) - Délibération n° 3018","gdprhub","Luxembourg","LU","CNPD (Luxembourg)","2020-02-04","day",null,"None","EUR",null,null,"Art. 27",null,null,"Other Outcome","https://blog.zoller.lu/2020/05/how-to-effectively-evade-gdpr-and-reach.html","https://gdprhub.eu/index.php?title=CNPD_%28Luxembourg%29_-_D%C3%A9lib%C3%A9ration_n%C2%B0_3018",null,"gdprhub",null,"Company established outside the EU",null,null,null,null,null,null,null,null,null,null],["2020/ES/118","ETid-201","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-04","day",1500,null,"EUR","Cafetería Nagasaki","Accommodation and Hospitality","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00427-2018.pdf","https://www.enforcementtracker.com/ETid-201","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00427/2018","gdprhub",null,null,"ES: cafeteria nagasaki",null,null,null,null,null,null,null,null,null],["2020/SI/001","IP - 0712-1/2019/2725","gdprhub","Slovenia","SI","IP (Slovenia)","2020-02-04","day",null,"None","EUR",null,null,"Art. 58(3)",null,null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1244","https://gdprhub.eu/index.php?title=IP_-_0712-1/2019/2725",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2020/ES/127","ETid-192","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",60000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00227-2019.pdf","https://www.enforcementtracker.com/ETid-192","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00227/2019","gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2020/ES/126","ETid-193","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",75000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00270-2019.pdf","https://www.enforcementtracker.com/ETid-193",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/125","ETid-194","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",60000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00405-2019.pdf","https://www.enforcementtracker.com/ETid-194","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00405/2019","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/124","ETid-195","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",50000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00275-2019.pdf","https://www.enforcementtracker.com/ETid-195",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/123","ETid-196","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",20000,null,"EUR","Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal","Transportation and Energy","Art. 21, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00402-2019.pdf","https://www.enforcementtracker.com/ETid-196","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00402/2019","gdprhub",null,null,"iberia lineas aereas de espana sa operadora unipersonal",null,null,null,null,null,null,null,null,null],["2020/ES/122","ETid-197","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",75000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00278-2019.pdf","https://www.enforcementtracker.com/ETid-197",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/121","ETid-198","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",6670,null,"EUR","Banco Bilbao Vizcaya Argentaria S.L.","Finance, Insurance and Consulting","Art. 21, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00400-2019.pdf","https://www.enforcementtracker.com/ETid-198",null,null,null,null,"banco bilbao vizcaya argentaria sl","BBVA",null,null,null,null,null,null,null,null],["2020/ES/120","ETid-199","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",5000,null,"EUR","Queseria Artesenal Ameco S.L.","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00259-2019.pdf","https://www.enforcementtracker.com/ETid-199",null,null,null,null,"queseria artesenal ameco sl",null,null,null,null,null,null,null,null,null],["2020/ES/119","ETid-200","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-02-03","day",800,null,"EUR","Automoción","Industry and Commerce","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00292-2019.pdf","https://www.enforcementtracker.com/ETid-200","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00292/2019","gdprhub",null,null,"ES: automocion",null,null,null,null,null,null,null,null,null],["2020/GB/009","ICO - FS50867142","gdprhub","United Kingdom","GB","ICO (UK)","2020-02-03","day",null,"None","EUR","Devon and Cornwall Police",null,"Art. 4(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617194/fs50867142.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50867142",null,"gdprhub",null,null,"GB: devon and cornwall police",null,null,null,null,null,null,null,null,null],["2020/EE/009","AKI (Estonia) - 2.1-3/19/4628","gdprhub","Estonia","EE","AKI (Estonia)","2020-01-31","day",null,"None","EUR","Ministry of Environment",null,null,null,null,"Rejected","https://www.aki.ee/sites/default/files/vaideotsused/2020/vaideotsus_31.01.2020_avaliku_teabe_asjas_nr_2.1.-3-19-4628_-_eraisik_-_keskkonnaministeerium.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1-3/19/4628",null,"gdprhub",null,null,"EE: ministry of environment",null,null,null,null,null,null,null,null,null],["2020/GB/010","ICO - FS50887618","gdprhub","United Kingdom","GB","ICO (UK)","2020-01-31","day",null,"None","EUR","City of York Council",null,null,null,null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617161/fs50887618.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50887618",null,"gdprhub",null,null,"GB: city of york council",null,null,null,null,null,null,null,null,null],["2020/IT/036","ETid-324","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-01-30","day",4000,null,"EUR","Comune di Colledara","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9302897","https://www.enforcementtracker.com/ETid-324",null,null,null,null,"IT: comune di colledara",null,null,null,null,null,null,null,null,null],["2020/HU/012","ETid-305","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2020-01-24","day",1450,null,"EUR","Accounting firm","Finance, Insurance and Consulting","Art. 24, Art. 32","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.naih.hu/files/NAIH-2020-1137-hatarozat.pdf","https://www.enforcementtracker.com/ETid-305",null,null,null,null,"HU: accounting firm",null,null,null,null,null,null,null,null,null],["2020/IT/042","ETid-212","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-01-23","day",30000,null,"EUR","Azienda Ospedaliero Universitaria Integrata di Verona (Hospital)","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9269629","https://www.enforcementtracker.com/ETid-212","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9269629","gdprhub",null,null,"IT: azienda ospedaliero universitaria integrata di verona",null,null,null,null,null,null,null,null,null],["2020/IT/041","ETid-213","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-01-23","day",30000,null,"EUR","Sapienza Università di Roma","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9269618","https://www.enforcementtracker.com/ETid-213","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9269618","gdprhub",null,null,"IT: sapienza universita di roma",null,null,null,null,null,null,null,null,null],["2020/IT/046","Garante per la protezione dei dati personali (Italy) - 9261093","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)","2020-01-23","day",null,"None","EUR","Istat",null,null,null,null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9261093","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9261093",null,"gdprhub",null,null,"IT: istat",null,null,null,null,null,null,null,null,null],["2020/IT/044","ETid-189","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-01-15","day",27800000,null,"EUR","TIM (telecommunications operator)","Media, Telecoms and Broadcasting","Art. 17, Art. 21, Art. 32, Art. 5, Art. 6","Data principles, Data security, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9256486","https://www.enforcementtracker.com/ETid-189","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_9256486","gdprhub",null,null,"tim spa",null,null,null,null,null,null,null,null,null],["2020/IT/043","ETid-202","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2020-01-15","day",10000,null,"EUR","Community of Francavilla Fontana","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9261227","https://www.enforcementtracker.com/ETid-202",null,null,null,null,"IT: community of francavilla fontana",null,null,null,null,null,null,null,null,null],["2020/ES/128","ETid-191","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-01-14","day",3600,null,"EUR","Zhang Bordeta 2006, S.L. (Store and Restaurant)","Accommodation and Hospitality","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00397-2019.pdf","https://www.enforcementtracker.com/ETid-191",null,null,null,null,"zhang bordeta 2006 sl",null,null,null,null,null,null,null,null,null],["2020/CY/005","ETid-178","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2020-01-13","day",9000,null,"EUR","Social Insurance Services of the Ministry of Labor, Welfare and Social Insurance","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/ACDFDC478581BEE1C22584EE002EE9C2?OpenDocument","https://www.enforcementtracker.com/ETid-178",null,null,null,null,"CY: social insurance services of the ministry of labor welfare and social insurance",null,null,null,null,null,null,null,null,null],["2020/CY/004","ETid-182","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2020-01-13","day",1000,null,"EUR","M.L. PRO.FIT SOLUTIONS LTD","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/All/ACDFDC478581BEE1C22584EE002EE9C2?OpenDocument","https://www.enforcementtracker.com/ETid-182",null,null,null,"eShop for Sports","ml pro fit solutions ltd",null,null,null,null,null,null,null,null,null],["2020/GR/008","ETid-183","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2020-01-13","day",15000,null,"EUR","Allseas Marine S.A.","Employment",null,"Data principles","Non-compliance with general data processing principles","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=126,92,211,86,111,236,222,151","https://www.enforcementtracker.com/ETid-183",null,null,null,null,"allseas marine sa",null,null,null,null,null,null,null,null,null],["2020/EE/007","AKI (Estonia) - 2.1.-3/19/4304","gdprhub","Estonia","EE","AKI (Estonia)","2020-01-10","day",null,"None","EUR","EPLÜ",null,"Art. 15(1), Art. 15(3)","Data subject rights",null,"Violation found","https://www.aki.ee/sites/default/files/vaideotsused/2020/vaideotsus_10.01.2020_avaliku_teabe_asjas_nr_2.1.-3-19-4303_-_eraisik_-_aiwil_oigusburoo_ou.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-3/19/4304",null,"gdprhub",null,null,"EE: eplu",null,null,null,null,null,null,null,null,null],["2020/ES/132","ETid-172","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-01-09","day",3000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/es/documento/ps-00445-2019.pdf","https://www.enforcementtracker.com/ETid-172",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/133","ETid-171","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-01-07","day",44000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00093-2019.pdf","https://www.enforcementtracker.com/ETid-171","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00093/2019","gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2020/ES/131","ETid-173","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-01-07","day",75000,null,"EUR","EDP España S.A.U.","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00109-2019.pdf","https://www.enforcementtracker.com/ETid-173",null,null,null,null,"edp espana sau",null,null,null,null,null,null,null,null,null],["2020/ES/130","ETid-174","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-01-07","day",75000,null,"EUR","EDP Comercializadora, S.A.U.","Transportation and Energy","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00025-2019.pdf","https://www.enforcementtracker.com/ETid-174",null,null,null,null,"edp comercializadora sau",null,null,null,null,null,null,null,null,null],["2020/ES/129","ETid-175","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2020-01-07","day",10000,null,"EUR","Asociación de Médicos Demócratas","Health Care","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/es/documento/ps-00231-2019.pdf","https://www.enforcementtracker.com/ETid-175",null,null,null,null,"ES: asociacion de medicos democratas",null,null,null,null,null,null,null,null,null],["2020/BG/005","CPDP (Bulgaria) - PNN-01-137/2019","gdprhub","Bulgaria","BG","CPDP (Bulgaria)","2020-01-06","day",null,"10.0000","BGN",null,null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.cpdp.bg/","https://gdprhub.eu/index.php?title=CPDP_%28Bulgaria%29_-_PNN-01-137/2019",null,"gdprhub",null,"Utility services company",null,null,10000.0,5113,"day 2020-01-06|1.9558|BGN",null,null,null,null,null],["2020/BG/002","ETid-270","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2020-01-06","day",5110,null,"EUR","Utility Company","Industry and Commerce","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.cpdp.bg/download.php?part=rubric_element&aid=4563","https://www.enforcementtracker.com/ETid-270",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/022","ETid-1028","cms_tracker","Germany","DE","Data Protection Authority of Saarland","2020","year",null,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datenschutz.saarland.de/fileadmin/user_upload/uds/tberichte/tb29_DS_2020.pdf","https://www.enforcementtracker.com/ETid-1028",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/021","ETid-1029","cms_tracker","Germany","DE","Data Protection Authority of Saarland","2020","year",10000,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datenschutz.saarland.de/fileadmin/user_upload/uds/tberichte/tb29_DS_2020.pdf","https://www.enforcementtracker.com/ETid-1029",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/020","ETid-1030","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2020","year",300,null,"EUR","Employee at a Covid 19 testing center","Individuals and Private Associations","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutz.hessen.de/sites/datenschutz.hessen.de/files/HBDI_49_Ta%CC%88tigkeitsbericht_2020.pdf","https://www.enforcementtracker.com/ETid-1030",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/019","ETid-1032","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2020","year",null,null,"EUR","Operator of a ballet school","Individuals and Private Associations","Art. 6(1), Art. 7(1)","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.lda.brandenburg.de/sixcms/media.php/9/TB_2020_web.pdf","https://www.enforcementtracker.com/ETid-1032",null,null,null,null,"DE: operator of a ballet school",null,null,null,null,null,null,null,null,null],["2020/DE/018","ETid-1033","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2020","year",null,null,"EUR","Medical assistant","Individuals and Private Associations","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.lda.brandenburg.de/sixcms/media.php/9/TB_2020_web.pdf","https://www.enforcementtracker.com/ETid-1033",null,null,null,null,"DE: medical assistant",null,null,null,null,null,null,null,null,null],["2020/DE/017","ETid-1034","cms_tracker","Germany","DE","Data Protection Authority of Hessen","2020","year",null,null,"EUR","Corporation","Industry and Commerce","Art. 12(3), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/hessen/landesdatenschutzbeauftragter-2/773-49-tb-lfd-hessen-2020-o-drs-nr-vom-01-06-2021/file","https://www.enforcementtracker.com/ETid-1034",null,null,null,null,"corp",null,null,null,null,null,null,null,null,null],["2020/DE/016","ETid-1035","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",10000,null,"EUR","Clearview AI Inc.","Industry and Commerce","Art. 58(1)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1035",null,null,null,null,"clearview ai inc","Clearview AI",null,null,null,null,null,null,null,null],["2020/DE/015","ETid-1036","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",300,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1036",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/014","ETid-1037","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",400,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1037",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/013","ETid-1038","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",400600,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1038",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/012","ETid-1039","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",400600,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1039",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/011","ETid-1040","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",400600,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1040",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/010","ETid-1041","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",300400,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1041",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/009","ETid-1042","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",300400,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1042",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/008","ETid-1043","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",300400,null,"EUR","Police officer","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1043",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/007","ETid-1044","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",3000,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1044",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/006","ETid-1045","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",null,null,"EUR","Company","Industry and Commerce","Art. 32, Art. 6","Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1045",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/005","ETid-1046","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",13000,null,"EUR","Company","Industry and Commerce","Art. 26(2)",null,"Insufficient data processing agreement","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1046",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/004","ETid-1048","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",50100,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1048",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/003","ETid-1049","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",50100,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1049",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/002","ETid-1050","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2020","year",50100,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://datenschutz-hamburg.de/assets/pdf/29._taetigkeitsbericht_datenschutz_2020.PDF","https://www.enforcementtracker.com/ETid-1050",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/MT/007","ETid-1836","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2020","year",5000,null,"EUR",null,null,"Art. 32(1)(b), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1836",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/MT/006","ETid-1837","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2020","year",2500,null,"EUR",null,null,"Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1837",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/MT/005","ETid-1838","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2020","year",2500,null,"EUR",null,null,"Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1838",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/MT/004","ETid-1840","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2020","year",2000,null,"EUR",null,null,"Art. 32(1)(b)","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1840",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/MT/003","ETid-1841","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2020","year",2500,null,"EUR",null,null,"Art. 32(1)(b), Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1841",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/MT/002","ETid-1842","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2020","year",20000,null,"EUR",null,null,"Art. 13, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1842",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/MT/001","ETid-1843","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2020","year",4000,null,"EUR",null,null,"Art. 13, Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://idpc.org.mt/decisions/","https://www.enforcementtracker.com/ETid-1843",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/041","ETid-631","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",2700,null,"EUR","Mall.tv","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/kamery-na-verejnem-prostranstvi-uoou-00811-20/ds-6532/archiv=1&p1=5649","https://www.enforcementtracker.com/ETid-631",null,null,null,null,"CZ: mall tv",null,null,null,null,null,null,null,null,null],["2020/CZ/040","ETid-632","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",null,null,"EUR","Ski rental company","Industry and Commerce","Art. 12, Art. 13, Art. 15, Art. 16, Art. 17, Art. 18, Art. 19, Art. 20, Art. 21, Art. 5(1)(c), Art. 6(1), Art. 7(1)","Consent, Data principles, Data subject rights, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-prostrednictvim-kopii-obcanskych-prukazu/ds-6267/archiv=1&p1=5649","https://www.enforcementtracker.com/ETid-632",null,null,null,null,"CZ: ski rental company",null,null,null,null,null,null,null,null,null],["2020/CZ/039","ETid-639","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",387,null,"EUR","Private healthcare provider","Health Care","Art. 24, Art. 32(1)","Accountability, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uoou.cz/kontrola-zabezpeceni-internetovych-stranek-v-souvislosti-s-predavanim-vysledku-zdravotnich-vysetreni/ds-6254/archiv=1&p1=5649","https://www.enforcementtracker.com/ETid-639",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/037","ETid-641","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",1900,null,"EUR",null,"Industry and Commerce","Art. 12(2), Art. 15(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=49126","https://www.enforcementtracker.com/ETid-641",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/036","ETid-648","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",null,null,"EUR","Public university","Public Sector and Education","Art. 13, Art. 6(1)","Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-v-ramci-prijimaciho-rizeni-na-vysokou-skolu/ds-6252/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-648",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/035","ETid-649","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",null,null,"EUR","Healthcare provider","Health Care","Art. 12(1), Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-v-ambulantnim-informacnim-systemu/ds-6277/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-649",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/034","ETid-650","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",null,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 21","Data principles, Data subject rights","Non-compliance with general data processing principles","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-potencialnich-klientu-spolecnosti-se-zvlastnim-zamerenim-na-overovani-jejich-totoznosti-a-porizovani-kopii-prukazu-totoznosti-pri-zrizovani-bankovniho-uctu-uoou-02511-19/ds-6487/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-650",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/033","ETid-651","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",null,null,"EUR",null,"Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.uoou.cz/kontrola-vyuziti-biometriky-u-klientu-uoou-09654-18/ds-6546/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-651",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/032","ETid-652","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",3850,null,"EUR","Television broadcaster","Media, Telecoms and Broadcasting","Art. 12(1)","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.uoou.cz/kontrola-pouzivani-cookies-uoou-00374-20/ds-6500/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-652","https://gdprhub.eu/index.php?title=UOOU_-_UOOU-00374/20","gdprhub",null,null,"CZ: television broadcaster",null,null,null,null,null,null,null,null,null],["2020/CZ/031","ETid-653","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",null,null,"EUR","Municipality","Public Sector and Education","Art. 13, Art. 14(3), Art. 5(1)(a), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-v-aplikaci-mobilni-rozhlas-uoou-01419-20/ds-6478/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-653",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/030","ETid-654","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",null,null,"EUR",null,"Employment","Art. 5(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/kontrola-zverejnovani-fotografii-zamestnancu-na-internetovych-strankach-zamestnavatele-uoou-03225-19/ds-6474/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-654",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/CZ/029","ETid-655","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2020","year",19200,null,"EUR",null,null,"Art. 15, Art. 16, Art. 17, Art. 18, Art. 19, Art. 20, Art. 21, Art. 22, Art. 5(1)(a), Art. 6(1)","Data principles, Data subject rights, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.uoou.cz/zpracovani-osobnich-udaju-na-webovych-strankach-formou-preklapeni-udaju-z-verejnych-rejstriku-uoou-00196-20/ds-6496/archiv=0&p1=5649","https://www.enforcementtracker.com/ETid-655","https://gdprhub.eu/index.php?title=UOOU_-_UOOU-00196/20","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2020/LI/001","ETid-724","cms_tracker","Liechtenstein","LI","Data Protection Authority of Liechtenstein","2020","year",4100,null,"EUR",null,null,null,"Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datenschutzstelle.li/application/files/8816/2246/5791/Taetigkeitsbericht_-_2020.pdf","https://www.enforcementtracker.com/ETid-724",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/LT/001","ETid-739","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2020","year",8000,null,"EUR",null,null,"Art. 13, Art. 24, Art. 35, Art. 5","Accountability, DPIA, Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/2020%20m_%20asmens%20duomenu%20apsaugos%20Lietuvoje%20apzvalga.pdf","https://www.enforcementtracker.com/ETid-739",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/024","ETid-758","cms_tracker","Germany","DE","Data Protection Authority of Bavaria","2020","year",7000,null,"EUR",null,null,"Art. 58(1)(f)","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.lda.bayern.de/media/baylda_report_10.pdf","https://www.enforcementtracker.com/ETid-758",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2020/DE/023","ETid-791","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2020","year",65000,null,"EUR","Company","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://lfd.niedersachsen.de/download/169169,","https://www.enforcementtracker.com/ETid-791",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/GR/011","HDPA (Greece) - 47/2019","gdprhub","Greece","GR","HDPA (Greece)","2019-12-24","day",null,"None","EUR","National Register of Undesirable Aliens (EKANA)",null,"Art. 21, Art. 6","Data subject rights, Unlawful processing",null,"Rejected","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2019&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_47/2019",null,"gdprhub",null,null,"GR: national register of undesirable aliens",null,null,null,null,null,null,null,null,null],["2019/ES/034","AEPD (Spain) - PS/00291/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-12-23","day",6000,"6,000","EUR","Joker Premium Invex",null,"Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00291-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00291/2019",null,"gdprhub",null,null,"ES: joker premium invex",null,null,null,null,null,null,null,null,null],["2019/GR/012","HDPA (Greece) - 42/2024","gdprhub","Greece","GR","HDPA (Greece)","2019-12-23","day",56000,"56,000","EUR",null,null,"Art. 35, Art. 38, Art. 5(1)(a)","DPIA, Data principles, Data protection officer",null,"Violation found","https://www.dpa.gr/sites/default/files/2024-11/42_2024%20anonym.pdf","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_42/2024",null,"gdprhub",null,"Nautical Club",null,null,null,null,null,null,null,null,null,null],["2019/IS/004","Persónuvernd - nr. 2018/1640","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2019-12-20","day",null,"None","EUR",null,null,"Art. 21(2)","Data subject rights",null,"Violation found","https://www.personuvernd.is/urlausnir/simanum-hf.-oheimilt-ad-senda-tolvupost-vegna-markadssetningar-til-vidskiptavinar-sem-skradur-var-a-bannskra","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_nr._2018/1640",null,"gdprhub",null,"Telecommunication company",null,null,null,null,null,null,null,null,null,null],["2019/GR/001","ETid-188","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2019-12-19","day",150000,null,"EUR","Aegean Marine Petroleum Network Inc.","Transportation and Energy","Art. 32, Art. 5, Art. 6","Data principles, Data security, Unlawful processing","Insufficient technical and organisational measures to ensure information security","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=205,136,113,56,60,108,243,88","https://www.enforcementtracker.com/ETid-188","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_44/2019","gdprhub",null,null,"aegean marine petroleum network inc",null,null,null,null,null,null,null,null,null],["2019/AT/005","DSB (Austria) - D123.768/0004-DSB/2019","gdprhub","Austria","AT","DSB (Austria)","2019-12-18","day",null,"None","EUR",null,null,"Art. 4(4), Art. 4(7), Art. 85(1), Art. 85(2)",null,null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20191218_DSB_D123_768_0004_DSB_2019_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D123.768/0004-DSB/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/RO/006","ETid-156","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-18","day",2000,null,"EUR","Telekom Romania Mobile Communications SA","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=O_noua_amenda_pentru_incalcarea_RGPD_comunicat_decembrie&lang=ro","https://www.enforcementtracker.com/ETid-156",null,null,null,null,"telekom romania mobile communications sa",null,null,null,null,null,null,null,null,null],["2019/GB/001","ETid-158","cms_tracker","United Kingdom","GB","Information Commissioner (ICO)","2019-12-17","day",320000,null,"EUR","Doorstep Dispensaree Ltd. (Pharmacy)","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://ico.org.uk/media/action-weve-taken/enforcement-notices/2616741/doorstop-en-20191217.pdf","https://www.enforcementtracker.com/ETid-158",null,null,null,null,"doorstep dispensaree ltd",null,null,null,null,null,null,null,null,null],["2019/BE/002","ETid-159","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2019-12-17","day",2000,null,"EUR","Nursing Care Organisation","Industry and Commerce","Art. 12, Art. 15, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.autoriteprotectiondonnees.be/sites/privacycommission/files/documents/DEQF_13-2019_FR_ANO.pdf","https://www.enforcementtracker.com/ETid-159",null,null,null,null,"BE: nursing care organisation",null,null,null,null,null,null,null,null,null],["2019/BE/001","ETid-169","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2019-12-17","day",15000,null,"EUR","Website providing legal information","Media, Telecoms and Broadcasting","Art. 12, Art. 13, Art. 6","Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.gegevensbeschermingsautoriteit.be/sites/privacycommission/files/documents/BETG_12-2019_NL.PDF","https://www.enforcementtracker.com/ETid-169","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_12/2019","gdprhub",null,null,"BE: website providing legal information",null,null,null,null,null,null,null,null,null],["2019/SE/001","ETid-144","cms_tracker","Sweden","SE","Data Protection Authority of Sweden (Integritetsskyddsmyndigheten)","2019-12-16","day",35000,null,"EUR","Nusvar AB","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/beslut-tillsyn-mrkoll.pdf","https://www.enforcementtracker.com/ETid-144",null,null,null,null,"nusvar ab",null,null,null,null,null,null,null,null,null],["2019/RO/009","ETid-145","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-16","day",2000,null,"EUR","Globus Score SRL","Industry and Commerce","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/?page=Alta_amenda_pentru_incalcarea_GDPR&lang=en","https://www.enforcementtracker.com/ETid-145",null,null,null,null,"globus score srl",null,null,null,null,null,null,null,null,null],["2019/RO/003","ETid-177","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-16","day",6000,null,"EUR","SC Enel Energie S.A. (Electricity Distributor)","Transportation and Energy","Art. 21, Art. 5, Art. 6, Art. 7","Consent, Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=sanctiune_pentru_incalcarea_RGPD_2020_2&lang=ro","https://www.enforcementtracker.com/ETid-177",null,null,null,null,"RO: enel energie",null,null,null,null,null,null,null,null,null],["2019/RO/002","ETid-184","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-13","day",5000,null,"EUR","Entirely Shipping & Trading S.R.L.","Employment","Art. 5(1), Art. 6, Art. 7","Consent, Data principles, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=O_noua_sanctiune_pentru_incalcarea_RGPD_2020_3&lang=ro","https://www.enforcementtracker.com/ETid-184",null,null,null,null,"entirely shipping and trading srl",null,null,null,null,null,null,null,null,null],["2019/RO/001","ETid-185","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-13","day",5000,null,"EUR","Entirely Shipping & Trading S.R.L.","Employment","Art. 5(1), Art. 6, Art. 7, Art. 9","Consent, Data principles, Special categories, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.dataprotection.ro/index.jsp?page=O_noua_sanctiune_pentru_incalcarea_RGPD_2020_3&lang=ro","https://www.enforcementtracker.com/ETid-185",null,null,null,null,"entirely shipping and trading srl",null,null,null,null,null,null,null,null,null],["2019/CZ/002","ETid-2817","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-12-13","day",2000,null,"EUR","Legal Person",null,"Art. 15(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/156-cj-uoou-0336219-11-dokument-c-156.pdf","https://www.enforcementtracker.com/ETid-2817",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/010","ETid-157","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-12-11","day",1430,null,"EUR",null,"Employment","Art. 13, Art. 24, Art. 25, Art. 5, Art. 6","Accountability, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://naih.hu/files/NAIH-2019-51-hatarozat.pdf","https://www.enforcementtracker.com/ETid-157","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2019/51/11","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/IT/002","ETid-186","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2019-12-11","day",8500000,null,"EUR","Eni Gas e Luce","Transportation and Energy","Art. 17, Art. 21, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9244365","https://www.enforcementtracker.com/ETid-186",null,null,null,null,"IT: eni gas e luce",null,null,null,null,null,null,null,null,null],["2019/IT/001","ETid-187","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2019-12-11","day",3000000,null,"EUR","Eni Gas e Luce","Transportation and Energy","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9244358","https://www.enforcementtracker.com/ETid-187",null,null,null,null,"IT: eni gas e luce",null,null,null,null,null,null,null,null,null],["2019/GR/009","HDPA (Greece) - 41/2019","gdprhub","Greece","GR","HDPA (Greece)","2019-12-11","day",null,"None","EUR",null,null,"Art. 12(3), Art. 12(4), Art. 15(1), Art. 15(3), Art. 16, Art. 58(2)(b)","Data subject rights, Transparency",null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema=PORTAL","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_41/2019",null,"gdprhub",null,"Ministry of Mercantile Marine",null,null,null,null,null,null,null,null,null,null],["2019/ES/005","ETid-147","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-12-10","day",1600,null,"EUR","Megastar SL","Industry and Commerce","Art. 13, Art. 5(1)(c)","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/es/documento/ps-00279-2019.pdf","https://www.enforcementtracker.com/ETid-147",null,null,null,null,"megastar sl",null,null,null,null,null,null,null,null,null],["2019/ES/001","ETid-161","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-12-10","day",5000,null,"EUR","Shop Macoyn, S.L.","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/es/documento/ps-00320-2019.pdf","https://www.enforcementtracker.com/ETid-161",null,null,null,null,"shop macoyn sl",null,null,null,null,null,null,null,null,null],["2019/RO/004","ETid-176","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-10","day",14000,null,"EUR","Hora Credit IFN SA","Finance, Insurance and Consulting","Art. 25, Art. 32, Art. 33, Art. 5","Accountability, Data breach, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Alta_amenda_pentru_incalcarea_RGPD_2020_1&lang=ro","https://www.enforcementtracker.com/ETid-176",null,null,null,null,"hora credit ifn sa",null,null,null,null,null,null,null,null,null],["2019/DE/014","ETid-129","cms_tracker","Germany","DE","The Federal Commissioner for Data Protection and Freedom of Information (BfDI)","2019-12-09","day",10000,null,"EUR","Rapidata GmbH","Media, Telecoms and Broadcasting","Art. 37","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://www.bfdi.bund.de/DE/Infothek/Pressemitteilungen/2019/30_BfDIverh%C3%A4ngtGeldbu%C3%9Fe1u1.html","https://www.enforcementtracker.com/ETid-129",null,null,null,null,"rapidata gmbh",null,null,null,null,null,null,null,null,null],["2019/NL/002","AP (The Netherlands) - Boete vingerafdrukken personeel","gdprhub","Netherlands","NL","AP (The Netherlands)","2019-12-04","day",725000,"725000","EUR",null,null,"Art. 9(1), Art. 9(2)(a), Art. 9(2)(g)","Special categories",null,"Violation found","https://www.autoriteitpersoonsgegevens.nl/uploads/imported/boetebesluit_vingerafdrukken_personeel.pdf","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_Boete_vingerafdrukken_personeel",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["2019/RO/012","ETid-125","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-04","day",20000,null,"EUR","S CNTAR TAROM SA (Airline)","Transportation and Energy","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Sanctiune_CN_TAROM&lang=ro","https://www.enforcementtracker.com/ETid-125",null,null,null,null,"s cntar tarom sa",null,null,null,null,null,null,null,null,null],["2019/DE/015","ETid-122","cms_tracker","Germany","DE","Data Protection Authority of Rheinland-Pfalz","2019-12-03","day",105000,null,"EUR","Hospital","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/geldbusse-gegen-krankenhaus-aufgrund-von-datenschutz-defiziten-beim-patientenmanagement/","https://www.enforcementtracker.com/ETid-122",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/ES/007","ETid-142","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-12-03","day",1500,null,"EUR","Cerrajeria Verin S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/resoluciones/PS-00265-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-142",null,null,null,null,"cerrajeria verin sl",null,null,null,null,null,null,null,null,null],["2019/ES/006","ETid-146","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-12-03","day",5000,null,"EUR","Linea Directa Aseguradora","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00250-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-146",null,null,null,null,"ES: linea directa aseguradora",null,null,null,null,null,null,null,null,null],["2019/AT/007","DSB (Austria) - D130.206/0006-DSB/2019","gdprhub","Austria","AT","DSB (Austria)","2019-12-02","day",null,"None","EUR","N***Group AG",null,"Art. 12(1), Art. 12(2), Art. 12(3), Art. 13(1)(a), Art. 13(2), Art. 13(3), Art. 15(1)(e), Art. 15(1)(f), Art. 15(3), Art. 27(1), Art. 27(5), Art. 3(2)(a), Art. 3(3), Art. 4(7), Art. 5(1)(a), Art. 5(2), Art. 57(1)(f), Art. 58(1)(b), Art. 58(2)(c), Art. 58(2)(d), Art. 77(1)","Data principles, Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20190822_DSB_D130_206_0006_DSB_2019_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D130.206/0006-DSB/2019",null,"gdprhub",null,null,"n group ag",null,null,null,null,null,null,null,null,null],["2019/RO/007","ETid-149","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-12-02","day",2000,null,"EUR","Nicola Medical Team 17 SRL","Health Care","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Noi_amenzi_in_aplicarea_RGPD&lang=ro","https://www.enforcementtracker.com/ETid-149",null,null,null,null,"nicola medical team 17 srl",null,null,null,null,null,null,null,null,null],["2019/RO/010","ETid-127","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-11-29","day",2500,null,"EUR","Royal President S.R.L.","Industry and Commerce","Art. 15, Art. 32, Art. 6","Data security, Data subject rights, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=alta_sanctiune_Royal_President&lang=ro","https://www.enforcementtracker.com/ETid-127",null,null,null,null,"royal president srl",null,null,null,null,null,null,null,null,null],["2019/RO/005","ETid-160","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-11-29","day",500,null,"EUR","Homeowners Association","Real Estate","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Amenda_asociatie_proprietari&lang=ro","https://www.enforcementtracker.com/ETid-160",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/BE/004","ETid-123","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2019-11-28","day",5000,null,"EUR","Mayor","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/news/la-chambre-contentieuse-sanctionne-deux-candidats-aux-elections-communales-de-2018","https://www.enforcementtracker.com/ETid-123",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/BE/003","ETid-124","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2019-11-28","day",5000,null,"EUR","Municipal alderman","Public Sector and Education","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/news/la-chambre-contentieuse-sanctionne-deux-candidats-aux-elections-communales-de-2018","https://www.enforcementtracker.com/ETid-124",null,null,null,null,"BE: municipal alderman",null,null,null,null,null,null,null,null,null],["2019/RO/011","ETid-126","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-11-28","day",null,null,"EUR","ING Bank N.V.","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Amenda_ING_RGPD&lang=ro","https://www.enforcementtracker.com/ETid-126",null,null,null,null,"ing bank nv","ING",null,null,null,null,null,null,null,null],["2019/ES/008","ETid-141","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-28","day",75000,null,"EUR","Curenergía Comercializador de último recurso","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00140-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-141",null,null,null,null,"curenergia comercializador de ultimo recurso sau",null,null,null,null,null,null,null,null,null],["2019/RO/008","ETid-148","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-11-26","day",3000,null,"EUR","Modern Barber","Industry and Commerce","Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.dataprotection.ro/index.jsp?page=Noi_amenzi_in_aplicarea_RGPD&lang=ro","https://www.enforcementtracker.com/ETid-148",null,null,null,null,"RO: modern barber",null,null,null,null,null,null,null,null,null],["2019/BE/009","APD/GBA (Belgium) - 10/2019","gdprhub","Belgium","BE","APD/GBA (Belgium)","2019-11-25","day",null,"None","EUR",null,null,"Art. 5(1)(b), Art. 5(1)(e), Art. 6(4)","Data principles, Unlawful processing",null,"Violation found","https://autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-10-2019.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_10/2019",null,"gdprhub",null,"Mayor",null,null,null,null,null,"person",null,null,null,null],["2019/BE/010","APD/GBA (Belgium) - 11/2019","gdprhub","Belgium","BE","APD/GBA (Belgium)","2019-11-25","day",5000,"5,000","EUR",null,null,"Art. 5(1)(b), Art. 5(1)(e), Art. 6(4)","Data principles, Unlawful processing",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-11-2019.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_11/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/RO/014","ETid-115","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-11-25","day",11000,null,"EUR","FAN Courier Express SRL","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=O_noua_amenda_in_baza_RGPD&lang=ro","https://www.enforcementtracker.com/ETid-115","https://gdprhub.eu/index.php?title=ANSDPCP_%28Romania%29_-_Fan_Courrier_Express_SRL","gdprhub",null,null,"fan courier express srl",null,null,null,null,null,null,null,null,null],["2019/RO/013","ETid-116","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-11-22","day",2000,null,"EUR","BNP Paribas Personal Finance S.A.","Finance, Insurance and Consulting","Art. 12, Art. 17","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.ro/index.jsp?page=Amenda_pentru_incalcarea_RGPD&lang=ro","https://www.enforcementtracker.com/ETid-116","https://gdprhub.eu/index.php?title=ANSDPCP_%28Romania%29_-_BNP_Paribas_Personal_Finance_SA_Paris_Sucursala_Bucure%C8%99ti","gdprhub",null,null,"bnp paribas personal finance sa",null,null,null,null,null,null,null,null,null],["2019/ES/020","ETid-114","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-21","day",60000,null,"EUR","Viaqua Xestión Integral Augas de Galicia","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00233-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-114",null,null,null,null,"ES: viaqua xestion integral augas de galicia",null,null,null,null,null,null,null,null,null],["2019/FR/001","ETid-118","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2019-11-21","day",500000,null,"EUR","Futura Internationale","Industry and Commerce","Art. 13, Art. 14, Art. 21, Art. 31, Art. 44, Art. 5, Art. 6","Data principles, Data subject rights, International transfers, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000039419459&fastReqId=461698027&fastPos=1","https://www.enforcementtracker.com/ETid-118","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2019-010","gdprhub",null,null,"FR: futura internationale",null,null,null,null,null,null,null,null,null],["2019/IS/003","Persónuvernd - nr. 2018/1779","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2019-11-20","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(f), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-simtalaskrar-og-medferd-tolvupostholfs-eftir-starfslok","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_nr._2018/1779",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2019/IS/002","Persónuvernd- nr. 2018/1779","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2019-11-20","day",null,"None","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(f), Art. 6(1)(a)","Data principles, Unlawful processing",null,"Violation found","https://www.personuvernd.is/urlausnir/midlun-simtalaskrar-og-medferd-tolvupostholfs-eftir-starfslok","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd-_nr._2018/1779",null,"gdprhub",null,"Employer",null,null,null,null,null,null,null,null,null,null],["2019/ES/021","ETid-113","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-19","day",60000,null,"EUR","Corporación radiotelevisión espanola","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/resoluciones/PS-00305-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-113",null,null,null,null,"ES: corporacion radiotelevision espanola",null,null,null,null,null,null,null,null,null],["2019/ES/018","ETid-119","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-19","day",60000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/resoluciones/PS-00237-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-119",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2019/ES/004","ETid-151","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-19","day",6000,null,"EUR","Sports Bar","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00236-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-151",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/022","NAIH (Hungary) - NAIH/2019/5112/15","gdprhub","Hungary","HU","NAIH (Hungary)","2019-11-18","day",null,"None","EUR","Hospital",null,"Art. 12(3), Art. 15, Art. 5(1)(d)","Data principles, Data subject rights, Transparency",null,"Violation found","https://www.naih.hu/files/NAIH-2019-5112-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2019/5112/15",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/024","NAIH (Hungary) - NAIH/2020/974/4","gdprhub","Hungary","HU","NAIH (Hungary)","2019-11-18","day",null,"1000000","HUF",null,null,"Art. 13, Art. 5(1)(a), Art. 5(2), Art. 6(1)(a), Art. 9(1)","Data principles, Special categories, Transparency, Unlawful processing",null,"Violation found","https://www.naih.hu/files/NAIH-2020-974-hatarozat.pdf","https://gdprhub.eu/index.php?title=NAIH_%28Hungary%29_-_NAIH/2020/974/4",null,"gdprhub",null,"Organiser of the \"Join the EPPO\" initiative",null,null,1000000.0,2983,"day 2019-11-18|335.2700|HUF",null,null,null,null,null],["2019/ES/019","ETid-117","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-14","day",30000,null,"EUR","Telefónica SA","Media, Telecoms and Broadcasting","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00251-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-117",null,null,null,null,"ES: telefonica","Telefonica",null,null,null,null,null,null,null,null],["2019/ES/042","AEPD (Spain) - PS/00174/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-13","day",null,"None","EUR","General Labour Union (GCT)",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00174-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00174/2019",null,"gdprhub",null,null,"ES: general labour union",null,null,null,null,null,null,null,null,null],["2019/ES/022","ETid-110","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-13","day",3000,null,"EUR","General Confederation of Labour ('CGT')","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00174-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-110",null,null,null,null,"ES: general confederation of labour",null,null,null,null,null,null,null,null,null],["2019/FR/007","CNIL (France) - MED-2019-027","gdprhub","France","FR","CNIL (France)","2019-11-12","day",null,"None","EUR","French Ministry of Internal Affairs",null,"Art. 24(1), Art. 24(2), Art. 25(1), Art. 25(2)","Accountability",null,"Violation found","https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000039445820&fastReqId=190592425&fastPos=2","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_MED-2019-027",null,"gdprhub",null,null,"FR: french ministry of internal affairs",null,null,null,null,null,null,null,null,null],["2019/ES/025","ETid-103","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-07","day",900,null,"EUR","TODOTECNICOS24H S.L.","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/resoluciones/PS-00268-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-103",null,null,null,null,"todotecnicos24h sl",null,null,null,null,null,null,null,null,null],["2019/GB/005","ICO - FS50777458","gdprhub","United Kingdom","GB","ICO (UK)","2019-11-07","day",null,"None","EUR","Wales Interpretation and Translation Service",null,"Art. 4(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616299/fs50777458-1.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50777458",null,"gdprhub",null,null,"GB: wales interpretation and translation service",null,null,null,null,null,null,null,null,null],["2019/ES/041","AEPD (Spain) - E/05724/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-06","day",null,"None","EUR","Centros comerciales Carrefour S.A.",null,"Art. 32, Art. 33","Data breach, Data security",null,"Violation found","https://www.aepd.es/es/documento/e-08158-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/05724/2019",null,"gdprhub",null,null,"centros comerciales carrefour sa","Carrefour",null,null,null,null,null,null,null,null],["2019/ES/040","AEPD (Spain) - E/08158/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-06","day",null,"None","EUR","Intercambiador detransportes avenida de america, S.A.U.",null,"Art. 32, Art. 33","Data breach, Data security",null,"Violation found","https://www.aepd.es/es/documento/e-08158-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/08158/2019",null,"gdprhub",null,null,"intercambiador detransportes avenida de america sau",null,null,null,null,null,null,null,null,null],["2019/ES/039","AEPD (Spain) - E/08205/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-06","day",null,"None","EUR","promofarma ecom S.L",null,"Art. 32, Art. 33, Art. 5(1)(f)","Data breach, Data principles, Data security",null,"Violation found","https://www.aepd.es/es/documento/e-08205-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/08205/2019",null,"gdprhub",null,null,"promofarma ecom sl",null,null,null,null,null,null,null,null,null],["2019/ES/038","AEPD (Spain) - PS/00266/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-06","day",1500,"1,500","EUR","Cerrajero Online SL",null,"Art. 13, Art. 83(2)(e)","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00266-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00266/2019",null,"gdprhub",null,null,"ES: cerrajero online",null,null,null,null,null,null,null,null,null],["2019/ES/043","AEPD (Spain) - PS/00268/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-06","day",900,"900","EUR","Todotecnicos24h S.L",null,"Art. 13","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00268-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00268/2019",null,"gdprhub",null,null,"todotecnicos24h sl",null,null,null,null,null,null,null,null,null],["2019/ES/024","ETid-105","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-06","day",900,null,"EUR","Cerrajero Online","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.aepd.es/resoluciones/PS-00266-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-105",null,null,null,null,"ES: cerrajero online",null,null,null,null,null,null,null,null,null],["2019/ES/003","ETid-152","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-11-06","day",60000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00140-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-152",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2019/ES/037","AEPD (Spain) - PS/00188/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-05","day",null,"None","EUR","Madrileña Red De Gas, S.A.U.",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00188-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00188/2019",null,"gdprhub",null,null,"madrilena red de gas sau",null,null,null,null,null,null,null,null,null],["2019/FR/009","CNIL (France) - MED-2019-025","gdprhub","France","FR","CNIL (France)","2019-11-05","day",null,"None","EUR","BOUTIQUE.AERO",null,"Art. 13, Art. 30(1), Art. 32, Art. 5(1)(c)","Data principles, Data security, Transparency",null,"Violation found","https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000039466203&fastReqId=105441404&fastPos=2","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_MED-2019-025",null,"gdprhub",null,null,"FR: boutique aero",null,null,null,null,null,null,null,null,null],["2019/SI/003","IP - 0712-1/2019/2504","gdprhub","Slovenia","SI","IP (Slovenia)","2019-11-05","day",null,"None","EUR",null,null,"Art. 5(1)(c), Art. 58(3), Art. 6(1)(b)","Data principles, Unlawful processing",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1049","https://gdprhub.eu/index.php?title=IP_-_0712-1/2019/2504",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2019/ES/035","AEPD (Spain) - PS/00324/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-04","day",null,"None","EUR","El Maestro Cerrajero SL",null,"Art. 13","Transparency",null,"Other Outcome","https://www.aepd.es/es/documento/ps-00324-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00324/2019",null,"gdprhub",null,null,"el maestro cerrajero sl",null,null,null,null,null,null,null,null,null],["2019/ES/036","AEPD (Spain) - TD/00182/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-11-04","day",null,"None","EUR","KUTXABANK S.A.",null,"Art. 15","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/td-00182-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00182/2019",null,"gdprhub",null,null,"kutxabank sa",null,null,null,null,null,null,null,null,null],["2019/SI/002","IP - 0712-1/2019/2356","gdprhub","Slovenia","SI","IP (Slovenia)","2019-11-04","day",null,"None","EUR",null,null,null,null,null,"non-binding","https://www.ip-rs.si/mnenja-gdpr/6048a38d44e0a","https://gdprhub.eu/index.php?title=IP_-_0712-1/2019/2356",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2019/SI/001","IP - 0712-1/2019/2419","gdprhub","Slovenia","SI","IP (Slovenia)","2019-11-04","day",null,"None","EUR",null,null,"Art. 5(1)(f), Art. 58(3), Art. 6, Art. 8","Consent, Data principles, Unlawful processing",null,"Other Outcome","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=977","https://gdprhub.eu/index.php?title=IP_-_0712-1/2019/2419",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2019/EE/001","AKI (Estonia) - 2.1.-1/19/126","gdprhub","Estonia","EE","AKI (Estonia)","2019-11-01","day",null,"None","EUR","Luminor Pank AS",null,"Art. 12(1), Art. 13(4), Art. 14(5)(a), Art. 15","Data subject rights, Transparency",null,"Rejected","https://www.aki.ee/sites/default/files/vaideotsused/2019/vaideotsus_13.11.2019_isiku_andmete_kaitse_asjas_nr_2.1.-3-19-3971_eraisik__0.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-1/19/126",null,"gdprhub",null,null,"luminor pank as",null,null,null,null,null,null,null,null,null],["2019/EE/002","AKI (Estonia) - 2.1.-3/19/3971","gdprhub","Estonia","EE","AKI (Estonia)","2019-11-01","day",null,"None","EUR",null,null,"Art. 15","Data subject rights",null,"Rejected","https://www.aki.ee/sites/default/files/vaideotsused/2019/vaideotsus_13.11.2019_isiku_andmete_kaitse_asjas_nr_2.1.-3-19-3971_eraisik__0.pdf","https://gdprhub.eu/index.php?title=AKI_%28Estonia%29_-_2.1.-3/19/3971",null,"gdprhub",null,"Financial service provider",null,null,null,null,null,null,null,null,null,null],["2019/GB/004","ICO - FER0851659","gdprhub","United Kingdom","GB","ICO (UK)","2019-11-01","day",null,"None","EUR","Canterbury City Council",null,"Art. 10, Art. 4(1), Art. 9","Special categories",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616232/fer0851659.pdf","https://gdprhub.eu/index.php?title=ICO_-_FER0851659",null,"gdprhub",null,null,"GB: canterbury city council",null,null,null,null,null,null,null,null,null],["2019/GB/003","ICO - FS50810710","gdprhub","United Kingdom","GB","ICO (UK)","2019-11-01","day",null,"None","EUR","Canterbury City Council",null,"Art. 4(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616245/fs50810710.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50810710",null,"gdprhub",null,null,"GB: canterbury city council",null,null,null,null,null,null,null,null,null],["2019/GB/006","ICO - FS50834927","gdprhub","United Kingdom","GB","ICO (UK)","2019-11-01","day",null,"None","EUR","Ministry of Defence",null,"Art. 4(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616251/fs50834927.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50834927",null,"gdprhub",null,null,"GB: ministry of defence",null,null,null,null,null,null,null,null,null],["2019/GB/007","ICO - FS50839431","gdprhub","United Kingdom","GB","ICO (UK)","2019-11-01","day",null,"None","EUR","University of Leicester",null,"Art. 4(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616248/fs50839431.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50839431",null,"gdprhub",null,null,"GB: university of leicester",null,null,null,null,null,null,null,null,null],["2019/DE/001","ETid-1031","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2019-11","month",5000,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2021/02/LfDI-BW_36_Ta%CC%88tigkeitsbericht_2020_WEB.pdf","https://www.enforcementtracker.com/ETid-1031",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/LV/001","ETid-120","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2019-11","month",150000,null,"EUR",null,null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://twitter.com/900sekundes/status/1199208013959172096","https://www.enforcementtracker.com/ETid-120",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/PL/001","ETid-512","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2019-11","month",1770,null,"EUR","L. Sp. z o.o.","Real Estate",null,"Data principles","Non-compliance with general data processing principles","Fine issued","http://orzeczenia.nsa.gov.pl/doc/942DE6198F","https://www.enforcementtracker.com/ETid-512",null,null,null,null,"l spzoo",null,null,null,null,null,null,null,null,null],["2019/ES/023","ETid-106","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-10-31","day",6000,null,"EUR","Jocker Premium Invex","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00291-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-106",null,null,null,null,"ES: jocker premium invex",null,null,null,null,null,null,null,null,null],["2019/NL/004","ETid-107","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2019-10-31","day",900000,null,"EUR","UWV (Dutch employee insurance service provider)","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/nl/nieuws/ap-dwingt-uwv-met-sanctie-gegevens-beter-te-beveiligen","https://www.enforcementtracker.com/ETid-107",null,null,null,null,"NL: uwv",null,null,null,null,null,null,null,null,null],["2019/NL/003","ETid-154","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2019-10-31","day",50000,null,"EUR","Menzis (Health Insurance Company)","Finance, Insurance and Consulting","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://autoriteitpersoonsgegevens.nl/nl/nieuws/sancties-voor-menzis-en-vgz-voor-overtreding-van-de-privacywet","https://www.enforcementtracker.com/ETid-154",null,null,null,null,"NL: menzis",null,null,null,null,null,null,null,null,null],["2019/IS/001","Persónuvernd- nr. 2019/232","gdprhub","Iceland","IS","Persónuvernd (Iceland)","2019-10-31","day",null,"None","EUR",null,null,"Art. 15, Art. 5(1)","Data principles, Data subject rights",null,"Rejected","https://www.personuvernd.is/urlausnir/midlun-opinberrar-stofnunar-a-personuupplysingum-i-tengslum-vid-radningu","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd-_nr._2019/232",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/023","BlnBDI (Berlin) - 711.412.1","gdprhub","Germany","DE","BlnBDI (Berlin)","2019-10-30","day",14500000,"14,500,000","EUR","Deutsche Wohnen SE",null,"Art. 25(1), Art. 5","Accountability, Data principles",null,"Violation found","https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191105-PM-Bussgeld_DW.pdf","https://gdprhub.eu/index.php?title=BlnBDI_%28Berlin%29_-_711.412.1",null,"gdprhub",null,null,"deutsche wohnen se",null,null,null,null,null,null,null,null,null],["2019/DE/017","ETid-99","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2019-10-30","day",null,null,"EUR","Deutsche Wohnen SE","Real Estate","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20191105-PM-Bussgeld_DW.pdf","https://www.enforcementtracker.com/ETid-99",null,null,null,null,"deutsche wohnen se",null,null,null,null,null,null,null,null,null],["2019/AT/001","ETid-96","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2019-10-29","day",13000000,null,"EUR","Austrian Post","Transportation and Energy","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://360.lexisnexis.at/d/entscheidungen-ris/bvwg_w258_2227269_1/u_verwaltung_BVwG_2024_BVWGT_20241227_W_7e8b9a258f","https://www.enforcementtracker.com/ETid-96",null,null,null,null,"AT: austrian post",null,null,null,null,null,null,null,null,null],["2019/BG/003","ETid-166","cms_tracker","Bulgaria","BG","Commission for Personal Data Protection (KZLD)","2019-10-28","day",511,null,"EUR","Employer","Employment","Art. 12(3), Art. 15(1)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cpdp.bg/index.php?p=element&aid=1219","https://www.enforcementtracker.com/ETid-166",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/GB/002","ICO - FS50819531","gdprhub","United Kingdom","GB","ICO (UK)","2019-10-28","day",null,"None","EUR","Pendle Borough Council",null,"Art. 4(1), Art. 5(1)(a), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2019/2616170/fs50819531.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50819531",null,"gdprhub",null,null,"GB: pendle borough council",null,null,null,null,null,null,null,null,null],["2019/MT/002","IDPC (Malta) - EDPBI:MT:OSS:D:2019:70","gdprhub","Malta","MT","IDPC (Malta)","2019-10-28","day",8000,"8000","EUR",null,null,"Art. 15","Data subject rights",null,"Violation found","https://edpb.europa.eu/sites/default/files/article-60-final-decisions/publishable_mt_2019-10_right_of_access_request_art._15_decisionpublic.pdf","https://gdprhub.eu/index.php?title=IDPC_%28Malta%29_-_EDPBI%3AMT%3AOSS%3AD%3A2019%3A70",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2019/ES/026","ETid-100","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-10-25","day",36000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00301-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-100",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2019/CY/003","ETid-179","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2019-10-25","day",70000,null,"EUR","LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd","Employment","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/ACDFDC478581BEE1C22584EE002EE9C2/$file/2019-apofasi%20bradford%20system%20%CE%91%CE%9D%CE%A9%CE%9D%CE%A5%CE%9C%CE%9F%CE%A0.pdf?openelement","https://www.enforcementtracker.com/ETid-179",null,null,null,null,"lgs handling ltd louis travel ltd and louis aviation ltd",null,null,null,null,null,null,null,null,null],["2019/CY/002","ETid-180","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2019-10-25","day",10000,null,"EUR","LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd","Employment","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/ACDFDC478581BEE1C22584EE002EE9C2/$file/2019-apofasi%20bradford%20system%20%CE%91%CE%9D%CE%A9%CE%9D%CE%A5%CE%9C%CE%9F%CE%A0.pdf?openelement","https://www.enforcementtracker.com/ETid-180",null,null,null,null,"lgs handling ltd louis travel ltd and louis aviation ltd",null,null,null,null,null,null,null,null,null],["2019/CY/001","ETid-181","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2019-10-25","day",2000,null,"EUR","LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd","Employment","Art. 6, Art. 9","Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/all/ACDFDC478581BEE1C22584EE002EE9C2/$file/2019-apofasi%20bradford%20system%20%CE%91%CE%9D%CE%A9%CE%9D%CE%A5%CE%9C%CE%9F%CE%A0.pdf?openelement","https://www.enforcementtracker.com/ETid-181",null,null,null,null,"lgs handling ltd louis travel ltd and louis aviation ltd",null,null,null,null,null,null,null,null,null],["2019/GR/007","HDPA (Greece) - 39/2019","gdprhub","Greece","GR","HDPA (Greece)","2019-10-25","day",null,"None","EUR","Ergasias S.A",null,"Art. 15, Art. 21","Data subject rights",null,"Rejected","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2019&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_39/2019",null,"gdprhub",null,null,"ergasias sa",null,null,null,null,null,null,null,null,null],["2019/HU/011","ETid-150","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-10-24","day",7400,null,"EUR","Military Hospital","Health Care","Art. 32, Art. 33","Data breach, Data security","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.naih.hu/files/NAIH-2019-2485-hatarozat.pdf","https://www.enforcementtracker.com/ETid-150",null,null,null,null,"HU: military hospital",null,null,null,null,null,null,null,null,null],["2019/DE/011","ETid-190","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2019-10-24","day",100000,null,"EUR","Food company","Accommodation and Hospitality","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2020/01/35.-T%C3%A4tigkeitsbericht-f%C3%BCr-den-Datenschutz-Web.pdf#page=44&zoom=100,0,0","https://www.enforcementtracker.com/ETid-190","https://gdprhub.eu/index.php?title=LfDI_%28Baden-W%C3%BCrttemberg%29_-_2019","gdprhub",null,null,"DE: food company",null,null,null,null,null,null,null,null,null],["2019/ES/032","AEPD (Spain) - TD/00185/2019","gdprhub","Spain","ES","AEPD (Spain)","2019-10-23","day",null,"None","EUR","Google LLC",null,"Art. 17, Art. 21","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/td-00185-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00185/2019",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2019/ES/002","ETid-153","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-10-23","day",60000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00249-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-153",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2019/GR/002","ETid-155","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2019-10-18","day",20000,null,"EUR","Wind Hellas Telecommunications","Media, Telecoms and Broadcasting","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentDisplay.jsp?docid=146,94,80,247,188,211,182,68","https://www.enforcementtracker.com/ETid-155","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_38/2019","gdprhub",null,null,"GR: wind hellas telecommunications",null,null,null,null,null,null,null,null,null],["2019/PL/003","ETid-97","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2019-10-18","day",9380,null,"EUR","Major of Aleksandrów Kujawski","Public Sector and Education","Art. 28","Processor obligations","Insufficient data processing agreement","Fine issued","https://uodo.gov.pl/decyzje/ZSPU.421.3.2019","https://www.enforcementtracker.com/ETid-97","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSPU.421.3.2019","gdprhub",null,null,"PL: major of aleksandrow kujawski",null,null,null,null,null,null,null,null,null],["2019/RO/018","ETid-66","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-10-17","day",2500,null,"EUR","UTTIS INDUSTRIES SRL","Employment","Art. 12, Art. 13, Art. 5(1)(c), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient fulfilment of information obligations","Fine issued","https://www.dataprotection.ro/?page=A_patra_amenda&lang=ro","https://www.enforcementtracker.com/ETid-66",null,null,null,null,"uttis industries srl",null,null,null,null,null,null,null,null,null],["2019/PL/002","ETid-102","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2019-10-16","day",47000,null,"EUR","ClickQuickNow","Industry and Commerce","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://uodo.gov.pl/decyzje/ZSPR.421.7.2019","https://www.enforcementtracker.com/ETid-102","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSPR.421.7.2019","gdprhub",null,null,"PL: clickquicknow",null,null,null,null,null,null,null,null,null],["2019/ES/028","ETid-93","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-10-16","day",60000,null,"EUR","Xfera Moviles S.A.","Media, Telecoms and Broadcasting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00262-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-93",null,null,null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["2019/ES/027","ETid-94","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-10-16","day",8000,null,"EUR","Iberdrola Clientes","Transportation and Energy","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.aepd.es/resoluciones/PS-00304-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-94",null,null,null,null,"ES: iberdrola clientes","Iberdrola",null,null,null,null,null,null,null,null],["2019/RO/023","ANSPDCP (Romania) - Vodaphone România S.A. 2","gdprhub","Romania","RO","ANSPDCP (Romania)","2019-10-15","day",2000,"2,000","EUR","Vodaphone Romania S.A",null,null,null,null,"Violation found","https://www.dataprotection.ro/index.jsp?page=O_noua_amenda_in_baza_Legii_506_/_2004_Vodafone&lang=en","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Vodaphone_Rom%C3%A2nia_S.A._2",null,"gdprhub",null,null,"vodaphone romania sa",null,null,null,null,null,null,null,null,null],["2019/HU/001","ETid-259","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-10-15","day",2860,null,"EUR",null,"Employment","Art. 13, Art. 24, Art. 25, Art. 5, Art. 6","Accountability, Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.naih.hu/files/NAIH-2019-769-hatarozat.pdf","https://www.enforcementtracker.com/ETid-259",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/CY/007","Commissioner (Cyprus) - patient data on Instagram","gdprhub","Cyprus","CY","Commissioner (Cyprus)","2019-10-11","day",14000,"14,000","EUR",null,null,"Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://in-cyprus.com/doctor-fined-e14000-for-revealing-personal-data-of-patient-on-instagram/","https://gdprhub.eu/index.php?title=Commissioner_%28Cyprus%29_-_patient_data_on_Instagram",null,"gdprhub",null,"Doctor",null,null,null,null,null,"person",null,null,null,null],["2019/NO/003","Datatilsynet (Norway) - 18/02579","gdprhub","Norway","NO","Datatilsynet (Norway)","2019-10-11","day",null,"1,200,000","NOK","Education Agency for Oslo municipality",null,"Art. 32(1)(b), Art. 32(1)(d), Art. 5(1)(f), Art. 5(2)","Data principles, Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/ae65e212c134455c93f36a10c5a8c792/vedtak-oslo-kommune-oktober2019.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_18/02579",null,"gdprhub",null,null,"NO: education agency for oslo municipality",null,1200000.0,119552,"day 2019-10-11|10.0375|NOK",null,null,null,null,null],["2019/AT/004","DSB (Austria) - D130.073/0008-DSB/2019","gdprhub","Austria","AT","DSB (Austria)","2019-10-09","day",null,"None","EUR",null,null,"Art. 32","Data security",null,"Violation found","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20191009_DSB_D130_073_0008_DSB_2019_00/DSBT_20191009_DSB_D130_073_0008_DSB_2019_00.html","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D130.073/0008-DSB/2019",null,"gdprhub",null,"Dating platform",null,null,null,null,null,null,null,null,null,null],["2019/RO/017","ETid-84","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-10-09","day",15000,null,"EUR","Raiffeisen Bank SA","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09_10_2019&lang=ro","https://www.enforcementtracker.com/ETid-84",null,null,null,null,"raiffeisen bank sa","Raiffeisen",null,null,null,null,null,null,null,null],["2019/RO/016","ETid-85","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-10-09","day",20000,null,"EUR","Vreau Credit SRL","Finance, Insurance and Consulting","Art. 32, Art. 33","Data breach, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Presa_09_10_2019&lang=ro","https://www.enforcementtracker.com/ETid-85",null,null,null,null,"vreau credit srl",null,null,null,null,null,null,null,null,null],["2019/BG/001","ETid-168","cms_tracker","Bulgaria","BG","Commission for Personal Data Protection (KZLD)","2019-10-08","day",5112,null,"EUR","The Ministry of Interior Affairs","Public Sector and Education","Art. 5(1), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/index.php?p=element&aid=1219","https://www.enforcementtracker.com/ETid-168",null,null,null,null,"BG: the ministry of interior affairs",null,null,null,null,null,null,null,null,null],["2019/CZ/003","ETid-2816","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-10-08","day",400,null,"EUR","Legal Person",null,"Art. 21(2)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/159-cj-uoou-0343419-10-dokument-c-159.pdf","https://www.enforcementtracker.com/ETid-2816",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/BG/002","ETid-167","cms_tracker","Bulgaria","BG","Commission for Personal Data Protection (KZLD)","2019-10-07","day",511,null,"EUR","B.D.","Health Care","Art. 31","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.cpdp.bg/index.php?p=element&aid=1219","https://www.enforcementtracker.com/ETid-167",null,null,null,null,"BG: bd",null,null,null,null,null,null,null,null,null],["2019/GR/004","ETid-82","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2019-10-07","day",200000,null,"EUR","Telecommunication Service Provider","Media, Telecoms and Broadcasting","Art. 25, Art. 5(1)(c)","Accountability, Data principles","Non-compliance with general data processing principles","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentSDisplay.jsp?docid=3,241,32,146,79,143,149,112","https://www.enforcementtracker.com/ETid-82",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/GR/003","ETid-83","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2019-10-07","day",200000,null,"EUR","Telecommunication Service Provider","Media, Telecoms and Broadcasting","Art. 21(3), Art. 25","Accountability, Data principles, Data subject rights","Non-compliance with general data processing principles","Fine issued","http://www.dpa.gr/APDPXPortlets/htdocs/documentSDisplay.jsp?docid=3,241,32,146,79,143,149,112","https://www.enforcementtracker.com/ETid-83",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/GR/006","HDPA (Greece) - 36/2019","gdprhub","Greece","GR","HDPA (Greece)","2019-10-07","day",null,"Reduced from 24,000 EUR to 22,000","EUR","Forthnet",null,null,null,null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33,15453&_dad=portal&_schema","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_36/2019",null,"gdprhub",null,null,"GR: forthnet",null,null,null,null,null,null,null,null,null],["2019/ES/045","AEPD (Spain) - EXP202103886","gdprhub","Spain","ES","AEPD (Spain)","2019-10-06","day",18000,"€18,000","EUR","Vueling Airlines S.A.",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00032-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202103886",null,"gdprhub",null,null,"vueling airlines sa",null,null,null,null,null,null,null,null,null],["2019/CZ/004","ETid-2815","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-10-04","day",2000,null,"EUR","Legal Person","Health Care","Art. 12(1), Art. 30, Art. 5(1)(a)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/162-cj-uoou-0360019-3-dokument-c-162.pdf","https://www.enforcementtracker.com/ETid-2815",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/RO/022","ANSDPCP (Romania) - Raiffeisen Bank S.A. and Vreau Credit S.R.L.","gdprhub","Romania","RO","ANSPDCP (Romania)","2019-10-01","day",170000,"170,000","EUR","Raiffeisen Bank S.A and Vreau Credit S.R.L.",null,"Art. 32(1), Art. 32(2), Art. 32(4)","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_09_10_2019&lang=en","https://gdprhub.eu/index.php?title=ANSDPCP_%28Romania%29_-_Raiffeisen_Bank_S.A._and_Vreau_Credit_S.R.L.",null,"gdprhub",null,null,"raiffeisen bank sa and vreau credit srl","Raiffeisen",null,null,null,null,null,null,null,null],["2019/ES/029","ETid-86","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-10-01","day",30000,null,"EUR","Vueling Airlines","Transportation and Energy","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00300-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-86",null,null,null,null,"ES: vueling airlines",null,null,null,null,null,null,null,null,null],["2019/HU/012","ETid-139","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-10","month",15100,null,"EUR","Town of Kerepes","Public Sector and Education","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2019-2076-hatarozat.pdf","https://www.enforcementtracker.com/ETid-139",null,null,null,null,"HU: town of kerepes",null,null,null,null,null,null,null,null,null],["2019/DE/024","LFDI - Hospital in Rhineland-Palatinate","gdprhub","Germany","DE","LFDI (Rhineland-Palatinate)","2019-09-30","day",105000,"105,000","EUR","Universitätsmedizin der Johannes-Gutenberg-Universität Mainz",null,"Art. 32, Art. 5","Data principles, Data security",null,"Violation found","https://gdprhub.eu/images/c/c4/LFDI_RLP_Bussgeldbescheid_8.03.66.pdf","https://gdprhub.eu/index.php?title=LFDI_-_Hospital_in_Rhineland-Palatinate",null,"gdprhub",null,null,"DE: universitatsmedizin der johannes gutenberg universitat mainz",null,null,null,null,null,null,null,null,null],["2019/RO/015","ETid-88","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-09-26","day",9000,null,"EUR","Inteligo Media SA","Media, Telecoms and Broadcasting","Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.ro/?page=Alta_sanctiune_RGPD&lang=ro","https://www.enforcementtracker.com/ETid-88",null,null,null,null,"inteligo media sa",null,null,null,null,null,null,null,null,null],["2019/DE/018","ETid-78","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2019-09-19","day",195407,null,"EUR","Delivery Hero","Accommodation and Hospitality","Art. 15, Art. 17, Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/pressemitteilungen/2019/20190919-PM-Bussgelder.pdf","https://www.enforcementtracker.com/ETid-78",null,null,null,null,"DE: delivery hero",null,null,null,null,null,null,null,null,null],["2019/BE/008","APD/GBA (Belgium) - 08/2019","gdprhub","Belgium","BE","APD/GBA (Belgium)","2019-09-17","day",null,"None","EUR",null,null,"Art. 12(3), Art. 12(4), Art. 13(2)(b), Art. 17, Art. 30(1)(d), Art. 30(1)(g)","Data subject rights, Transparency",null,"Violation found","https://www.autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-08-2019.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_08/2019",null,"gdprhub",null,"Recruiter",null,null,null,null,null,null,null,null,null,null],["2019/BE/005","ETid-80","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2019-09-17","day",10000,null,"EUR","Merchant","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.sudinfo.be/id141981/article/2019-09-19/un-commercant-recu-une-amende-de-10000-euros-pour-avoir-voulu-creer-une-carte-de","https://www.enforcementtracker.com/ETid-80","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_06/2019","gdprhub",null,null,"BE: merchant",null,null,null,null,null,null,null,null,null],["2019/PL/004","ETid-79","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2019-09-10","day",660000,null,"EUR","Morele.net","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://uodo.gov.pl/decyzje/ZSPR.421.2.2019","https://www.enforcementtracker.com/ETid-79","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSPR.421.2.2019","gdprhub",null,null,"PL: morele net",null,null,null,null,null,null,null,null,null],["2019/PT/007","CNPD (Portugal) - Deliberação 2019/494","gdprhub","Portugal","PT","CNPD (Portugal)","2019-09-03","day",null,null,null,null,null,null,null,null,null,"https://pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3118&tabela=leis&ficha=1","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2019/494",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2019/PT/008","CNPD (Portugal) - Deliberação 2019/495","gdprhub","Portugal","PT","CNPD (Portugal)","2019-09-03","day",null,null,null,null,null,"Art. 83(7)",null,null,null,"https://www.cnpd.pt/decisoes/historico-de-decisoes/?year=2019&type=2&ent","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2019/495",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["2019/BG/008","ETid-140","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2019-09-03","day",28100,null,"EUR","National Revenue Agency","Public Sector and Education","Art. 58(2)(e), Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/?p=element_view&aid=2226","https://www.enforcementtracker.com/ETid-140",null,null,null,null,"BG: national revenue agency",null,null,null,null,null,null,null,null,null],["2019/BG/007","ETid-162","cms_tracker","Bulgaria","BG","Commission for Personal Data Protection (KZLD)","2019-09-03","day",1022,null,"EUR","Telecommunication service provide","Media, Telecoms and Broadcasting","Art. 25(1), Art. 6(1)","Accountability, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/index.php?p=element&aid=1219","https://www.enforcementtracker.com/ETid-162",null,null,null,null,"BG: telecommunication service provide",null,null,null,null,null,null,null,null,null],["2019/BG/006","ETid-163","cms_tracker","Bulgaria","BG","Commission for Personal Data Protection (KZLD)","2019-09-03","day",5113,null,"EUR","Telecommunication service provide","Media, Telecoms and Broadcasting","Art. 25(1), Art. 6(1)","Accountability, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/index.php?p=element&aid=1219","https://www.enforcementtracker.com/ETid-163",null,null,null,null,"BG: telecommunication service provide",null,null,null,null,null,null,null,null,null],["2019/BG/005","ETid-164","cms_tracker","Bulgaria","BG","Commission for Personal Data Protection (KZLD)","2019-09-03","day",11760,null,"EUR","Commercial representative of telecommunication service provider","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/index.php?p=element&aid=1219","https://www.enforcementtracker.com/ETid-164",null,null,null,null,"BG: commercial representative of telecommunication service provider",null,null,null,null,null,null,null,null,null],["2019/BG/004","ETid-165","cms_tracker","Bulgaria","BG","Commission for Personal Data Protection (KZLD)","2019-09-03","day",1121,null,"EUR","Private enforcement agent","Industry and Commerce","Art. 12(4), Art. 15","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cpdp.bg/index.php?p=element&aid=1219","https://www.enforcementtracker.com/ETid-165",null,null,null,null,"BG: private enforcement agent",null,null,null,null,null,null,null,null,null],["2019/BG/010","ETid-71","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2019-08-28","day",2600000,null,"EUR","National Revenue Agency","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cpdp.bg/index.php?p=news_view&aid=1519","https://www.enforcementtracker.com/ETid-71",null,null,null,null,"BG: national revenue agency",null,null,null,null,null,null,null,null,null],["2019/BG/009","ETid-72","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2019-08-28","day",511000,null,"EUR","DSK Bank","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cpdp.bg/index.php?p=news_view&aid=1514","https://www.enforcementtracker.com/ETid-72",null,null,null,null,"BG: dsk bank",null,null,null,null,null,null,null,null,null],["2019/LV/002","ETid-73","cms_tracker","Latvia","LV","Data State Inspectorate (DSI)","2019-08-26","day",7000,null,"EUR","Online Services","Industry and Commerce","Art. 17","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dvi.gov.lv/lv/zinas/datu-valsts-inspekcija-piemero-7000-eiro-lielu-naudas-sodu-internetveikalam-par-personas-datu-apstrades-parkapumiem/","https://www.enforcementtracker.com/ETid-73",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/SE/002","ETid-67","cms_tracker","Sweden","SE","Data Protection Authority of Sweden","2019-08-20","day",18630,null,"EUR","School in Skellefteå","Public Sector and Education","Art. 35, Art. 36, Art. 5(1)(c), Art. 9","DPIA, Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.datainspektionen.se/globalassets/dokument/beslut/facial-recognition-used-to-monitor-the-attendance-of-students.pdf","https://www.enforcementtracker.com/ETid-67",null,null,null,null,"SE: school in skelleftea",null,null,null,null,null,null,null,null,null],["2019/ES/030","ETid-70","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-08-16","day",60000,null,"EUR","AVON COSMETICS","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00159-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-70",null,null,null,null,"ES: avon cosmetics",null,null,null,null,null,null,null,null,null],["2019/HU/002","ETid-258","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-08-08","day",1715,null,"EUR","Government Office Managing the Real Estate Register","Public Sector and Education","Art. 14, Art. 5","Data principles, Transparency","Non-compliance with general data processing principles","Fine issued","https://www.naih.hu/files/NAIH-2019-1590-hatarozat.pdf","https://www.enforcementtracker.com/ETid-258",null,null,null,null,"HU: government office managing the real estate register",null,null,null,null,null,null,null,null,null],["2019/DE/006","ETid-238","cms_tracker","Germany","DE","Data Protection Authority of Nordrhein-Westfalen","2019-08-05","day",200,null,"EUR","Private person (YouTube-Channel)","Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.youtube.com/watch?v=wFBrgJIkDwI","https://www.enforcementtracker.com/ETid-238",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/003","ETid-257","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-08-02","day",4290,null,"EUR","Public area maintenance company","Employment","Art. 13, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Non-compliance with general data processing principles","Fine issued","https://www.naih.hu/files/NAIH_2019_2466_hatarozat.pdf","https://www.enforcementtracker.com/ETid-257",null,null,null,null,"HU: public area maintenance company",null,null,null,null,null,null,null,null,null],["2019/AT/003","ETid-68","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2019-08","month",25000,null,"EUR","Company in the medical sector","Health Care","Art. 13, Art. 35, Art. 37","DPIA, Data protection officer, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dsb.gv.at/dam/jcr:784483fa-dafb-49bd-8a09-412bb15eb9f9/Newsletter_DSB_4_2019.pdf","https://www.enforcementtracker.com/ETid-68",null,null,null,null,"AT: company in the medical sector",null,null,null,null,null,null,null,null,null],["2019/NL/001","AP (The Netherlands) - AWB-20 2533/20 2938","gdprhub","Netherlands","NL","AP (The Netherlands)","2019-07-30","day",830000,"830000","EUR","Credit Registration Office (BKR)",null,"Art. 12(2), Art. 12(5), Art. 15","Data subject rights, Transparency",null,"Violation found","https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBGEL:2020:3159","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_AWB-20_2533/20_2938",null,"gdprhub",null,null,"NL: credit registration office",null,null,null,null,null,null,null,null,null],["2019/GR/005","ETid-65","cms_tracker","Greece","GR","Hellenic Data Protection Authority (HDPA)","2019-07-30","day",150000,null,"EUR","PWC Business Solutions","Employment","Art. 13(1)(c), Art. 14(1)(c), Art. 5(1), Art. 5(2), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dpa.gr/pls/portal/docs/PAGE/APDPX/ENGLISH_INDEX/DECISIONS/SUMMARY%20OF%20DECISION%2026_2019%20(EN).PDF","https://www.enforcementtracker.com/ETid-65",null,null,null,null,"GR: pwc business solutions",null,null,null,null,null,null,null,null,null],["2019/AT/006","DSB (Austria) - D123.921/0005-DSB/2019","gdprhub","Austria","AT","DSB (Austria)","2019-07-26","day",null,"None","EUR",null,null,"Art. 1(2), Art. 12(3), Art. 12(4), Art. 15, Art. 77(1)","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20190726_DSB_D123_921_0005_DSB_2019_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D123.921/0005-DSB/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/FR/002","ETid-64","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2019-07-25","day",180000,null,"EUR","ACTIVE ASSURANCES (car insurer)","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.legifrance.gouv.fr/affichCnil.do?id=CNILTEXT000038810992","https://www.enforcementtracker.com/ETid-64",null,null,null,null,"FR: active assurances",null,null,null,null,null,null,null,null,null],["2019/HU/004","ETid-256","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-07-17","day",8575,null,"EUR","Budapest Environs Regional Court","Public Sector and Education","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2019-2472_hatarozat.pdf","https://www.enforcementtracker.com/ETid-256",null,null,null,null,"HU: budapest environs regional court",null,null,null,null,null,null,null,null,null],["2019/RO/019","ETid-62","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-07-05","day",3000,null,"EUR","LEGAL COMPANY & TAX HUB SRL","Industry and Commerce","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=2019%20A%20treia%20amenda%20in%20aplicarea%20RGPD&lang=ro","https://www.enforcementtracker.com/ETid-62",null,null,null,null,"legal company and tax hub srl",null,null,null,null,null,null,null,null,null],["2019/RO/020","ETid-59","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-07-02","day",15000,null,"EUR","WORLD TRADE CENTER BUCHAREST SA","Accommodation and Hospitality","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/index.jsp?page=O_noua_amenda_GDPR&lang=ro","https://www.enforcementtracker.com/ETid-59",null,null,null,null,"world trade center bucharest sa",null,null,null,null,null,null,null,null,null],["2019/AT/002","ETid-69","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2019-07","month",11000,null,"EUR","Private person (soccer coach)","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.derstandard.at/story/2000107377808/fussballerinnen-nackt-gefilmt-mostviertler-trainer-muss-strafe-zahlen","https://www.enforcementtracker.com/ETid-69",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/RO/021","ETid-57","cms_tracker","Romania","RO","Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)","2019-06-27","day",130000,null,"EUR","UNICREDIT BANK SA","Finance, Insurance and Consulting","Art. 25(1), Art. 5(1)(c)","Accountability, Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.ro/?page=Comunicat_Amenda_Unicredit&lang=ro","https://www.enforcementtracker.com/ETid-57",null,null,null,null,"unicredit bank sa","UniCredit",null,null,null,null,null,null,null,null],["2019/HU/006","ETid-254","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-06-26","day",2850,null,"EUR",null,null,"Art. 17, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2019-2402_hatarozat.pdf","https://www.enforcementtracker.com/ETid-254",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/005","ETid-255","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-06-26","day",2850,null,"EUR","Financial Enterprise","Finance, Insurance and Consulting","Art. 21, Art. 5, Art. 6","Data principles, Data subject rights, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH_2019_1837_hatarozat.pdf","https://www.enforcementtracker.com/ETid-255",null,null,null,null,"HU: financial enterprise",null,null,null,null,null,null,null,null,null],["2019/HU/013","ETid-74","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-06-25","day",15150,null,"EUR",null,null,"Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.naih.hu/files/NAIH-2019-2471-hatarozat.pdf","https://www.enforcementtracker.com/ETid-74",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/NL/005","ETid-63","cms_tracker","Netherlands","NL","Dutch Supervisory Authority for Data Protection (AP)","2019-06-18","day",350000,null,"EUR","Haga Hospital","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://autoriteitpersoonsgegevens.nl/nl/nieuws/haga-beboet-voor-onvoldoende-interne-beveiliging-pati%C3%ABntendossiers","https://www.enforcementtracker.com/ETid-63",null,null,null,null,"NL: haga hospital",null,null,null,null,null,null,null,null,null],["2019/FR/003","ETid-51","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2019-06-13","day",20000,null,"EUR","Employer UNIONTRAD COMPANY","Employment","Art. 12, Art. 13, Art. 32, Art. 5(1)(c)","Data principles, Data security, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000038629823&fastReqId=946473298&fastPos=1","https://www.enforcementtracker.com/ETid-51",null,null,null,null,"FR: employer uniontrad company",null,null,null,null,null,null,null,null,null],["2019/CZ/001","ETid-2818","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-06-12","day",400,null,"EUR","Legal Person",null,"Art. 17(1)","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://uoou.gov.cz/media/poskytnute-informace/2024/2592024/138-cj-uoou-0203719-7-dokument-c-138.pdf","https://www.enforcementtracker.com/ETid-2818",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/ES/031","ETid-47","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019-06-11","day",250000,null,"EUR","Professional Football League (LaLiga)","Individuals and Private Associations","Art. 5(1)(a), Art. 7(3)","Consent, Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.eldiario.es/tecnologia/Agencia-Proteccion-Datos-Liga-microfono_0_908859408.html#click=https://t.co/RI3qZzucaB","https://www.enforcementtracker.com/ETid-47",null,null,null,null,"ES: professional football league",null,null,null,null,null,null,null,null,null],["2019/HU/007","ETid-253","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-06-03","day",2850,null,"EUR","Claim management company","Finance, Insurance and Consulting","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH_2019_1598_hatarozat.pdf","https://www.enforcementtracker.com/ETid-253",null,null,null,null,"HU: claim management company",null,null,null,null,null,null,null,null,null],["2019/HU/008","ETid-252","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-05-31","day",2000,null,"EUR","Local bank","Finance, Insurance and Consulting","Art. 15, Art. 18","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/files/NAIH_2019_1859_hatarozat.pdf","https://www.enforcementtracker.com/ETid-252",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/FR/004","ETid-24","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2019-05-28","day",400000,null,"EUR","SERGIC (Real Estate)","Real Estate","Art. 5(1)(e)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&id=CNILTEXT000038552658&fastReqId=119744754&fastPos=1","https://www.enforcementtracker.com/ETid-24","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2019-005","gdprhub",null,null,"FR: sergic",null,null,null,null,null,null,null,null,null],["2019/BE/006","ETid-5","cms_tracker","Belgium","BE","Belgian Data Protection Authority (APD)","2019-05-28","day",2000,null,"EUR","Mayor","Public Sector and Education","Art. 5(1)(b), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.autoriteprotectiondonnees.be/news/lautorite-de-protection-des-donnees-prononce-une-sanction-dans-le-cadre-dune-campagne","https://www.enforcementtracker.com/ETid-5",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/014","ETid-61","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-05-23","day",92146,null,"EUR","Organizer of SZIGET festival and VOLT festival","Media, Telecoms and Broadcasting","Art. 13, Art. 5(1)(b), Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.naih.hu/files/NAIH-2019-55_hatarozat.pdf","https://www.enforcementtracker.com/ETid-61",null,null,null,null,"HU: organizer of sziget festival and volt festival",null,null,null,null,null,null,null,null,null],["2019/HU/009","ETid-251","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-05-21","day",286,null,"EUR","Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest","Public Sector and Education","Art. 33","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://www.naih.hu/files/NAIH-2019-3854_hatarozat.pdf","https://www.enforcementtracker.com/ETid-251",null,null,null,null,"HU: directorate of social and child welfare institutions of the ferencvaros district of budapest",null,null,null,null,null,null,null,null,null],["2019/LT/001","ETid-40","cms_tracker","Lithuania","LT","Lithuanian Data Protection Authority (VDAI)","2019-05-16","day",61500,null,"EUR","Payment service provider UAB MisterTango","Finance, Insurance and Consulting","Art. 32, Art. 33, Art. 5","Data breach, Data principles, Data security","Insufficient fulfilment of data breach notification obligations","Fine issued","https://vdai.lrv.lt/uploads/vdai/documents/files/Mokejimo%20inciavimo%20paslaugos%20(privatusis)%202019(1).pdf","https://www.enforcementtracker.com/ETid-40",null,null,null,null,"payment service provider uab mistertango",null,null,null,null,null,null,null,null,null],["2019/DE/019","ETid-50","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2019-05-09","day",1400,null,"EUR","Police Officer","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-erstes-bussgeld-gegen-polizeibeamten/","https://www.enforcementtracker.com/ETid-50",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/PT/006","CNPD (Portugal) - Deliberação 2019/297","gdprhub","Portugal","PT","CNPD (Portugal)","2019-05-06","day",107000,"107.000","EUR","DECO PROTESTE Editores, Lda.",null,"Art. 28","Processor obligations",null,"Violation found","https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/121715","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2019/297",null,"gdprhub",null,null,"deco proteste editores lda",null,null,null,null,null,null,null,null,null],["2019/CZ/005","ETid-20","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-05-06","day",194,null,"EUR",null,null,"Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34472","https://www.enforcementtracker.com/ETid-20",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/NO/001","ETid-75","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2019-04-29","day",120000,null,"EUR","Oslo Municipal Education Department","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/contentassets/f7246f38ff394d32bef6895bc65a4b4f/varsel-om-gebyr---oslo-kommune.pdf","https://www.enforcementtracker.com/ETid-75",null,null,null,null,"NO: oslo municipal education department",null,null,null,null,null,null,null,null,null],["2019/PL/005","ETid-44","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2019-04-25","day",12950,null,"EUR","Sports association","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://uodo.gov.pl/pl/138/990","https://www.enforcementtracker.com/ETid-44",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/IT/003","ETid-39","cms_tracker","Italy","IT","Italian Data Protection Authority (Garante)","2019-04-17","day",50000,null,"EUR","Italian political party Movimento 5 Stelle","Public Sector and Education","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9101974","https://www.enforcementtracker.com/ETid-39",null,null,null,null,"IT: italian political party movimento 5 stelle",null,null,null,null,null,null,null,null,null],["2019/HU/016","ETid-52","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-04-17","day",9400,null,"EUR",null,null,"Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","http://www.naih.hu/files/NAIH-2019-167-hatarozat.pdf","https://www.enforcementtracker.com/ETid-52",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/022","ETid-27","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2019-04-12","day",80000,null,"EUR","Company in the financial sector","Finance, Insurance and Consulting","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2019/07/PM-Datenschutzverletzungen-bereiten-zunehmend-Sorge-30.07.2019.pdf","https://www.enforcementtracker.com/ETid-27",null,null,null,null,"DE: company in the financial sector",null,null,null,null,null,null,null,null,null],["2019/BG/012","ETid-54","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2019-04-08","day",510,null,"EUR","Medical centers","Health Care","Art. 5(1)(a), Art. 6(1), Art. 9(1), Art. 9(2)","Data principles, Special categories, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/?p=element_view&aid=2192","https://www.enforcementtracker.com/ETid-54",null,null,null,null,"BG: medical centers",null,null,null,null,null,null,null,null,null],["2019/HU/017","ETid-38","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-04-05","day",34375,null,"EUR","Hungarian political party","Public Sector and Education","Art. 33(1), Art. 33(5), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","http://www.cms-lawnow.com/ealerts/2019/04/hungarian-data-authority-investigates-two-cases-of-privacy-breaches?cc_lang=en","https://www.enforcementtracker.com/ETid-38",null,null,null,null,"HU: hungarian political party",null,null,null,null,null,null,null,null,null],["2019/HU/015","ETid-53","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-04-05","day",1900,null,"EUR",null,null,"Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","http://www.naih.hu/files/NAIH_2019_133_hatarozat.pdf","https://www.enforcementtracker.com/ETid-53",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/PL/006","ETid-43","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)","2019-03-26","day",220000,null,"EUR","Private company working with data from publicly available sources",null,"Art. 14","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://uodo.gov.pl/en/553/1009","https://www.enforcementtracker.com/ETid-43","https://gdprhub.eu/index.php?title=UODO_%28Poland%29_-_ZSPR.421.3.2018","gdprhub",null,null,"PL: private company working with data from publicly available sources",null,null,null,null,null,null,null,null,null],["2019/BG/011","ETid-55","cms_tracker","Bulgaria","BG","Data Protection Commision of Bulgaria (KZLD)","2019-03-26","day",5100,null,"EUR","A.P. EOOD","Employment","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/?p=element_view&aid=2191","https://www.enforcementtracker.com/ETid-55",null,null,null,null,"ap eood",null,null,null,null,null,null,null,null,null],["2019/PT/005","CNPD (Portugal) - Deliberação 2019/222","gdprhub","Portugal","PT","CNPD (Portugal)","2019-03-25","day",2000,"2000","EUR",null,null,"Art. 13(1), Art. 13(2)","Transparency",null,"Violation found","https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/121677","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2019/222",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/PT/002","ETid-77","cms_tracker","Portugal","PT","Portuguese Data Protection Authority (CNPD)","2019-03-25","day",2000,null,"EUR",null,null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.cnpd.pt/bin/decisoes/Delib/DEL_2019_222.pdf","https://www.enforcementtracker.com/ETid-77",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/CZ/006","ETid-18","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-03-21","day",10000,null,"EUR",null,null,"Art. 5(1)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34470","https://www.enforcementtracker.com/ETid-18",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/PT/001","ETid-108","cms_tracker","Portugal","PT","Portuguese Data Protection Authority (CNPD)","2019-03-19","day",2000,null,"EUR",null,null,"Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.cnpd.pt/bin/decisoes/Delib/DEL_2019_207.pdf","https://www.enforcementtracker.com/ETid-108",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/NO/004","Datatilsynet (Norway) - 18/02140","gdprhub","Norway","NO","Datatilsynet (Norway)","2019-03-18","day",null,"1,600,000","NOK","Bergen municipality",null,"Art. 32(1)(a), Art. 32(1)(b), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.datatilsynet.no/contentassets/67033efe6b8a48d7aa679be2c8fd436d/18-02140-13-vedtak-om-overtredelsesgebyr---melding-om-avvik-hos-bergen-kommune-253778_15_1.pdf","https://gdprhub.eu/index.php?title=Datatilsynet_%28Norway%29_-_18/02140",null,"gdprhub",null,null,"NO: bergen municipality",null,1600000.0,165426,"day 2019-03-18|9.6720|NOK",null,null,null,null,null],["2019/HU/018","ETid-37","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-03-04","day",3200,null,"EUR","Unnamed financial institution","Finance, Insurance and Consulting","Art. 13(3), Art. 17(1), Art. 5(1)(b), Art. 5(1)(c), Art. 6(4)","Data principles, Data subject rights, Transparency, Unlawful processing","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/files/NAIH-2019-2526-2-H-hatarozat.pdf","https://www.enforcementtracker.com/ETid-37",null,null,null,null,"HU: unnamed financial institution",null,null,null,null,null,null,null,null,null],["2019/DE/020","ETid-32","cms_tracker","Germany","DE","Data Protection Authority of Berlin","2019-03","month",50000,null,"EUR","N26","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/berlin/695-tb-lfd-berlin-2018-ohne-drs-nr-vom-28-03-2019/file","https://www.enforcementtracker.com/ETid-32",null,null,null,null,"DE: n26",null,null,null,null,null,null,null,null,null],["2019/NO/002","ETid-42","cms_tracker","Norway","NO","Norwegian Supervisory Authority (Datatilsynet)","2019-03","month",170000,null,"EUR","Bergen Municipality","Public Sector and Education","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.datatilsynet.no/en/about-privacy/reports-on-specific-subjects/administrative-fine-of-170.000--imposed-on-bergen-municipality/","https://www.enforcementtracker.com/ETid-42",null,null,null,null,"NO: bergen municipality",null,null,null,null,null,null,null,null,null],["2019/CZ/009","ETid-14","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-02-28","day",582,null,"EUR",null,null,"Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34466","https://www.enforcementtracker.com/ETid-14",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/019","ETid-36","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-02-28","day",3200,null,"EUR","Mayor's Office of the city of Kecdkemét","Public Sector and Education","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.naih.hu/files/NAIH-2019-596-hatarozat.pdf","https://www.enforcementtracker.com/ETid-36",null,null,null,null,"HU: mayor s office of the city of kecdkemet",null,null,null,null,null,null,null,null,null],["2019/CZ/007","ETid-17","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-02-26","day",776,null,"EUR",null,null,"Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34469","https://www.enforcementtracker.com/ETid-17",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/BG/015","ETid-7","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2019-02-26","day",27100,null,"EUR","Telecommunication service provider","Media, Telecoms and Broadcasting","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/?p=element_view&aid=2180","https://www.enforcementtracker.com/ETid-7",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/BG/013","ETid-9","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2019-02-22","day",500,null,"EUR","Employer","Employment","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cpdp.bg/?p=element_view&aid=2177","https://www.enforcementtracker.com/ETid-9",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/HU/020","ETid-34","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-02-20","day",1560,null,"EUR","Debt collector","Finance, Insurance and Consulting","Art. 5(1)(a), Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","http://www.cms-lawnow.com/ealerts/2019/03/hungary-fines-two-companies-for-gdpr-infringement?cc_lang=en","https://www.enforcementtracker.com/ETid-34",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/MT/001","ETid-41","cms_tracker","Malta","MT","Data Protection Commissioner of Malta","2019-02-18","day",5000,null,"EUR","Lands Authority","Public Sector and Education","Art. 32, Art. 5","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.gvzh.com.mt/malta-news/idpc-fines-lands-authority-data-breach/","https://www.enforcementtracker.com/ETid-41",null,null,null,null,"MT: lands authority",null,null,null,null,null,null,null,null,null],["2019/HU/021","ETid-33","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2019-02-08","day",1560,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","http://www.cms-lawnow.com/ealerts/2019/03/hungary-fines-two-companies-for-gdpr-infringement?cc_lang=en","https://www.enforcementtracker.com/ETid-33",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/021","ETid-28","cms_tracker","Germany","DE","Data Protection Authority of Sachsen-Anhalt","2019-02-05","day",2500,null,"EUR",null,"Individuals and Private Associations","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2020/01/35.-T%C3%A4tigkeitsbericht-f%C3%BCr-den-Datenschutz-Web.pdf#page=44&zoom=100,0,0","https://www.enforcementtracker.com/ETid-28",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2019/PT/003","ETid-76","cms_tracker","Portugal","PT","Portuguese Data Protection Authority (CNPD)","2019-02-05","day",20000,null,"EUR",null,null,"Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.cnpd.pt/bin/decisoes/Delib/DEL_2019_21.pdf","https://www.enforcementtracker.com/ETid-76","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2019/21","gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2019/CZ/010","ETid-13","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-02-04","day",1165,null,"EUR","Car renting company","Industry and Commerce","Art. 5(1)(a)","Data principles, Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34465","https://www.enforcementtracker.com/ETid-13",null,null,null,null,"CZ: car renting company",null,null,null,null,null,null,null,null,null],["2019/CZ/008","ETid-15","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-02-04","day",1165,null,"EUR","Credit brokerage","Finance, Insurance and Consulting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34467","https://www.enforcementtracker.com/ETid-15",null,null,null,null,"CZ: credit brokerage",null,null,null,null,null,null,null,null,null],["2019/GB/008","ICO (UK) - Leave.EU and Eldon Insurance","gdprhub","United Kingdom","GB","ICO (UK)","2019-02-01","day",null,"120000","GBP","Leave.EU Group Limited",null,null,null,null,"Violation found","https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/02/ico-to-audit-data-protection-practices-at-leaveeu-and-eldon-insurance-after-fining-both-companies-for-unlawful-marketing-messages/#","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Leave.EU_and_Eldon_Insurance",null,"gdprhub",null,null,"leave eu group ltd",null,120000.0,136537,"day 2019-02-01|0.8789|GBP",null,null,null,null,null],["2019/FR/005","ETid-23","cms_tracker","France","FR","French Data Protection Authority (CNIL)","2019-01-21","day",50000000,null,"EUR","Google LLC","Media, Telecoms and Broadcasting","Art. 13, Art. 14, Art. 5, Art. 6","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc","https://www.enforcementtracker.com/ETid-23","https://gdprhub.eu/index.php?title=CNIL_%28France%29_-_SAN-2019-001","gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["2019/BG/014","ETid-8","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2019-01-17","day",500,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.cpdp.bg/?p=element&aid=1195","https://www.enforcementtracker.com/ETid-8",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/CZ/011","ETid-12","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2019-01-10","day",388,null,"EUR","Employer","Employment","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34464","https://www.enforcementtracker.com/ETid-12",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/CY/006","ETid-10","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2019","year",5000,null,"EUR","State Hospital","Health Care","Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.agplaw.com/cyprus-gdpr-commissioner-fines-newspaper-and-hospital/","https://www.enforcementtracker.com/ETid-10",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/016","ETid-101","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2019","year",80000,null,"EUR",null,"Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/wp-content/uploads/2019/07/PM-Datenschutzverletzungen-bereiten-zunehmend-Sorge-30.07.2019.pdf","https://www.enforcementtracker.com/ETid-101",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/CY/005","ETid-11","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2019","year",10000,null,"EUR","Newspaper","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.agplaw.com/cyprus-gdpr-commissioner-fines-newspaper-and-hospital/","https://www.enforcementtracker.com/ETid-11",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/ES/017","ETid-130","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",21000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6(1)","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00087-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-130",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2019/ES/016","ETid-131","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",36000,null,"EUR","VODAFONE ONO, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(f)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00092-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-131",null,null,null,null,"vodafone ono sau","Vodafone",null,null,null,null,null,null,null,null],["2019/ES/015","ETid-132","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",48000,null,"EUR","VODAFONE ONO, S.A.U.","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/resoluciones/PS-00212-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-132",null,null,null,null,"vodafone ono sau","Vodafone",null,null,null,null,null,null,null,null],["2019/ES/014","ETid-133","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",48000,null,"EUR","TELEFONICA MOVILES ESPAÑA, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(a)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00173-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-133",null,null,null,null,"telefonica moviles espana sau","Telefonica",null,null,null,null,null,null,null,null],["2019/ES/013","ETid-134","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",30000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/resoluciones/PS-00205-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-134",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2019/ES/012","ETid-135","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",40000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00064-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-135",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["2019/ES/011","ETid-136","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",20000,null,"EUR","Employer","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00150-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-136",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/ES/010","ETid-137","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",9000,null,"EUR","Employer","Employment","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00050-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-137",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/ES/009","ETid-138","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)","2019","year",3600,null,"EUR","AMADOR RECREATIVOS, S.L","Industry and Commerce","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00135-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-138",null,null,null,null,"amador recreativos sl",null,null,null,null,null,null,null,null,null],["2019/DE/013","ETid-143","cms_tracker","Germany","DE","Data Protection Authority of Mecklenburg-Vorpommern","2019","year",800,null,"EUR","Police Officer","Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.faz.net/aktuell/gesellschaft/kriminalitaet/polizisten-nutzten-daten-um-minderjaehrige-maedchen-zu-kontaktieren-16227841.html","https://www.enforcementtracker.com/ETid-143",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/012","ETid-170","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2019","year",294000,null,"EUR",null,"Employment","Art. 5","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.handelsblatt.com/politik/deutschland/dsgvo-datenschutz-verstoesse-zahl-der-bussgelder-ist-drastisch-gestiegen/25364576.html?ticket=ST-45092061-7c0aydLKNr5gZlxMtwwK-ap1","https://www.enforcementtracker.com/ETid-170",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/010","ETid-203","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2019","year",51000,null,"EUR","Facebook Germany GmbH","Media, Telecoms and Broadcasting","Art. 37","Data protection officer","Insufficient involvement of data protection officer","Fine issued","https://datenschutz-hamburg.de/assets/pdf/28._Taetigkeitsbericht_Datenschutz_2019_HmbBfDI.pdf","https://www.enforcementtracker.com/ETid-203",null,null,null,null,"facebook germany gmbh","Meta",null,null,null,null,null,null,null,null],["2019/DE/009","ETid-204","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2019","year",20000,null,"EUR","Hamburger Verkehrsverbund GmbH (HVV GmbH)","Transportation and Energy","Art. 33, Art. 34","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://datenschutz-hamburg.de/assets/pdf/28._Taetigkeitsbericht_Datenschutz_2019_HmbBfDI.pdf","https://www.enforcementtracker.com/ETid-204",null,null,null,null,"hamburger verkehrsverbund gmbh",null,null,null,null,null,null,null,null,null],["2019/DE/008","ETid-205","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2019","year",null,null,"EUR","Hamburger Volksbank eG","Finance, Insurance and Consulting","Art. 21","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://datenschutz-hamburg.de/assets/pdf/28._Taetigkeitsbericht_Datenschutz_2019_HmbBfDI.pdf","https://www.enforcementtracker.com/ETid-205",null,null,null,null,"DE: hamburger volksbank eg",null,null,null,null,null,null,null,null,null],["2019/DK/001","ETid-21","cms_tracker","Denmark","DK","Danish Data Protection Authority (Datatilsynet)","2019","year",160000,null,"EUR","Taxa 4x35","Transportation and Energy","Art. 5(1)(e)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2019/mar/datatilsynet-indstiller-taxaselskab-til-boede-paa-1-2-mio-kr/","https://www.enforcementtracker.com/ETid-21",null,null,null,null,"DK: taxa 4x35",null,null,null,null,null,null,null,null,null],["2019/DE/007","ETid-236","cms_tracker","Germany","DE","Data Protection Authority of Saarland","2019","year",2000,null,"EUR","Restaurant","Accommodation and Hospitality","Art. 5(1)(c)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.datenschutz.saarland.de/fileadmin/user_upload/uds/tberichte/tb28_2019.pdf","https://www.enforcementtracker.com/ETid-236",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/005","ETid-271","cms_tracker","Germany","DE","Data Protection Authority of Brandenburg","2019","year",50000,null,"EUR",null,null,"Art. 15, Art. 28","Data subject rights, Processor obligations","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/brandenburg/landesdatenschutzbeauftragte/726-21-tb-lfd-brandenburg-2019-o-drs-nr-vom-24-03-2020/file","https://www.enforcementtracker.com/ETid-271",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/CY/004","ETid-87","cms_tracker","Cyprus","CY","Cypriot Data Protection Commissioner","2019","year",14000,null,"EUR","Doctor","Health Care","Art. 5, Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://cyprus-mail.com/2019/10/11/doctor-fined-e14000-for-violating-patient-data-on-instagram/","https://www.enforcementtracker.com/ETid-87",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/004","ETid-941","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2019","year",500,null,"EUR",null,null,"Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/750-20-tb-lfd-sachsen-2019-o-drs-nr-vom-22-12-2020/file","https://www.enforcementtracker.com/ETid-941",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/003","ETid-942","cms_tracker","Germany","DE","Data Protection Authority of Saxony","2019","year",50800,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/sachsen/landesdatenschutzbeauftragter-6/750-20-tb-lfd-sachsen-2019-o-drs-nr-vom-22-12-2020/file","https://www.enforcementtracker.com/ETid-942",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2019/DE/002","ETid-943","cms_tracker","Germany","DE","Data Protection Authority of Niedersachsen","2019","year",3501000,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.zaftda.de/tb-bundeslaender/niedersachsen/748-25-tb-lfd-niedersachen-2019-o-drs-nr-vom-03-09-2020/file","https://www.enforcementtracker.com/ETid-943",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/AT/001","ETid-4","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2018-12-20","day",2200,null,"EUR",null,"Individuals and Private Associations","Art. 13, Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20181220_DSB_D550_037_0003_DSB_2018_00/DSBT_20181220_DSB_D550_037_0003_DSB_2018_00.pdf","https://www.enforcementtracker.com/ETid-4",null,null,null,"Private person",null,null,null,null,null,"person",null,null,null,null],["2018/HU/001","ETid-35","cms_tracker","Hungary","HU","Hungarian National Authority for Data Protection and the Freedom of Information (NAIH)","2018-12-18","day",3200,null,"EUR",null,null,"Art. 12(4), Art. 13, Art. 15, Art. 18(1)(c)","Data subject rights, Transparency","Insufficient fulfilment of data subjects rights","Fine issued","https://www.naih.hu/files/NAIH-2018-5559-H-hatarozat.pdf","https://www.enforcementtracker.com/ETid-35",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/DE/003","ETid-26","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2018-12-17","day",5000,null,"EUR","Kolibri Image Regina und Dirk Maass GbR","Industry and Commerce","Art. 28(3)","Processor obligations","Insufficient data processing agreement","Fine issued","https://www.heise.de/newsticker/meldung/DSGVO-5000-Euro-Bussgeld-fuer-fehlenden-Auftragsverarbeitungsvertrag-4282737.html","https://www.enforcementtracker.com/ETid-26",null,null,null,null,"DE: kolibri image regina und dirk maass gbr",null,null,null,null,null,null,null,null,null],["2018/AT/004","ETid-1","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2018-12-09","day",4800,null,"EUR","Betting place","Industry and Commerce","Art. 13","Transparency","Insufficient fulfilment of information obligations","Fine issued","https://www.dsb.gv.at/documents/22758/116802/Straferkenntnis+DSB-D550.038+0003-DSB+2018.pdf/fb0bb313-8651-44ac-a713-c286d83e3f19","https://www.enforcementtracker.com/ETid-1",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/BG/001","ETid-6","cms_tracker","Bulgaria","BG","Bulgarian Commission for Personal Data Protection (KZLD)","2018-12-04","day",500,null,"EUR","Bank","Finance, Insurance and Consulting","Art. 5(1)(b), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://gdprtoolkit.eu/first-gdpr-fine-in-bulgaria/","https://www.enforcementtracker.com/ETid-6",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/DE/004","ETid-25","cms_tracker","Germany","DE","Data Protection Authority of Baden-Wuerttemberg","2018-11-21","day",20000,null,"EUR","Knuddels.de","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/","https://www.enforcementtracker.com/ETid-25","https://gdprhub.eu/index.php?title=LfDI_%28Baden-W%C3%BCrttemberg%29_-_O_1018/115","gdprhub",null,null,"DE: knuddels de",null,null,null,null,null,null,null,null,null],["2018/CZ/001","ETid-16","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)","2018-10-25","day",388,null,"EUR",null,null,"Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=34468","https://www.enforcementtracker.com/ETid-16",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/PT/002","CNPD (Portugal) - Deliberação 2018/984","gdprhub","Portugal","PT","CNPD (Portugal)","2018-10-09","day",400000,"400000","EUR","Centro Hospitalar Barreiro Montijo, EPE",null,"Art. 32(1)(b), Art. 32(1)(d), Art. 5(1)(c), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.cnpd.pt/home/decisoes/Delib/20_984_2018.pdf","https://gdprhub.eu/index.php?title=CNPD_%28Portugal%29_-_Delibera%C3%A7%C3%A3o_2018/984",null,"gdprhub",null,null,"centro hospitalar barreiro montijo epe",null,null,null,null,null,null,null,null,null],["2018/AT/002","ETid-3","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2018-09-27","day",300,null,"EUR","Private car owner","Individuals and Private Associations","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20180927_DSB_D550_084_0002_DSB_2018_00/DSBT_20180927_DSB_D550_084_0002_DSB_2018_00.pdf","https://www.enforcementtracker.com/ETid-3",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/AT/006","DSB (Austria) - D550.038/0003-DSB/2018","gdprhub","Austria","AT","DSB (Austria)","2018-09-18","day",5280,"5280","EUR",null,null,"Art. 5(1)(a), Art. 5(1)(c), Art. 6(1)(f)","Data principles, Unlawful processing",null,"Violation found","https://www.ris.bka.gv.at/Dokumente/Erv/ERV_1999_1_165/ERV_1999_1_165.html","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D550.038/0003-DSB/2018",null,"gdprhub",null,"Betting store",null,null,null,null,null,null,null,null,null,null],["2018/NL/001","AP (The Netherlands) - z2018-02009","gdprhub","Netherlands","NL","AP (The Netherlands)","2018-07-31","day",null,null,null,"UWV",null,"Art. 32","Data security",null,"Violation found","https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/last_onder_dwangsom_uwv_werkgeversportaal.pdf","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_z2018-02009",null,"gdprhub",null,null,"NL: uwv",null,null,null,null,null,null,null,null,null],["2018/PT/001","ETid-45","cms_tracker","Portugal","PT","Portuguese Data Protection Authority (CNPD)","2018-07-17","day",400000,null,"EUR","Public Hospital","Health Care","Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.cnpd.pt/bin/decisoes/Delib/20_984_2018.pdf","https://www.enforcementtracker.com/ETid-45",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/AT/005","DSB (Austria) - D122.844/0006-DSB/2018","gdprhub","Austria","AT","DSB (Austria)","2018-05-21","day",null,"None","EUR",null,null,"Art. 12(5), Art. 15, Art. 99","Data subject rights, Transparency",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20180621_DSB_D122_844_0006_DSB_2018_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D122.844/0006-DSB/2018",null,"gdprhub",null,"Bank",null,null,null,null,null,null,null,null,null,null],["2018/AT/007","DSB (Austria) - D122.970/0004-DSB/2019","gdprhub","Austria","AT","DSB (Austria)","2018-05-21","day",null,"None","EUR",null,null,"Art. 17","Data subject rights",null,"Violation found","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20191108_DSB_D122_970_0004_DSB_2019_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_D122.970/0004-DSB/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["2018/AT/003","ETid-2","cms_tracker","Austria","AT","Austrian Data Protection Authority (dsb)","2018","year",1800,null,"EUR","Kebab restaurant","Accommodation and Hospitality","Art. 13, Art. 14, Art. 5","Data principles, Transparency, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dsb.gv.at/documents/22758/115212/Newsletter_DSB_1_2020.pdf/a640bbb8-9297-4230-86e4-163bc9ccb844","https://www.enforcementtracker.com/ETid-2",null,null,null,null,"AT: kebab restaurant",null,null,null,null,null,null,null,null,null],["2018/DE/002","ETid-29","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2018","year",20000,null,"EUR",null,null,"Art. 33(1), Art. 34(1)","Data breach","Insufficient fulfilment of data breach notification obligations","Fine issued","https://datenschutz-hamburg.de/assets/pdf/27._Taetigkeitsbericht_Datenschutz_2018_HmbBfDI.pdf","https://www.enforcementtracker.com/ETid-29",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["2018/DE/001","ETid-31","cms_tracker","Germany","DE","Data Protection Authority of Hamburg","2018","year",500,null,"EUR",null,null,null,null,"Unknown","Fine issued","https://www.pingdigital.de/blog/2019/03/29/implodierende-aufsichtsbehoerden/1626","https://www.enforcementtracker.com/ETid-31",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/030","AEPD (Spain) - E/00038/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR",null,null,"Art. 5(1)(c)","Data principles",null,"Rejected","https://www.aepd.es/es/documento/e-00038-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/00038/2021",null,"gdprhub",null,"Individual",null,null,null,null,null,"person",null,null,null,null],["ND/ES/002","AEPD (Spain) - E/00378/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Google LLC (Google Spain, S.L.)",null,"Art. 17","Data subject rights",null,"No further action","https://www.aepd.es/es/documento/e-00378-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/00378/2020",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["ND/ES/029","AEPD (Spain) - E/00647/2019 - CO/00198/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","FACEBOOK IRELAND LIMITED",null,"Art. 4(16), Art. 4(22), Art. 4(23), Art. 60(8), Art. 80(2)",null,null,"Rejected","https://www.aepd.es/es/documento/co-00198-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/00647/2019_-_CO/00198/2020",null,"gdprhub",null,null,"meta platforms ireland ltd","Meta",null,null,null,null,null,null,null,null],["ND/ES/028","AEPD (Spain) - E/00739/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","UNIVERSIDAD MIGUEL HERNÁNDEZ DE ELCHE(UMH)",null,"Art. 12(5), Art. 13, Art. 15","Data subject rights, Transparency",null,"Rejected","https://www.aepd.es/es/documento/e-00739-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/00739/2021",null,"gdprhub",null,null,"ES: universidad miguel hernandez de elche",null,null,null,null,null,null,null,null,null],["ND/ES/026","AEPD (Spain) - E/02666/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","AYUNTAMIENTO DE FUENLABRADA",null,"Art. 14, Art. 35","DPIA, Transparency",null,"Rejected","https://www.aepd.es/es/documento/e-02666-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/02666/2020",null,"gdprhub",null,null,"ES: ayuntamiento de fuenlabrada",null,null,null,null,null,null,null,null,null],["ND/ES/027","AEPD (Spain) - E/03276/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","ALDANITI INTERNATIONAL NETWORK, LTD",null,"Art. 6(1)(a)","Unlawful processing",null,"Other Outcome","https://www.aepd.es/es/documento/e-03276-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/03276/2021",null,"gdprhub",null,null,"aldaniti international network ltd",null,null,null,null,null,null,null,null,null],["ND/ES/047","AEPD (Spain) - E/03783/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Secretaría de Estado de Seguridad del Ministerio del Interior",null,"Art. 2",null,null,"Violation found","https://www.aepd.es/es/documento/e-03783-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/03783/2020",null,"gdprhub",null,null,"ES: secretaria de estado de seguridad del ministerio del interior",null,null,null,null,null,null,null,null,null],["ND/ES/050","AEPD (Spain) - E/03882/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","El Corte Inglés",null,"Art. 4(1), Art. 4(15), Art. 4(2), Art. 6, Art. 6(1)(c), Art. 9, Art. 9(2)(h)","Special categories, Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/e-03882-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/03882/2020",null,"gdprhub",null,null,"ES: el corte ingles",null,null,null,null,null,null,null,null,null],["ND/ES/049","AEPD (Spain) - E/03884/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","METRO BILBAO, S.A.",null,"Art. 2(1), Art. 4(1), Art. 4(6)",null,null,"Violation found","https://www.aepd.es/es/documento/e-03884-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/03884/2020",null,"gdprhub",null,null,"metro bilbao sa",null,null,null,null,null,null,null,null,null],["ND/ES/001","AEPD (Spain) - E/06179/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Telefónica",null,"Art. 32, Art. 33, Art. 34","Data breach, Data security",null,"No further action","https://www.aepd.es/es/documento/e-06179-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/06179/2019",null,"gdprhub",null,null,"ES: telefonica","Telefonica",null,null,null,null,null,null,null,null],["ND/ES/043","AEPD (Spain) - E/07796/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","REAL MADRID CLUB DE FUTBOL",null,"Art. 32(1)","Data security",null,"Violation found","https://www.aepd.es/es/documento/e-07796-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/07796/2020",null,"gdprhub",null,null,"ES: real madrid club de futbol",null,null,null,null,null,null,null,null,null],["ND/ES/048","AEPD (Spain) - E/09208/2018","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Niantic, Inc.",null,"Art. 32, Art. 6","Data security, Unlawful processing",null,"Rejected","https://www.aepd.es/es/documento/e-09208-2018.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_E/09208/2018",null,"gdprhub",null,null,"niantic inc",null,null,null,null,null,null,null,null,null],["ND/ES/054","AEPD (Spain) - EXP202100300","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR",null,null,"Art. 16","Data subject rights",null,"Rejected","https://www.aepd.es/es/documento/td-00245-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202100300",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/055","AEPD (Spain) - EXP202101314","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","AD735 DATA MEDIA ADVERTISING S.L",null,"Art. 15, Art. 31","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/td-00246-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202101314",null,"gdprhub",null,null,"ad735 data media advertising sl",null,null,null,null,null,null,null,null,null],["ND/ES/086","AEPD (Spain) - EXP202206776","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,null,null,null,null,null,null,null,"Rejected","https://www.aepd.es/documento/ps-00430-2022.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202206776",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/085","AEPD (Spain) - EXP202208230","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",96000,"96000","EUR","FOURTH PARTY LOGISTICS, S.L.",null,"Art. 28(2), Art. 28(3)","Processor obligations",null,"Other Outcome","https://www.aepd.es/es/documento/ps-00243-2023.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_EXP202208230",null,"gdprhub",null,null,"fourth party logistics sl",null,null,null,null,null,null,null,null,null],["ND/ES/087","AEPD (Spain) - PS-00201-2025","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",1050000,"1.050.000","EUR","Vodafone España, S.A.U",null,"Art. 32, Art. 6(1)(a), Art. 6(1)(f)","Data security, Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00201-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00201-2025",null,"gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["ND/ES/103","AEPD (Spain) - PS-00240-2025","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",750000,"750000.0","EUR","Vodafone España, S.A.U.",null,"Art. 28, Art. 32, Art. 5(1)(f)","Data principles, Data security, Processor obligations",null,"Violation found","https://www.aepd.es/documento/ps-00240-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00240-2025",null,"gdprhub",null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["ND/ES/088","AEPD (Spain) - PS-00304-2024","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",20000,"20000.0","EUR","El León de El Español Publicaciones, S.A.",null,"Art. 25, Art. 5(1)(c), Art. 5(2), Art. 58(2)(d)","Accountability, Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00304-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00304-2024",null,"gdprhub",null,null,"el leon de el espanol publicaciones sa",null,null,null,null,null,null,null,null,null],["ND/ES/091","AEPD (Spain) - PS-00506-2026","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,null,null,"Ajuntament de Canals",null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00506-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS-00506-2026",null,"gdprhub",null,null,"ES: ajuntament de canals",null,null,null,null,null,null,null,null,null],["ND/ES/084","AEPD (Spain) - PS/00003/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",300000,"300000","EUR","PageGroup Europe",null,"Art. 12(2), Art. 12(3), Art. 12(6), Art. 25, Art. 32, Art. 4(16), Art. 5(1)(c), Art. 56(1)","Accountability, Data principles, Data security, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00003-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00003/2021",null,"gdprhub",null,null,"ES: pagegroup europe",null,null,null,null,null,null,null,null,null],["ND/ES/007","AEPD (Spain) - PS/00005/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"n/a","EUR","Sound Soul, S.L.",null,"Art. 5(1)(c)","Data principles",null,"Rejected","https://www.aepd.es/es/documento/ps-00005-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00005/2020",null,"gdprhub",null,null,"sound soul sl",null,null,null,null,null,null,null,null,null],["ND/ES/038","AEPD (Spain) - PS/00024/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",5000,"5000","EUR","ABANCA CORPORACIÓN BANCARIA, S.A.",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00024-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00024/2021",null,"gdprhub",null,null,"abanca corporacion bancaria sa",null,null,null,null,null,null,null,null,null],["ND/ES/009","AEPD (Spain) - PS/00027/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Ministry for Internal affairs",null,"Art. 5(1)(b), Art. 83(5)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00027-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00027/2019",null,"gdprhub",null,null,"ES: ministry for internal affairs",null,null,null,null,null,null,null,null,null],["ND/ES/036","AEPD (Spain) - PS/00048/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","ASOCIACIÓN DETRABAJADORES PENITENCIARIOS TU ABANDONO ME PUEDE MATAR",null,"Art. 5, Art. 6","Data principles, Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00048-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00048/2021",null,"gdprhub",null,null,"ES: asociacion detrabajadores penitenciarios tu abandono me puede matar",null,null,null,null,null,null,null,null,null],["ND/ES/042","AEPD (Spain) - PS/00064/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","AYUNTAMIENTO DE EL ESPINAR",null,"Art. 32(1), Art. 5(1)(f)","Data principles, Data security",null,"Violation found","https://www.aepd.es/es/documento/ps-00064-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00064/2021",null,"gdprhub",null,null,"ES: ayuntamiento de el espinar",null,null,null,null,null,null,null,null,null],["ND/ES/045","AEPD (Spain) - PS/00076/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","CLÍNICA VIVANTA S.L",null,"Art. 6(1)","Unlawful processing",null,"Rejected","https://www.aepd.es/es/documento/ps-00076-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00076/2021",null,"gdprhub",null,null,"clinica vivanta sl",null,null,null,null,null,null,null,null,null],["ND/ES/005","AEPD (Spain) - PS/00098/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"none","EUR","DIRECCIÓN GENERAL DE LA GUARDIA CIVI",null,"Art. 13","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00098-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00098/2019",null,"gdprhub",null,null,"ES: direccion general de la guardia civi",null,null,null,null,null,null,null,null,null],["ND/ES/037","AEPD (Spain) - PS/00126/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",3000,"3000","EUR","FURNISHYOURSPACE SL",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00126-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00126/2020",null,"gdprhub",null,null,"furnishyourspace sl",null,null,null,null,null,null,null,null,null],["ND/ES/039","AEPD (Spain) - PS/00127/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA UNIPERSONAL",null,"Art. 13","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00127-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00127/2020",null,"gdprhub",null,null,"iberia lineas aereas de espana sa operadora unipersonal",null,null,null,null,null,null,null,null,null],["ND/ES/035","AEPD (Spain) - PS/00172/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","POSADA LAS ANIMAS VIGO SPAIN, S.L.",null,"Art. 6(1), Art. 7","Consent, Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00172-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00172/2020",null,"gdprhub",null,null,"posada las animas vigo spain sl",null,null,null,null,null,null,null,null,null],["ND/ES/011","AEPD (Spain) - PS/00180/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",1600,"1600","EUR","Bodegas Dinastía, S.L.",null,"Art. 13","Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00180-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00180/2020",null,"gdprhub",null,null,"bodegas dinastia sl",null,null,null,null,null,null,null,null,null],["ND/ES/034","AEPD (Spain) - PS/00190/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR",null,null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00190-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00190/2020",null,"gdprhub",null,"Home Owners' Association",null,null,null,null,null,null,null,null,null,null],["ND/ES/004","AEPD (Spain) - PS/00198/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"n/a","N/A",null,null,"Art. 5(1), Art. 83(5)","Data principles",null,"n/a","https://www.aepd.es/es/documento/ps-00198-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00198/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/089","AEPD (Spain) - PS/00249/2025","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",10000,"10000.0","EUR","MÁS SOL ENERGÍA 15, S.L.",null,"Art. 14, Art. 4(11), Art. 5(2), Art. 7","Consent, Data principles, Transparency",null,"Violation found","https://www.aepd.es/documento/ps-00249-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00249/2025",null,"gdprhub",null,null,"mas sol energia 15 sl",null,null,null,null,null,null,null,null,null],["ND/ES/074","AEPD (Spain) - PS/00255/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",15000,"15.000","EUR","Telefónica de España, S.A.U.",null,null,null,null,"Violation found","https://www.aepd.es/es/documento/ps-00255-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00255/2021",null,"gdprhub",null,null,"telefonica de espana sau","Telefonica",null,null,null,null,null,null,null,null],["ND/ES/075","AEPD (Spain) - PS/00276/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","WW E-SERVICES IBERIA, S.L.U. (\"WESTWING\")",null,"Art. 6(1)(b)","Unlawful processing",null,"Rejected","https://www.aepd.es/es/documento/ps-00276-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00276/2021",null,"gdprhub",null,null,"ww e services iberia slu",null,null,null,null,null,null,null,null,null],["ND/ES/059","AEPD (Spain) - PS/00285/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","FEDERACIÓN DE BALONMANO DEL PRINCIPADO DEASTURIAS",null,"Art. 13, Art. 37","Data protection officer, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00285-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00285/2020",null,"gdprhub",null,null,"ES: federacion de balonmano del principado deasturias",null,null,null,null,null,null,null,null,null],["ND/ES/025","AEPD (Spain) - PS/00299/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",30000,"30.000","EUR","Twitter International Company (Twitter Spain, S.L.)",null,"Art. 13, Art. 7","Consent, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00299-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00299/2019",null,"gdprhub",null,null,"ES: twitter international company","X (Twitter)",null,null,null,null,null,null,null,null],["ND/ES/069","AEPD (Spain) - PS/00308/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",50000,"50000","EUR","ORANGE ESPAGNE, S.A.U.",null,"Art. 6","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00308-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00308/2021",null,"gdprhub",null,null,"orange espagne sau","Orange",null,null,null,null,null,null,null,null],["ND/ES/073","AEPD (Spain) - PS/00314/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","AYUNTAMIENTO DE MOLINA DE SEGURA",null,"Art. 37, Art. 83(4)(a)","Data protection officer",null,"Violation found","https://www.aepd.es/es/documento/ps-00314-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00314/2021",null,"gdprhub",null,null,"ES: ayuntamiento de molina de segura",null,null,null,null,null,null,null,null,null],["ND/ES/060","AEPD (Spain) - PS/00329/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","AYUNTAMIENTO DE BURGOS",null,"Art. 37","Data protection officer",null,"Violation found","https://www.aepd.es/es/documento/ps-00329-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00329/2020",null,"gdprhub",null,null,"ES: ayuntamiento de burgos",null,null,null,null,null,null,null,null,null],["ND/ES/065","AEPD (Spain) - PS/00334/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR",null,null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00334-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00334/2020",null,"gdprhub",null,"Former employee of a business",null,null,null,null,null,"person",null,null,null,null],["ND/ES/012","AEPD (Spain) - PS/00337/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"n/a","EUR","Partido Socialista Obrero Español",null,"Art. 21(1)","Data subject rights",null,"Rejected","https://www.aepd.es/es/documento/ps-00337-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00337/2019",null,"gdprhub",null,null,"ES: partido socialista obrero espanol",null,null,null,null,null,null,null,null,null],["ND/ES/104","AEPD (Spain) - PS/00339/2024","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",100000,"100000.0","EUR","REAL FEDERACIÓN ESPAÑOLA DE FÚTBOL",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00339-2024.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00339/2024",null,"gdprhub",null,null,"ES: real federacion espanola de futbol",null,null,null,null,null,null,null,null,null],["ND/ES/023","AEPD (Spain) - PS/00340/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Regionalist Party of Aragon (PAR)",null,"Art. 21(1), Art. 58(2), Art. 6(1)(e), Art. 6(1)(f), Art. 83(5)","Data subject rights, Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00340-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00340/2019",null,"gdprhub",null,null,"ES: regionalist party of aragon",null,null,null,null,null,null,null,null,null],["ND/ES/015","AEPD (Spain) - PS/00341/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Socialist Party of Catalonia (PSC-PSOE)",null,"Art. 21","Data subject rights",null,"Violation found","https://www.aepd.es/es/documento/ps-00341-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00341/2019",null,"gdprhub",null,null,"ES: socialist party of catalonia",null,null,null,null,null,null,null,null,null],["ND/ES/067","AEPD (Spain) - PS/00347/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","AYUNTAMIENTO DE EL ESCORIAL",null,"Art. 5(1)(c), Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00347-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00347/2020",null,"gdprhub",null,null,"ES: ayuntamiento de el escorial",null,null,null,null,null,null,null,null,null],["ND/ES/019","AEPD (Spain) - PS/00367/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",2500,"2.500","EUR","VOX",null,"Art. 5(1)(f), Art. 58(2), Art. 83(5)(a)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00367-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00367/2019",null,"gdprhub",null,null,"ES: vox",null,null,null,null,null,null,null,null,null],["ND/ES/071","AEPD (Spain) - PS/00377/2021","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Municipality of [Redacted Location]",null,"Art. 13, Art. 5(1)(c)","Data principles, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00377-2021.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00377/2021",null,"gdprhub",null,null,"ES: municipality of redacted location",null,null,null,null,null,null,null,null,null],["ND/ES/062","AEPD (Spain) - PS/00388/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",3000,"3000","EUR","FLEXOGRÁFICA DEL MEDITERRÁNEO, S.L.",null,"Art. 13, Art. 7","Consent, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00388-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00388/2020",null,"gdprhub",null,null,"flexografica del mediterraneo sl",null,null,null,null,null,null,null,null,null],["ND/ES/016","AEPD (Spain) - PS/00406/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",2500,"2.500","EUR",null,null,"Art. 5(1)(f), Art. 83(5)(a)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00406-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00406/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/064","AEPD (Spain) - PS/00408/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR",null,null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/es/documento/ps-00408-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00408/2020",null,"gdprhub",null,"Minor",null,null,null,null,null,"person",null,null,null,null],["ND/ES/017","AEPD (Spain) - PS/00439/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,null,null,null,null,"Art. 5(1)(c), Art. 83(5)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/td-00318-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00439/2019",null,"gdprhub",null,"City council",null,null,null,null,null,null,null,null,null,null],["ND/ES/024","AEPD (Spain) - PS/00454/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"0","EUR",null,null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.aepd.es/es/documento/ps-00454-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00454/2019",null,"gdprhub",null,"Private individual",null,null,null,null,null,"person",null,null,null,null],["ND/ES/083","AEPD (Spain) - PS/00480/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","sacramental y penitencial cofradía de nuestro padre jesús sacramentado y maría santísima de la piedad, amparo de los leoneses",null,"Art. 13, Art. 32, Art. 5(1)(f)","Data principles, Data security, Transparency",null,"Violation found","https://www.aepd.es/es/documento/ps-00480-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_PS/00480/2020",null,"gdprhub",null,null,"ES: sacramental y penitencial cofradia de nuestro padre jesus sacramentado y maria santisima de la piedad amparo de los leoneses",null,null,null,null,null,null,null,null,null],["ND/ES/079","AEPD (Spain) - TD/00248/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","CONSEJERÍA DE EDUCACIÓN",null,"Art. 12, Art. 13, Art. 15","Data subject rights, Transparency",null,"Rejected","https://www.aepd.es/es/documento/td-00248-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00248/2020",null,"gdprhub",null,null,"ES: consejeria de educacion",null,null,null,null,null,null,null,null,null],["ND/ES/078","AEPD (Spain) - TD/00261/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","Asturias Healthcare System",null,"Art. 12, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/es/documento/td-00261-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00261/2020",null,"gdprhub",null,null,"ES: asturias healthcare system",null,null,null,null,null,null,null,null,null],["ND/ES/080","AEPD (Spain) - TD/00263/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR",null,null,"Art. 13, Art. 15","Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/es/documento/td-00263-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00263/2020",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/081","AEPD (Spain) - TD/00277/2020","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,"None","EUR","GOOGLE LLC",null,"Art. 17","Data subject rights",null,"Rejected","https://www.aepd.es/es/documento/td-00277-2020.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00277/2020",null,"gdprhub",null,null,"IT: google","Google (Alphabet)",null,null,null,null,null,null,null,null],["ND/ES/013","AEPD (Spain) - TD/00306/2019","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,null,null,"PEPEMOBILE. S.L.",null,"Art. 17","Data subject rights",null,"No further action","https://www.aepd.es/es/documento/td-00306-2019.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_TD/00306/2019",null,"gdprhub",null,null,"pepemobile sl",null,null,null,null,null,null,null,null,null],["ND/ES/094","AEPD (Spain) - pd-00055-2026","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,null,null,"Ministerio de Defensa",null,"Art. 12, Art. 15, Art. 24, Art. 25, Art. 5(1)(a), Art. 5(2)","Accountability, Data principles, Data subject rights, Transparency",null,"Violation found","https://www.aepd.es/documento/pd-00055-2026.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_pd-00055-2026",null,"gdprhub",null,null,"ES: ministerio de defensa",null,null,null,null,null,null,null,null,null],["ND/ES/090","AEPD (Spain) - ps-00148-2025","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",200000,"200000.0","EUR","XFERA MÓVILES, S.A.U.",null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00148-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_ps-00148-2025",null,"gdprhub",null,null,"xfera moviles sa",null,null,null,null,null,null,null,null,null],["ND/ES/092","AEPD (Spain) - ps-00256-2025","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",2000,"2000.0","EUR",null,null,"Art. 6(1)","Unlawful processing",null,"Violation found","https://www.aepd.es/documento/ps-00256-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_ps-00256-2025",null,"gdprhub",null,"Notary",null,null,null,null,null,"person",null,null,null,null],["ND/ES/105","AEPD (Spain) - ps-00287-2025","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",null,null,null,"Dirección General de Tráfico (DGT)",null,"Art. 5(1)(c)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00287-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_ps-00287-2025",null,"gdprhub",null,null,"ES: direccion general de trafico",null,null,null,null,null,null,null,null,null],["ND/ES/093","AEPD (Spain) - ps-0035-2025","gdprhub","Spain","ES","AEPD (Spain)",null,"unknown",160,"160.0","EUR",null,null,"Art. 5(1)(f)","Data principles",null,"Violation found","https://www.aepd.es/documento/ps-00035-2025.pdf","https://gdprhub.eu/index.php?title=AEPD_%28Spain%29_-_ps-0035-2025",null,"gdprhub",null,"Landlord",null,null,null,null,null,"person",null,null,null,null],["ND/RO/001","ANSPDCP (Romania) - Fine against Proleasing Motors SRL","gdprhub","Romania","RO","ANSPDCP (Romania)",null,"unknown",15000,"15000","EUR","Proleasing Motors SRL",null,"Art. 32(1), Art. 32(2), Art. 58(2)(d)","Data security",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_09_07_20&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Proleasing_Motors_SRL",null,"gdprhub",null,null,"proleasing motors srl",null,null,null,null,null,null,null,null,null],["ND/RO/014","ANSPDCP (Romania) - Fine against Societatea Civilă Medicală Policlinica Tommed","gdprhub","Romania","RO","ANSPDCP (Romania)",null,"unknown",2000,"2000","EUR","Societatea Civilă Medicală Policlinica Tommed",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(f), Art. 5(2), Art. 9","Data principles, Special categories",null,"Violation found","https://www.dataprotection.ro/?page=Comunicat_Presa_06_12_2021_1&lang=ro","https://gdprhub.eu/index.php?title=ANSPDCP_%28Romania%29_-_Fine_against_Societatea_Civil%C4%83_Medical%C4%83_Policlinica_Tommed",null,"gdprhub",null,null,"RO: societatea civila medicala policlinica tommed",null,null,null,null,null,null,null,null,null],["ND/NL/001","AP (The Netherlands) - 30.04.2020","gdprhub","Netherlands","NL","AP (The Netherlands)",null,"unknown",725000,"725,000","EUR",null,null,"Art. 9(2)(a), Art. 9(2)(b)","Special categories",null,"Violation found","https://autoriteitpersoonsgegevens.nl/nl/nieuws/boete-voor-bedrijf-voor-verwerken-vingerafdrukken-werknemers","https://gdprhub.eu/index.php?title=AP_%28The_Netherlands%29_-_30.04.2020",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["ND/BE/002","APD/GBA (Belgium) - 05/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)",null,"unknown",25000,"25000","EUR","Cellphone number provider",null,"Art. 24, Art. 32, Art. 33, Art. 34(1), Art. 5(1)(f), Art. 5(2)","Accountability, Data breach, Data principles, Data security",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-05-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_05/2021",null,"gdprhub",null,null,"BE: cellphone number provider",null,null,null,null,null,null,null,null,null],["ND/BE/003","APD/GBA (Belgium) - 07/2021","gdprhub","Belgium","BE","APD/GBA (Belgium)",null,"unknown",null,"None","EUR",null,null,"Art. 15(1), Art. 32, Art. 33, Art. 5(1), Art. 6(1)","Data breach, Data principles, Data security, Data subject rights, Unlawful processing",null,"Violation found","https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-07-2021.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_07/2021",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/BE/001","APD/GBA (Belgium) - 13/2019","gdprhub","Belgium","BE","APD/GBA (Belgium)",null,"unknown",2000,"2000","EUR",null,null,"Art. 12, Art. 15, Art. 17","Data subject rights, Transparency",null,"Violation found","https://autoriteprotectiondonnees.be/publications/decision-quant-au-fond-n-13-2019.pdf","https://gdprhub.eu/index.php?title=APD/GBA_%28Belgium%29_-_13/2019",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/095","APDCAT (Catalonia) - PS-01092025","gdprhub","Spain","ES","APDCAT (Catalonia)",null,"unknown",3150,"3150.0","EUR",null,null,"Art. 12, Art. 15, Art. 5(1)(a), Art. 6","Data principles, Data subject rights, Transparency, Unlawful processing",null,"Violation found","https://seu.apdcat.cat","https://gdprhub.eu/index.php?title=APDCAT_%28Catalonia%29_-_PS-01092025",null,"gdprhub",null,"Public-sector group",null,null,null,null,null,null,null,null,null,null],["ND/HR/002","AZOP (Croatia) - Decision 05-07-2021","gdprhub","Croatia","HR","AZOP (Croatia)",null,"unknown",null,"None","EUR",null,null,"Art. 32(1)(b), Art. 32(1)(d), Art. 32(2)","Data security",null,"Violation found","https://azop.hr/izdane-nove-upravne-novcane-kazne-5-7-2021/","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_05-07-2021",null,"gdprhub",null,"IT company",null,null,null,null,null,null,null,null,null,null],["ND/HR/001","AZOP (Croatia) - Decision 11-08-2020","gdprhub","Croatia","HR","AZOP (Croatia)",null,"unknown",null,"None","EUR","Raiffeisen Bank",null,"Art. 15(3)","Data subject rights",null,"Violation found","https://novac.jutarnji.hr/aktualno/azop-odlucio-da-raiffeisen-krsi-gdpr-ovi-se-ne-slazu-nastavljamo-poslovati-kao-dosad/10448236/","https://gdprhub.eu/index.php?title=AZOP_%28Croatia%29_-_Decision_11-08-2020",null,"gdprhub",null,null,"HR: raiffeisen bank","Raiffeisen",null,null,null,null,null,null,null,null],["ND/AT/001","DSB (Austria) - 2025-0.861.933","gdprhub","Austria","AT","DSB (Austria)",null,"unknown",null,null,null,"N. GmbH",null,"Art. 2, Art. 3, Art. 4(1), Art. 4(2), Art. 5(1)(b), Art. 5(1)(f), Art. 57(4)","Data principles",null,"Rejected","https://ogd.ris.bka.gv.at/JudikaturEntscheidung.wxe?Abfrage=Dsk&Dokumentnummer=DSBT_20251028_2025_0_861_933_00","https://gdprhub.eu/index.php?title=DSB_%28Austria%29_-_2025-0.861.933",null,"gdprhub",null,null,"n gmbh",null,null,null,null,null,null,null,null,null],["ND/DK/004","Datatilsynet (Denmark) - 2019-421-0028","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,"None","EUR","Udbetaling Danmark",null,"Art. 12(3), Art. 15(1)(h), Art. 22(1)","Data subject rights, Transparency",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/feb/tilsyn-med-udbetaling-danmarks-behandling-af-personoplysninger/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-421-0028",null,"gdprhub",null,null,"DK: udbetaling danmark",null,null,null,null,null,null,null,null,null],["ND/DK/003","Datatilsynet (Denmark) - 2019-431-0036","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,null,null,"KMD A/S",null,"Art. 32","Data security",null,"Reprimand","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/feb/manglende-sikkerhed-omkring-en-udviklingsserver/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-431-0036",null,"gdprhub",null,null,"kmd as",null,null,null,null,null,null,null,null,null],["ND/DK/007","Datatilsynet (Denmark) - 2019-431-0048","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,"None","EUR","JH Schultz Information A / S",null,"Art. 28(1), Art. 28(3)(f), Art. 32","Data security, Processor obligations",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/sep/sikkerhedshul-i-schultz-expose","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-431-0048",null,"gdprhub",null,null,"jh schultz information as",null,null,null,null,null,null,null,null,null],["ND/DK/009","Datatilsynet (Denmark) - 2019-431-0052","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,"None","EUR","Epic Booking",null,"Art. 13(1), Art. 13(2), Art. 4(11), Art. 5(1)(e), Art. 6(1)(a)","Data principles, Transparency, Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2021/mar/epic-bookings-behandling-af-personoplysninger","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-431-0052",null,"gdprhub",null,null,"DK: epic booking",null,null,null,null,null,null,null,null,null],["ND/DK/002","Datatilsynet (Denmark) - 2019-441-1578","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,null,null,"nemlig.com A/S",null,"Art. 34","Data breach",null,"Order","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2019/dec/brud-paa-persondatasikkerheden-hos-nemligcom-as/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-441-1578",null,"gdprhub",null,null,"nemlig com as",null,null,null,null,null,null,null,null,null],["ND/DK/001","Datatilsynet (Denmark) - 2019-441-1581","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,null,null,"Intervare A/S",null,"Art. 34","Data breach",null,"Order","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2019/dec/brud-paa-persondatasikkerheden-hos-intervare-as/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-441-1581",null,"gdprhub",null,null,"intervare as",null,null,null,null,null,null,null,null,null],["ND/DK/005","Datatilsynet (Denmark) - 2019-812-0035","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,"None","EUR","Danish Prison and Probation Service",null,"Art. 15","Data subject rights",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/maj/kriminalforsorgens-haandtering-af-anmodning-om-indsigt/","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2019-812-0035",null,"gdprhub",null,null,"DK: danish prison and probation service",null,null,null,null,null,null,null,null,null],["ND/DK/008","Datatilsynet (Denmark) - 2020-31-3354","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,"None","EUR","DGU Erhverv A / S",null,"Art. 4(11), Art. 6(1)(a)","Unlawful processing",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-31-3354",null,"gdprhub",null,null,"dgu erhverv as",null,null,null,null,null,null,null,null,null],["ND/DK/011","Datatilsynet (Denmark) - 2020-31-4326","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,"None","EUR","jo:ga ApS",null,"Art. 32(1)","Data security",null,"Violation found","https://www.datatilsynet.dk/afgoerelser/afgoerelser/2021/okt/kritik-af-%5bjoga%5d-aps-manglende-behandlingssikkerhed-","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-31-4326",null,"gdprhub",null,null,"jo ga aps",null,null,null,null,null,null,null,null,null],["ND/DK/010","Datatilsynet (Denmark) - 2020-432-0037","gdprhub","Denmark","DK","Datatilsynet (Denmark)",null,"unknown",null,"None","EUR","Familieretshuset",null,"Art. 28(3), Art. 32(1), Art. 33","Data breach, Data security, Processor obligations",null,"Violation found","https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2021/mar/anmeldelser-om-brud-paa-persondatasikkerheden","https://gdprhub.eu/index.php?title=Datatilsynet_%28Denmark%29_-_2020-432-0037",null,"gdprhub",null,null,"DK: familieretshuset",null,null,null,null,null,null,null,null,null],["ND/XX/001","EDPB - Endorsement 1/2018","gdprhub",null,null,null,null,"unknown",null,null,null,null,null,null,null,null,null,null,"https://gdprhub.eu/index.php?title=EDPB_-_Endorsement_1/2018",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/097","ETid-104","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)",null,"unknown",12000,null,"EUR","Madrileña Red de Gas","Transportation and Energy","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.aepd.es/resoluciones/PS-00188-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-104",null,null,null,null,"madrilena red de gas sau",null,null,null,null,null,null,null,null,null],["ND/SK/001","ETid-109","cms_tracker","Slovakia","SK","Slovak Data Protection Office",null,"unknown",50000,null,"EUR","Social Insurance Agency","Health Care","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.etrend.sk/ekonomika/socialna-poistovna-porusila-gdpr-pokutu-50-tisic-eur-nechce-zaplatit.html","https://www.enforcementtracker.com/ETid-109",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/CZ/003","ETid-111","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)",null,"unknown",588,null,"EUR","Alza.cz a.s.","Industry and Commerce","Art. 6, Art. 7","Consent, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-po-odvolani-souhlasu-spolecnost-alza-cz-a-s/ds-5717/archiv=0&p1=5653","https://www.enforcementtracker.com/ETid-111",null,null,null,null,"alza cz as",null,null,null,null,null,null,null,null,null],["ND/CZ/002","ETid-112","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)",null,"unknown",980,null,"EUR",null,"Individuals and Private Associations","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.uoou.cz/kontrola-zabezpeceni-osobnich-udaju-pri-provozovani-online-hry-fyzicka-osoba-podnikajici/ds-5723/archiv=0&p1=5653","https://www.enforcementtracker.com/ETid-112",null,null,null,"Individual entrepreneur",null,null,null,null,null,null,null,null,null,null],["ND/ES/096","ETid-121","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)",null,"unknown",10000,null,"EUR","Ikea Ibérica","Industry and Commerce","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00127-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-121",null,null,null,null,"ES: ikea iberica",null,null,null,null,null,null,null,null,null],["ND/PL/001","ETid-1570","cms_tracker","Poland","PL","Polish National Personal Data Protection Office (UODO)",null,"unknown",960,null,"EUR",null,null,"Art. 58","Cooperation with the DPA","Insufficient cooperation with supervisory authority","Fine issued","https://www.uodo.gov.pl/pl/138/2593","https://www.enforcementtracker.com/ETid-1570",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/HR/003","ETid-1679","cms_tracker","Croatia","HR","Croatian Data Protection Authority (azop)",null,"unknown",20000,null,"EUR","Telecommunications company","Media, Telecoms and Broadcasting","Art. 5(1)(d), Art. 6(1)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://azop.hr/izrecena-upravna-novcana-kazna-zbog-nezakonite-obrade-osobnih-podataka/","https://www.enforcementtracker.com/ETid-1679",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/CZ/004","ETid-19","cms_tracker","Czech Republic","CZ","Czech Data Protection Auhtority (UOOU)",null,"unknown",3140,null,"EUR","UniCredit Bank Czech Republic and Slovakia, a.s.","Finance, Insurance and Consulting","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.uoou.cz/kontrola-zpracovani-osobnich-udaju-bankou-unicredit-bank-czech-republic-and-slovakia-a-s/ds-5705/archiv=0&p1=5653","https://www.enforcementtracker.com/ETid-19",null,null,null,null,"unicredit bank czech republic and slovakia as","UniCredit",null,null,null,null,null,null,null,null],["ND/DE/005","ETid-30","cms_tracker","Germany","DE","Data Protection Authority of Saarland",null,"unknown",118,null,"EUR",null,null,"Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://indd.adobe.com/view/d639298c-3165-4e30-85d8-0730de2a3598","https://www.enforcementtracker.com/ETid-30",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/ES/102","ETid-46","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)",null,"unknown",5000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(d)","Data principles","Non-compliance with general data processing principles","Fine issued","https://www.aepd.es/resoluciones/PS-00331-2018_ORI.pdf","https://www.enforcementtracker.com/ETid-46",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["ND/ES/101","ETid-48","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)",null,"unknown",60000,null,"EUR","GESTIÓN DE COBROS, YO COBRO SL","Finance, Insurance and Consulting","Art. 5(1)(f)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00121-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-48",null,null,null,"Debt collecting agancy","gestion de cobros yo cobro sl",null,null,null,null,null,null,null,null,null],["ND/ES/100","ETid-49","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)",null,"unknown",27000,null,"EUR","Vodafone España, S.A.U.","Media, Telecoms and Broadcasting","Art. 5(1)(d)","Data principles, Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.aepd.es/resoluciones/PS-00411-2018_ORI.pdf","https://www.enforcementtracker.com/ETid-49",null,null,null,null,"vodafone espana sau","Vodafone",null,null,null,null,null,null,null,null],["ND/ES/099","ETid-56","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)",null,"unknown",60000,null,"EUR","ENDESA (energy supplyer)","Transportation and Energy","Art. 5(1)(f)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.aepd.es/resoluciones/PS-00074-2019_ORI.pdf","https://www.enforcementtracker.com/ETid-56",null,null,null,null,"ES: endesa",null,null,null,null,null,null,null,null,null],["ND/ES/098","ETid-81","cms_tracker","Spain","ES","Spanish Data Protection Authority (aepd)",null,"unknown",9600,null,"EUR","SANTI 3000, S.L.","Employment","Art. 5(1)(a), Art. 6","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://theword.iuslaboris.com/hrlaw/insights/spain-video-surveillance-and-data-protection-in-the-workplace","https://www.enforcementtracker.com/ETid-81",null,null,null,"Restaurant","santi 3000 sl",null,null,null,null,null,null,null,null,null],["ND/SK/006","ETid-89","cms_tracker","Slovakia","SK","Slovak Data Protection Office",null,"unknown",null,null,"EUR",null,null,"Art. 15","Data subject rights","Insufficient fulfilment of data subjects rights","Fine issued","https://www.dataprotection.gov.sk/uoou/sites/default/files/sprava_o_stave_ochrany_osobnych_udajov_za_obdobie_25.maj_2018_az_24_maj_2019.pdf","https://www.enforcementtracker.com/ETid-89",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/SK/005","ETid-90","cms_tracker","Slovakia","SK","Slovak Data Protection Office",null,"unknown",null,null,"EUR",null,null,"Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.sk/uoou/sites/default/files/sprava_o_stave_ochrany_osobnych_udajov_za_obdobie_25.maj_2018_az_24_maj_2019.pdf","https://www.enforcementtracker.com/ETid-90",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/SK/004","ETid-91","cms_tracker","Slovakia","SK","Slovak Data Protection Office",null,"unknown",null,null,"EUR",null,null,"Art. 32, Art. 5(1)(f)","Data principles, Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.dataprotection.gov.sk/uoou/sites/default/files/sprava_o_stave_ochrany_osobnych_udajov_za_obdobie_25.maj_2018_az_24_maj_2019.pdf","https://www.enforcementtracker.com/ETid-91",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/SK/003","ETid-92","cms_tracker","Slovakia","SK","Slovak Data Protection Office",null,"unknown",null,null,"EUR",null,"Public Sector and Education","Art. 5(1)(a), Art. 6(1)(a)","Data principles, Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://www.dataprotection.gov.sk/uoou/sites/default/files/sprava_o_stave_ochrany_osobnych_udajov_za_obdobie_25.maj_2018_az_24_maj_2019.pdf","https://www.enforcementtracker.com/ETid-92",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/DE/004","ETid-938","cms_tracker","Germany","DE","Data Protection Authority of Rhineland-Palatinate",null,"unknown",50,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://fragdenstaat.de/anfrage/einsatz-von-dashcams-12/#nachricht-541947","https://www.enforcementtracker.com/ETid-938",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/DE/003","ETid-939","cms_tracker","Germany","DE","Data Protection Authority of Rhineland-Palatinate",null,"unknown",300,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://fragdenstaat.de/anfrage/einsatz-von-dashcams-12/#nachricht-541947","https://www.enforcementtracker.com/ETid-939",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/DE/002","ETid-940","cms_tracker","Germany","DE","Data Protection Authority of Rhineland-Palatinate",null,"unknown",600,null,"EUR",null,"Individuals and Private Associations","Art. 6","Unlawful processing","Insufficient legal basis for data processing","Fine issued","https://fragdenstaat.de/anfrage/einsatz-von-dashcams-12/#nachricht-541947","https://www.enforcementtracker.com/ETid-940",null,null,null,null,null,null,null,null,null,null,null,null,null,null],["ND/SK/002","ETid-95","cms_tracker","Slovakia","SK","Slovak Data Protection Office",null,"unknown",40000,null,"EUR","Slovak Telekom","Media, Telecoms and Broadcasting","Art. 32","Data security","Insufficient technical and organisational measures to ensure information security","Fine issued","https://www.etrend.sk/ekonomika/gdpr-zacina-hryzt-telekomunikacny-operator-dostal-pokutu-40-tisic-eur.html","https://www.enforcementtracker.com/ETid-95",null,null,null,null,"SK: slovak telekom",null,null,null,null,null,null,null,null,null],["ND/IT/009","Garante per la protezione dei dati personali (Italy) - 10269624","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)",null,"unknown",280000,"280000.0","EUR","Altroconsumo Edizioni S.r.l.",null,"Art. 12(3), Art. 21(2), Art. 28(3)(e), Art. 6(1)(b), Art. 7","Consent, Data subject rights, Processor obligations, Transparency, Unlawful processing",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10269624","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10269624",null,"gdprhub",null,null,"altroconsumo edizioni srl",null,null,null,null,null,null,null,null,null],["ND/IT/012","Garante per la protezione dei dati personali (Italy) - 10297167","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)",null,"unknown",10000,"10000.0","EUR","Nazionale di Ricerca Metrologica",null,"Art. 12(1), Art. 13, Art. 32, Art. 5(1)(a), Art. 88","Data principles, Data security, Transparency",null,"Violation found","https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10297167","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_10297167",null,"gdprhub",null,null,"IT: nazionale di ricerca metrologica",null,null,null,null,null,null,null,null,null],["ND/IT/011","Garante per la protezione dei dati personali (Italy) - 615/2026","gdprhub","Italy","IT","Garante per la protezione dei dati personali (Italy)",null,"unknown",5000,"5000.0","EUR","Comune di Aprilia",null,"Art. 5(1)(a), Art. 5(1)(b), Art. 5(1)(c), Art. 6(1)(c), Art. 6(1)(e)","Data principles, Unlawful processing",null,null,"https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/10296755","https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_%28Italy%29_-_615/2026",null,"gdprhub",null,null,"IT: comune di aprilia",null,null,null,null,null,null,null,null,null],["ND/GR/001","HDPA (Greece) - 37/2020","gdprhub","Greece","GR","HDPA (Greece)",null,"unknown",1000,"1000","EUR",null,null,"Art. 4(7)",null,null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2020&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_37/2020",null,"gdprhub",null,"Politician",null,null,null,null,null,"person",null,null,null,null],["ND/GR/002","HDPA (Greece) - 38/2020","gdprhub","Greece","GR","HDPA (Greece)",null,"unknown",2000,"2000","EUR",null,null,"Art. 4(7)",null,null,"Violation found","https://www.dpa.gr/portal/page?_pageid=33%2C15453&_dad=portal&_schema=PORTAL&_piref33_15473_33_15453_15453.etos=2020&_piref33_15473_33_15453_15453.arithmosApofasis=&_piref33_15473_33_15453_15453.thematikiEnotita=-1&_piref33_15473_33_15453_15453.ananeosi=%CE%91%CE%BD%CE%B1%CE%BD%CE%AD%CF%89%CF%83%CE%B7","https://gdprhub.eu/index.php?title=HDPA_%28Greece%29_-_38/2020",null,"gdprhub",null,"Politician",null,null,null,null,null,"person",null,null,null,null],["ND/DE/001","HmbBfDI (Hamburg) - Vattenfall Europe Sales GmbH","gdprhub","Germany","DE","HmbBfDI (Hamburg)",null,"unknown",901389,"901389","EUR","Vattenfall Europe",null,"Art. 12, Art. 13","Transparency",null,"Violation found","https://datenschutz-hamburg.de/pressemitteilungen/2021/09/2021-09-25-vattenfall2","https://gdprhub.eu/index.php?title=HmbBfDI_%28Hamburg%29_-_Vattenfall_Europe_Sales_GmbH",null,"gdprhub",null,null,"DE: vattenfall europe",null,null,null,null,null,null,null,null,null],["ND/GB/006","ICO (UK) - Yes Consumer Solutions Ltd","gdprhub","United Kingdom","GB","ICO (UK)",null,"unknown",170000,"170000","EUR","Yes Consumer Solutions Ltd",null,"Art. 4(11)",null,null,"Violation found","https://ico.org.uk/media/action-weve-taken/mpns/2620333/yes-consumer-solutions-limited-mpn-20210729.pdf","https://gdprhub.eu/index.php?title=ICO_%28UK%29_-_Yes_Consumer_Solutions_Ltd",null,"gdprhub",null,null,"yes consumer solutions ltd",null,null,null,null,null,null,null,null,null],["ND/GB/003","ICO - FS50812647","gdprhub","United Kingdom","GB","ICO (UK)",null,"unknown",null,null,null,"Department for Digital, Culture, Media & Sport",null,null,null,null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617184/fs50812647.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50812647",null,"gdprhub",null,null,"GB: department for digital culture media and sport",null,null,null,null,null,null,null,null,null],["ND/GB/002","ICO - FS50867088","gdprhub","United Kingdom","GB","ICO (UK)",null,"unknown",null,null,null,"Northamptonshire Police",null,"Art. 10, Art. 5(1)(a), Art. 6(1)","Data principles, Special categories, Unlawful processing",null,"Rejected","https://ico.org.uk/media/action-weve-taken/decision-notices/2020/2617193/fs50867088.pdf","https://gdprhub.eu/index.php?title=ICO_-_FS50867088",null,"gdprhub",null,null,"GB: northamptonshire police",null,null,null,null,null,null,null,null,null],["ND/SI/009","IP (Slovenia) - 0609-113/2025/9","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",5320,"5320.0","EUR",null,null,"Art. 32, Art. 5(1)(f)","Data principles, Data security",null,null,"https://www.ip-rs.si/varstvo-osebnih-podatkov/praksa-ip/suvp/2026","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_0609-113/2025/9",null,"gdprhub",null,"Company",null,null,null,null,null,null,null,null,null,null],["ND/SI/007","IP (Slovenia) - 07121-1/2021/1039","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",null,"None","EUR",null,null,"Art. 6, Art. 9","Special categories, Unlawful processing",null,null,"https://www.ip-rs.si/mnenja-gdpr/testiranje-pri-delodajalcu","https://gdprhub.eu/index.php?title=IP_%28Slovenia%29_-_07121-1/2021/1039",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["ND/SI/004","IP - 07120-1/2020/25","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",null,"None","EUR",null,null,"Art. 28, Art. 4(5), Art. 58, Art. 6, Art. 9","Processor obligations, Special categories, Unlawful processing",null,null,"https://wzww.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1449","https://gdprhub.eu/index.php?title=IP_-_07120-1/2020/25",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["ND/SI/006","IP - 07120-1/2021/181","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",null,"None","EUR",null,null,"Art. 6","Unlawful processing",null,null,"https://bit.ly/3edwXoH","https://gdprhub.eu/index.php?title=IP_-_07120-1/2021/181",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["ND/SI/003","IP - 07121-1/2020/195","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",null,null,null,null,null,"Art. 35","DPIA",null,"n/a","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1294","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/195",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["ND/SI/002","IP - 07121-1/2020/196","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",null,null,null,null,null,"Art. 58, Art. 6","Unlawful processing",null,"n/a","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1290","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/196",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["ND/SI/001","IP - 07121-1/2020/199","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",null,null,null,null,null,"Art. 32, Art. 58, Art. 6(1)(e), Art. 6(1)(f)","Data security, Unlawful processing",null,"n/a","https://www.ip-rs.si/vop/?tx_jzgdprdecisions_pi1%5BshowUid%5D=1293","https://gdprhub.eu/index.php?title=IP_-_07121-1/2020/199",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["ND/SI/005","IP - 07121-1/2021/577","gdprhub","Slovenia","SI","IP (Slovenia)",null,"unknown",null,"None","EUR",null,null,"Art. 37","Data protection officer",null,null,"https://www.ip-rs.si/mnenja-gdpr/obveznosti-upravljavca-po-splošni-uredbi-in-imenovanje-dpo","https://gdprhub.eu/index.php?title=IP_-_07121-1/2021/577",null,"gdprhub",null,null,null,null,null,null,null,"opinion",null,null,null,null],["ND/IS/004","Persónuvernd (Iceland) - 2025010358","gdprhub","Iceland","IS","Persónuvernd (Iceland)",null,"unknown",null,null,null,null,null,"Art. 14, Art. 5(1)(a)","Data principles, Transparency",null,"Other Outcome","https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/midlun-baendasamtaka-islands-a-personuupplysingum-ur-world-feng-og-aframhaldandi-vinnsla-horseday-ehf-16-9-2026","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Iceland%29_-_2025010358",null,"gdprhub",null,"Farmers’ Association",null,null,null,null,null,null,null,null,null,null],["ND/IS/005","Persónuvernd (Island) - 2025061555","gdprhub","Iceland","IS","Persónuvernd (Island)",null,"unknown",null,null,null,"Isavia INN",null,"Art. 12, Art. 13, Art. 5(1)(a)","Data principles, Transparency",null,"Violation found","https://island.is/s/personuvernd/urskurdir-akvardanir-og-alit/frumkvaedisathugun-a-vinnslu-personuupplysinga-i-tengslum-vid-rafraena-voktun-a-bilastaedum-isavia-innanlandsflugvalla-ehf-22-9-2026","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_%28Island%29_-_2025061555",null,"gdprhub",null,null,"IS: isavia inn",null,null,null,null,null,null,null,null,null],["ND/IS/003","Persónuvernd - 2020010646","gdprhub","Iceland","IS","Persónuvernd (Iceland)",null,"unknown",null,"None","EUR","National Commissioner of Police",null,"Art. 15","Data subject rights",null,"Rejected","https://www.personuvernd.is/urlausnir/rettur-einstaklings-til-upplysinga-um-uppflettingar-i-malaskrarkerfi-rikislogreglustjora-loke","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020010646",null,"gdprhub",null,null,"IS: national commissioner of police",null,null,null,null,null,null,null,null,null],["ND/IS/002","Persónuvernd - 2020051604","gdprhub","Iceland","IS","Persónuvernd (Iceland)",null,"unknown",null,"None","EUR","Dictorate of Labour",null,"Art. 2, Art. 4(1)",null,null,null,"https://www.personuvernd.is/urlausnir/svar-personuverndar-til-vinnumalastofnunar-vegna-birtingar-upplysinga-um-nytingu-hlutabotaleidar","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_2020051604",null,"gdprhub",null,null,"IS: dictorate of labour",null,null,null,null,null,null,null,null,null],["ND/IS/001","Persónuvernd - nr. 2019/0490","gdprhub","Iceland","IS","Persónuvernd (Iceland)",null,"unknown",null,"n/a","N/A","Íslandshótels",null,"Art. 5(1)(f), Art. 9","Data principles, Special categories",null,"Violation found","https://www.personuvernd.is/urlausnir/vinnsla-islandshotela-hf.-a-upplysingum-um-veikindafjarvistir-starfsmanna","https://gdprhub.eu/index.php?title=Pers%C3%B3nuvernd_-_nr._2019/0490",null,"gdprhub",null,null,"IS: islandshotels",null,null,null,null,null,null,null,null,null],["ND/FI/001","Tietosuojavaltuutetun toimisto (Finland) - 3021/452/2017","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)",null,"unknown",null,null,null,"Electricity company",null,"Art. 12(1), Art. 12(2), Art. 12(6), Art. 13, Art. 15(1)(h), Art. 15(3), Art. 15(4), Art. 5(1)(a), Art. 58(2)","Data principles, Data subject rights, Transparency",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200501","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_3021/452/2017",null,"gdprhub",null,null,null,null,null,null,null,null,null,null,null,null],["ND/FI/002","Tietosuojavaltuutetun toimisto (Finland) - 4359/163/2018","gdprhub","Finland","FI","Tietosuojavaltuutetun toimisto (Finland)",null,"unknown",null,"None","EUR",null,null,"Art. 5(1)(e), Art. 58(2)(c)","Data principles",null,"Violation found","https://finlex.fi/fi/viranomaiset/tsv/2020/20200521","https://gdprhub.eu/index.php?title=Tietosuojavaltuutetun_toimisto_%28Finland%29_-_4359/163/2018",null,"gdprhub",null,"Debt collection agency",null,null,null,null,null,null,null,null,null,null]]}