Category: GDPR

GDPR

Welcome to the Captain Compliance editorial GDPR section, dedicated to the General Data Protection Regulation, one of the most comprehensive data privacy and security laws globally. Enforced since May 25, 2018, the GDPR establishes stringent requirements for organizations that collect, process, and store personal data of individuals within the European Union (EU). This regulation applies to both EU-based companies and non-EU organizations that handle EU citizens’ data. Here, you’ll find articles that explore key aspects of the GDPR, including data protection principles, individual rights, and compliance strategies. We provide insights into special categories of personal data, consent requirements, and the implications of non-compliance, such as significant fines. Stay informed about how the GDPR impacts your business operations and learn how to implement effective data protection measures to ensure compliance and safeguard personal data. You can always reach out to the Captain Compliance team for help with a DPO or implementing GDPR software to help automate your organizations privacy requirements. 

GDPR Enforcement Tracker

Enforcement Tracker IDCountryDate of DecisionFine [€]Company FinedQuoted Art.Violation Reason
ETid-2506FINLAND2024-12-17950,000Sambla Group OyArt. 5 (1) f) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2505ROMANIA2025-01-235,000Softehnica S.R.L.Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2504ROMANIA2025-01-172,000DELIVERY SOLUTIONS S.A.Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2503ROMANIA2025-01-2015,000Vodafone Romania S.A.Art. 32 (1) b) GDPR, Art. 32 (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2502SPAIN2024-10-04900Private individualArt. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-2501SPAIN2024-10-314,000GESTIÓN DE VENTAS IBERIA S.L.Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2500SPAIN2024-10-3112,000NEGOCIOS R&R 2020 S.L.Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2499SPAIN2024-12-03300Private individualArt. 13 GDPRInsufficient fulfilment of information obligations
ETid-2598SPAIN2024-11-072,000KAFFA KOFFEE ORGANISATION, S.L.Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2597ITALY2024-11-0215,000,000OpenAI OpCo LLCArt. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2596CROATIA2024-09-1345,000HotelUnknownUnknown
ETid-2595CROATIA2024-09-1335,700CompanyUnknownUnknown
ETid-2594CROATIA2024-09-13190,000HospitalArt. 5 (1) e) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) a), b) GDPR, Art. 32 (1) b), Art. 33 (1) GDPR, Art. 38 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2493POLAND2024-11-266,900HospitalArt. 33 (1) GDPR, Art. 34 (1), (2) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2492POLAND2024-11-204,700UnknownArt. 28 (3) c), f) GDPR, Art. 32 (1) , (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2491POLAND2024-11-20358,000UnknownArt. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 28 (1) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2490SPAIN2024-11-19200,000VODAFONE ESPAÑA, S.A.U.Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2489SPAIN2024-10-18200,000VODAFONE ESPAÑA, S.A.U.Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2488SPAIN2024-10-04600VOLTIUM CONSULTORES 2020Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2487GERMANY2024-11-12900,000Debt collection service providerArt. 5 (1) a) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2486SPAIN2024-09-11600KVIKU SPAIN, S.LArt. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2485POLAND2024-10-185,800UnknownArt. 37 (1) a) GDPR, Art. 37 (7) GDPRInsufficient involvement of data protection officer
ETid-2484IRELAND 2024-12-17 251,000,000 Meta Platforms Ireland Limited Art. 33 (3), (5) GDPR, Art. 25 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2483 ITALY 2024-07-17 80,000 Selectra S.p.A. Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 88 GDPR, Art. 114 Codice della privacyNon-compliance with general data processing principles
ETid-2482NORWAY 2024-10-21 20,800 Grue municipality Art. 24 GDPR, Art. 32 (1) b) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2481 SPAIN 2024-09-05 3,000 PLAY FUL KIDS, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2480SPAIN 2024-08-06 2,000 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2479 ROMANIA 2024-11-04 1,000 Blackcab Systems SRL Art. 12 (3) GDPR, Art. 15 (1), (3) GDPRInsufficient fulfilment of data subjects rights
ETid-2478ROMANIA 2024-10-30 15,000 Untold SRL Art. 12 (3), (4) GDPR, Art. 15 GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-2477 ROMANIA 2024-08-20 8,000 Ana Hotels SRL Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2476ITALY 2024-09-12 400 Private individual Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-2475 ITALY 2024-09-12 5,000 Top Quality Corporation s.r.l.s. Art. 12 (3) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2464SPAIN 2024-07-11 600 ASSOCIACIO CANNABICA DEL MARESME ACANNAM Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2463 ITALY 2024-09-26 4,000 CI & DI Food s.r.l. Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2462SPAIN 2024-07-05 10,000 Clinic owner Art. 6 (1) GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-2461 IRELAND 2024-09-27 91,000,000 Meta Platforms Ireland Limited Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 33 (1), (5) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2460SPAIN 2024-08-06 10,000 LOCAL VERTICALS, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2459 SPAIN 2024-08-22 50,000 SANTANDER CONSUMER FINANCE, S.A. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2458NORWAY 2024-09-04 12,700 University of Agder Art. 32 GDPR, Art. 24 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2457 POLAND 2024-08-20 940,000 mBank Art. 34 (1), (2) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2456ROMANIA 2024-09-17 3,000 Constanța South Container Terminal SRL Art. 32 (1) b) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2455 ROMANIA 2024-09-16 3,000 Vodafone România SA Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-2454ROMANIA 2024-09-16 1,000 SC Class IT Outsourcing SRL Art. 12 (3) GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-2453 GREECE 2024-09-23 1,400 Attorney Art. 12 (3) GDPR, Art. 31 GDPRInsufficient fulfilment of data subjects rights
ETid-2452ROMANIA 2024-09-23 2,000 PPC ENERGIE MUNTENIA S.A. Art. 12 (3) GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-2451 SPAIN 2024-06-25 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2450SWEDEN 2024-08-29 698,000 Apohem AB Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2449 SWEDEN 2024-08-29 3,200,000 Apoteket AB. Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2448THE NETHERLANDS 2024-05-16 30,500,000 Clearview AI Inc. Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 12 (1), (2) GDPR, Art. 14 (1), (2) GDPR, Art. 27 (1) GDPR Non-compliance with general data processing principles
ETid-2447 THE NETHERLANDS 2024-07-22 290,000,000 Uber Technologies Inc., Uber B.V. Art. 44 GDPRNon-compliance with general data processing principles
ETid-2446POLAND 2024-09-02 19,800 National Prosecutor's Office Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR Insufficient legal basis for data processing
ETid-2445 NORWAY 2024-09-06 20,900 Eidskog municipality Art. 6 GDPRInsufficient legal basis for data processing
ETid-2444GERMANY 2024 32,000 Company Unknown Insufficient technical and organisational measures to ensure information security
ETid-2443 GERMANY 2024 11,500 Company UnknownInsufficient technical and organisational measures to ensure information security
ETid-2442GERMANY 2024 Unknown Company Unknown Insufficient technical and organisational measures to ensure information security
ETid-2441 GERMANY 2024 Unknown Company UnknownInsufficient technical and organisational measures to ensure information security
ETid-2440GERMANY 2024 Unknown Police employees Unknown Insufficient legal basis for data processing
ETid-2439 GERMANY 2024 Unknown Private individual UnknownInsufficient legal basis for data processing
ETid-2438GERMANY 2024 Unknown Private individual Unknown Insufficient legal basis for data processing
ETid-2437 GERMANY 2024 6,000 Online retailer UnknownInsufficient fulfilment of data breach notification obligations
ETid-2436SPAIN 2024-06-26 4,000 ALTERNATIVA CORELLANA INDEPENDIENTE Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-2435 GERMANY 2024 16,000 Hotel UnknownInsufficient legal basis for data processing
ETid-2434SPAIN 2024-07-04 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2433 GERMANY 2023 16,600 Company Art. 6 GDPR, Art. 12 GDPR, Art. 26 GDPRUnknown
ETid-2432DENMARK 2024-08-14 26,800 Municipality of Vejen Unknown Insufficient technical and organisational measures to ensure information security
ETid-2431 SPAIN 2024-08-12 270,000 UNIQLO EUROPE, LTD, SUCURSAL EN ESPAÑA Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2430FRANCE 2024-01-31 20,000 Website editor Unknown Unknown
ETid-2429 FRANCE 2024-01-31 10,000 Unknown UnknownUnknown
ETid-2428POLAND 2024-05-20 336,000 Company Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2427 ITALY 2024-06-20 10,000 TS Food Processing s.r.l. Art. 12 (3) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2426SPAIN 2023-03-16 145,000 AFIANZA ASESORES S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2425 FRANCE 2024-05-25 15,000 Association UnknownNon-compliance with general data processing principles
ETid-2424FRANCE 2024-05-25 10,000 Association Unknown Non-compliance with general data processing principles
ETid-2423 FRANCE 2024-01-31 5,000 Dentist UnknownInsufficient fulfilment of data subjects rights
ETid-2422FRANCE 2024-04-25 16,000 Association Art. 6 GDPR Insufficient legal basis for data processing
ETid-2421 FRANCE 2024-05-23 6,000 Pubilc educational institution UnknownNon-compliance with general data processing principles
ETid-2420FRANCE 2024-06-10 5,000 Bakery Unknown Non-compliance with general data processing principles
ETid-2419 ROMANIA 2024-08-06 1,000 BEST ELAN ONLINE SRL Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2418SPAIN 2024-05-28 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2417 SPAIN 2024-06-07 2,000 EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L. Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2416SPAIN 2024-05-14 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2415 FRANCE 2024-01-24 20,000 Pharmaceutical wholesaler UnknownUnknown
ETid-2414FRANCE 2024-01-22 500 Attorney Unknown Insufficient cooperation with supervisory authority
ETid-2413 FRANCE 2024-01-15 5,000 Attorney UnknownInsufficient fulfilment of data subjects rights
ETid-2412FRANCE 2024-01-09 1,500 Website operator Unknown Insufficient fulfilment of data subjects rights
ETid-2411 ITALY 2024-06-20 20,000 Municipality of Nepi Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 2-ter Codice della privacyNon-compliance with general data processing principles
ETid-2410FRANCE 2024-07-22 6,900 Municipality of Korou Art. 31 GDPR, Art. 37 GDPR Insufficient involvement of data protection officer
ETid-2409 ITALY 2024-04-24 30,000 Rossi Carta S.r.l. Art. 6 GDPR, Art. 7 GDPR, Art. 12 (3) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2408ITALY 2024-05-23 8,400 Azienda Sanitaria Locale TO4 Art. 5 (1) f) GDPR, Art. 9 GDPR Non-compliance with general data processing principles
ETid-2407 SPAIN 2024-05-28 70,000 CAIXABANK S.A. Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2406SPAIN 2024-04-15 400 Private individual Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2405 ITALY 2024-05-23 4,500 Azienda Socio-sanitaria Territoriale Rhodense Art. 5 (1) d) GDPR, Art. 12 GDPR, Art. 16 GDPRInsufficient fulfilment of data subjects rights
ETid-2404ITALY 2024-06-20 4,000 Medical association Art. 12 (3) GDPR, Art. 13 (2) a) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2403 SPAIN 2024-07-18 600 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2402SPAIN 2024-07-18 200,000 Vodafone España, S.A.U. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-2401 SPAIN 2024-07-17 600 DIGIMAN ALICANTE S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2400GREECE 2024-06-27 50,000 METRO SA Art. 15 GDPR, Art. 17 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2399 THE NETHERLANDS 2024-05-02 600,000 A.S. Watson Health & Beauty Continental Europe B.V. Art. 5 (1) a) GDPR, Ar.t 6 (1) GDPRInsufficient legal basis for data processing
ETid-2398LITHUANIA 2024-07-02 2,385,276 Vinted Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 12 (1), (4) GDPR Insufficient fulfilment of data subjects rights
ETid-2397 SPAIN 2024-06-26 80,000 AXA REAL ESTATE INVESTMENT MANAGERS IBERICA S.A. y SEUR GEOPOST, S.L. Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2396SPAIN 2024-07-10 300 WWPD CINVENTO INTERNATIONAL PATENT TRADING, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2395 SPAIN 2024-04-12 1,000 DELSA ALQUILERES S.L. Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-2394ITALY 2024-06-06 500 Comune di Ustica Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 9 (1), (2), (4) GDPR, Art. 37 (7) GDPR, Art. 2-ter (1), (3) Codice della privacy, Art. 2-septies (8) Codice della privacy Non-compliance with general data processing principles
ETid-2393 SPAIN 2024-04-12 600 Website operator Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2392SPAIN 2024-05-22 3,000 CUBILLO GALLEGO S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2391 SPAIN 2024-05-24 1,000 VOX ESPAÑA Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2390ITALY 2024-05-23 3,500 Professional association Art. 5 (1) a), d) GDPR Art. 6 GDPR, Art. 27 (7) GDPR, Art. 2-ter Codice della privacy Non-compliance with general data processing principles
ETid-2389 SPAIN 2024-06-13 3,000 DQG NORTE A.I.E Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2388SPAIN 2024-06-17 3,000 20 AÑOS DE MÚSICA A.I.E. Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2387 SPAIN 2024-06-05 800 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2386SPAIN 2024-06-05 180 Website operator Art. 5 (1) e) GDPR Non-compliance with general data processing principles
ETid-2385 SPAIN 2024-04-26 10,000 ASSOCIACIO OASIS CULTURAL Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2384SPAIN 2024-06-25 150,000 BANCO CETELEM, S.A. Art. 6 GDPR, Art. 17 (1) d) GDPR Insufficient legal basis for data processing
ETid-2383 SPAIN 2024-06-26 600 Homeowners' association Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2382ITALY 2024-04-11 20,000 Istituto Nazionale di Previdenza Sociale Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy Insufficient legal basis for data processing
ETid-2381 ITALY 2024-06-06 6,419,631 Eni Plenitude S.p.A. Art. 5 (1) a), d), f) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 130 Codice della privacyNon-compliance with general data processing principles
ETid-2380ITALY 2024-06-06 120,000 Cappello Giovanni & Figli s.r.l. Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 9 (2) b) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2379 SPAIN 2024-06-12 120,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A. Art. 5 (1) d) GDPRNon-compliance with general data processing principles
ETid-2378SPAIN 2024-06-10 160,000 ALLIANZ COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2377 SWEDEN 2024-06-24 1,300,000 Avanza Bank AB Art. 5 (1) f) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2376ROMANIA 2024-06-25 1,000 Rețele Electrice Dobrogea SA Art. 32 (1) b) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2375 ROMANIA 2024-06-25 3,000 Rețele Electrice Muntenia SA. Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2374CYPRUS 2024-02-08 2,000 Brivio Limited Art. 12 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-2373 CYPRUS 2024-02-08 1,500 Aylo Social LTD Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-2372SPAIN 2024-06-17 600 Club Balonmano Gijón Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2371 SPAIN 2024-06-20 42,000 CUI ZSQ FOOD, S.L. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-2370ITALY 2024-05-09 75,000 Azienda ospedale università di Padova Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2369 POLAND 2024-04-24 2,500 Committee Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2368SPAIN 2024-04-12 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2367 SPAIN 2024-06-10 100,000 NATURGY IBERIA, S.A. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2366ITALY 2024-04-24 30,000 Gestore Dei Servizi Energetici - Gse S.p.A. Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2365 ITALY 2024-04-24 10,000 C.I.E.L. S.p.A. Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2364ITALY 2024-04-24 3,000 I.N.P.A.S. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy Insufficient legal basis for data processing
ETid-2363 ITALY 2024-04-24 5,000 Dly S.r.l. Art. 5 (1) a) GDPR, Art. 88 GDPR, Art. 114 Codice della privacyNon-compliance with general data processing principles
ETid-2362ITALY 2024-05-09 3,000 Polisportiva Mimmo Ferrito s.r.l.. Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2361 ITALY 2024-05-09 3,000 Medical association Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-2360SPAIN 2024-06-05 6,000 EUROBOX S.A. Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2359 ITALY 2024-05-09 10,000 Azzurro Club Hotels S.r.l. Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 130 (2) Codice della privacyInsufficient legal basis for data processing
ETid-2358GERMANY 2023 Fine in four-digit amount Private individual Unknown Non-compliance with general data processing principles
ETid-2357 GERMANY 2023 Fine in four-digit amount Physician UnknownNon-compliance with general data processing principles
ETid-2356GERMANY 2023 Unknown Private individual Unknown Non-compliance with general data processing principles
ETid-2355 GERMANY 2023 Unknown Store detective UnknownNon-compliance with general data processing principles
ETid-2354GERMANY 2023 Unknown Private individual Unknown Non-compliance with general data processing principles
ETid-2353 GERMANY 2023 Unknown Private individual UnknownNon-compliance with general data processing principles
ETid-2352SPAIN 2024-04-19 1,000 CONSULTORÍA PERITACIONES ALMERIENSES, S.L Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2351 THE NETHERLANDS 2024-06-04 6,000 Ambitious People Group B.V. Art. 12 (3) GDPR, Art. 17 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-2350SPAIN 2024-05-23 600 President of a workers' council Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-2349 SPAIN 2024-05-30 4,200 PILLOW HOTELS, S.L. Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 33 (1) GDPRNon-compliance with general data processing principles
ETid-2348ROMANIA 2024-05-30 2,000 Corint Logistic SRL. Art. 5 (1) a), b) GDPR, Art. 17 GDPR, Art. 21 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-2347 FRANCE 2024-06-05 Unknown Unknown UnknownInsufficient cooperation with supervisory authority
ETid-2346FRANCE 2024-06-05 Unknown Unknown Unknown Insufficient fulfilment of data subjects rights
ETid-2345 FRANCE 2024-06-05 Unknown Company Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2344FRANCE 2024-06-05 Unknown Company Art. 5 (1) a) GDPR Non-compliance with general data processing principles
ETid-2343 SPAIN 2024-05-07 1,200 ARRENDAMIENTOS DEUDORES, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2342SPAIN 2024-03-21 5,000 HIPERBAZAR YONGFA 2018 SL Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2341 ITALY 2024-04-11 100,000 Olimpia S.r.l. Art. 5 (1) a), f) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2340ITALY 2024-04-11 100,000 Facile.Energy S.r.l. Art. 5 (1) a), f) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2339 SPAIN 2024-05-22 96,000 WATIUM S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2338SPAIN 2024-05-07 360,000 4FINANCE SPAIN
FINANCIAL SERVICES, S.A.U.
Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2337 ITALY 2024-04-11 1,000 Store owner Art. 5 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2336SPAIN 2024-05-08 12,000 DENTALCUADROS BCN S.L.P. Art. 32 GDPR, Art. 33 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2335 ITALY 2024-04-11 6,000 Libero Consorzio comunale di Enna Art. 37 (1), (7) GDPR, Art. 38 (2), (6) GDPRInsufficient involvement of data protection officer
ETid-2334ITALY 2024-04-11 25,000 Innova Camara Art. 5 (1) e), f) GDPR, Ar.t 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2333 POLAND 2024-04-29 56,000 Res-Gastro M. Gaweł Sp. k. Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2332SPAIN 2024-03-25 2,400 Restaurant owner Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2331 ITALY 2024-03-07 20,000 Centro Riparazioni Piacentino S.p.A. Art. 5 (1) a), c), e) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2330ITALY 2024-03-07 20,000 Banca di Credito Cooperativo Appulo Lucana soc. cooperativa Art. 12 (3), (4) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2329 SPAIN 2024-03-15 200,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2328SPAIN 2024-04-30 1,200 DELPASO CAR
HIRE, S.L.U.
Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2327 AUSTRIA 2024-01-04 10,000 Website operator Art. 17 (1) GDPR, Art. 25 (1) GDPR, Art. 58 (2) c) GDPRInsufficient fulfilment of data subjects rights
ETid-2326POLAND 2024-04-30 210 Association Art. 33 (1) GDPR Insufficient fulfilment of data breach notification obligations
ETid-2325 SPAIN 2024-05-09 1,600 Homeowners' association Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2324SPAIN 2024-05-07 480 Homeowners' association Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-2323 SPAIN 2024-02-23 90,000 TELEFÓNICA DE ESPAÑA, S.A.U. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2322SPAIN 2024-03-021 1,000 CLÍNICA PARÍS, S.L. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2321 SPAIN 2024-01-08 2,000 Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-2320ITALY 2024-03-07 2,000 Bar Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy Non-compliance with general data processing principles
ETid-2319 SPAIN 2024-02-19 400 Private individual Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-2318SPAIN 2024-03-07 1,000 DENTAL REY-GAR, S.L. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2317 UNITED KINGDOM 2024-04-30 8,700 Central Young Men’s Christian Association Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2316ROMANIA 2024-05-08 5,000 CENTRUL MEDICAL UNIREA SRL Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2315 ROMANIA 2024-05-09 1,000 MEDICOVER SRL Art. 32 (1) b) GDPR, Art. 32 (2), (3), (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2314ROMANIA 2024-05-09 2,000 IRIDEX GROUP SALUBRIZARE SRL Art. 32 (1) b) GDPR, Art. 32 (2), (3), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2313 SPAIN 2024-03-21 500 JUNTA DE CONSERVACION SECTOR RESIDENCIAL ELORDIGAN SAT Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2312SPAIN 2024-03-15 500 CORPORACIÓN DUAL GRUPO LC, S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-2311 GERMANY 2023 5,000 Company Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-2310GERMANY 2023 25,000 Company Art. 21 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-2309 GERMANY 2023 3,600 Physician Art. 5 (1) f) GDPR, Art. 32 (1) b) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2308ITALY 2023-04-13 200,000 Mas s.r.l.s. Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 30 GDPR Non-compliance with general data processing principles
ETid-2307 ITALY 2023-04-13 500,000 Mas s.r.l. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 30 GDPRNon-compliance with general data processing principles
ETid-2306ITALY 2024-02-08 79,100,000 Enel Energia SpA Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2305 CROATIA 2024-04-22 20,000 Betting company Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPRInsufficient legal basis for data processing
ETid-2304CROATIA 2024-04-22 15,000 Betting company Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPR Insufficient legal basis for data processing
ETid-2303 CROATIA 2024-04-22 Fine amount between EUR 500 and EUR 4,000 Unknown Art. 27 Croatin Law on the Implementation of the GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2302GERMANY 2023 Fine in three-digit amount Fishing club Art. 6 GDPR Insufficient legal basis for data processing
ETid-2301 GERMANY 2023 Fine in three-digit amount Police officer UnknownInsufficient legal basis for data processing
ETid-2300GERMANY 2023 Fine in three-digit amount Private individual Unknown Insufficient legal basis for data processing
ETid-2299 GERMANY 2023 Fine in five-digit amount Supermarket Art. 6 (1) GDPR, Art. 9 (1) GDPRInsufficient legal basis for data processing
ETid-2298CZECH REPUBLIC 2024-04-15 13,900,000 Avast Software s.r.o. Unknown Unknown
ETid-2297 ROMANIA 2024-04-23 2,000 ALPHA BANK ROMANIA SA. Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2296ROMANIA 2024-04-22 2,000 S.C. Tensa Art Design S.A.. Art. 6 GDPR Insufficient legal basis for data processing
ETid-2295 SPAIN 2024-04-12 1,200,000 CAIXABANK, S.A Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2294SPAIN 2024-02-29 200,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2293 SPAIN 2024-03-01 200,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2292SPAIN 2023-02-08 500 Hiper Store S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2291 SPAIN 2023-10-26 7,000 Ophthalmologic institute Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2290SPAIN 2024-02-19 400 Private individual Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2289 ITALY 2024-03-21 10,000 Azienda sanitaria locale Roma 3 Art. 33 (1), (2), (5) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2288SPAIN 2022-11-07 60,000 INFORMÁTICA MÉDICA, S.L. Art. 28 GDPR Insufficient data processing agreement
ETid-2287 SPAIN 2022-10-26 6,400 AIO E-COMMERCE, S.L. Art. 5 (1) c), f) GDPRNon-compliance with general data processing principles
ETid-2286SPAIN 2024-04-05 112,000 VODAFONE ESPAÑA, S.A.U. Art. 5 (1) d) GDPR Non-compliance with general data processing principles
ETid-2285 SPAIN 2024-04-12 1,800 PRESTAMER, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2284GREECE 2024-02-28 2,995,140 Hellenic Post (ΕΛΛΗΝΙΚΑ ΤΑΧΥΔΡΟΜΕΙΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ) Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2283 SPAIN 2023-11-03 2,000 SINDICATO LIBRE DE TRANSPORTES Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2282GERMANY 2023 Fine in four-digit amount Daycare center Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2281 GERMANY 2023 Fine in four-digit amount Private individual UnknownNon-compliance with general data processing principles
ETid-2280GERMANY 2023 75,000 Company Art. 9 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2279 SPAIN 2023-11-02 48,000 INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P. Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 34 GDPRNon-compliance with general data processing principles
ETid-2278SPAIN 2024-03-25 27,000 20 MINUTOS EDITORA, S.L. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2277 BULGARIA 2023-02-09 5,100 Unknown Art. 5 (1) a), b) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-2276SPAIN 2024-03-15 800 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2275 SPAIN 2022-06-22 1,600 URQUÍA & BAS, CORREDURÍA DE SEGUROS S.L. Art. 33 GDPRInsufficient fulfilment of data breach notification obligations
ETid-2274SPAIN 2024-02-06 160,000 SANITAS, S.A. DE SEGUROS Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-2273 ITALY 2024-02-22 2,000 Camera di Commercio Industria Artigianato e Agricoltura Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-2272SPAIN 2024-02-13 100,000 VODAFONE ESPAÑA, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2271 SPAIN 2024-02-13 4,000 ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L. Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2270ITALY 2023-07-18 45,000 Municipality of Modica Art. 5 (1) a), c), e) GDPR, Art. 5 (2) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 37 (1), (7) GDPR Non-compliance with general data processing principles
ETid-2269 SPAIN 2024-01-23 7,500 ROUNDED TECHNOLOGIES, S.L. Art. 21 LSSI, Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-2268ITALY 2024-02-08 18,000 Azienda socio-sanitaria locale n. 1 di Sassari Art. 5 GDPR, Art. 9 GPDR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2267 SPAIN 2024-02-12 365,000 CTC EXTERNALIZACIÓN, S.L Art. 13 GDPR, Art. 32 GDPR, Art. 35 GDPRInsufficient fulfilment of information obligations
ETid-2266GREECE 2024-04-02 175,000 Greek Ministry of Immigration and Asylum Art. 25 GDPR, Art. 31 GDPR, Art. 35 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2265 SPAIN 2024-02-08 30,000 CENTRO MÉDICO SALUS BALEARES, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2264ITALY 2024-02-07 5,000 Wi-Planet sas di Torri Carlo Alberto e c. Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2263 SPAIN 2024-02-08 200,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2262SPAIN 2024-02-13 40,000 IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA. Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2261 POLAND 2024-03-12 18,000 Toyota Bank Polska S.A. Art. 33 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2260POLAND 2024-03-12 326,000 Santander Bank Polska S.A. Art. 33 (1) GDPR, Art. 34 (1) GDPR Insufficient fulfilment of data breach notification obligations
ETid-2259 ITALY 2024-02-22 50,000 Azienda Trasporto Passeggeri Emilia-Romagna S.p.A. Art. 5 (1) a), e) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 21 (4) GDPR, Art. 130 (2), (3) Codice della privacyNon-compliance with general data processing principles
ETid-2258POLAND 2023-12-13 5,500 Company Unknown Insufficient cooperation with supervisory authority
ETid-2257 ICELAND 2024-03-24 10,000 Stjörnuna ehf Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2256AUSTRIA 2023 50,700 Political party Unknown Unknown
ETid-2255 ITALY 2023-12-21 2,000 Company Art. 5 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2254POLAND 2023-10-18 24,000 Insurance company Art. 33 (1) GDPR Insufficient fulfilment of data breach notification obligations
ETid-2253 POLAND 2023-12-19 2,300 District Court Krakow Art. 33 (1), (3) GDPR, Art. 34 (1), (2) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2252SPAIN 2023-12-12 10,000 VACACIONES EDREAMS, S.L. Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2251 SPAIN 2023-12-23 3,500 Private individual Art. 6 (1) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-2250SPAIN 2024-01-23 200,000 ORANGE ESPAGNE S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2249 SPAIN 2023-01-19 56,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2248CYPRUS 2023 8,000 Bank of Cyprus Public Company Ltd. Art. 5 (1) d) GDPR Non-compliance with general data processing principles
ETid-2247 CYPRUS 2023-12-07 1,500 Physician Art. 5 (1) a) GDPRNon-compliance with general data processing principles
ETid-2246SPAIN 2024-02-01 36,000 HISPAPOST, S.A. Art. 28 (3) GDPR Insufficient fulfilment of data breach notification obligations
ETid-2245 ITALY 2024-02-08 300,000 Medtronic Italia Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2244ROMANIA 2024-03-05 5,000 EURO MINI STORAGE ROMANIA SRL Art. 24 GDPR, Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2243 FINLAND 2024-03-06 856,000 Verkkokauppa.com Art. 5 (1) e) GDPR, Art. 25 (2) GDPRNon-compliance with general data processing principles
ETid-2242ITALY 2024-02-08 800,000 NTT Data Italia S.P.A Art. 28 (2) GDPR, Art. 33 (2) GDPR Insufficient fulfilment of data breach notification obligations
ETid-2241 GERMANY 2023 Fine amount between EUR 100 and EUR 1,000 Police officers UnknownInsufficient legal basis for data processing
ETid-2240GERMANY 2023 Unknown Website operator Art. 6 GDPR Insufficient legal basis for data processing
ETid-2239 GERMANY 2023 Unknown Operator of a dating platform Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2238GERMANY 2023 Unknown Real estate agency Unknown Insufficient legal basis for data processing
ETid-2237 GERMANY 2023 Unknown Clinic Art. 6 GDPRInsufficient legal basis for data processing
ETid-2236GERMANY 2023 Unknown Company Art. 6 GDPR Insufficient legal basis for data processing
ETid-2235 GERMANY 2023 Unknown Company Art. 6 (1) a) GDPRInsufficient legal basis for data processing
ETid-2234GERMANY 2023 Unknown Company Unknown Insufficient legal basis for data processing
ETid-2233 GERMANY 2023 1,200 Police officer UnknownInsufficient legal basis for data processing
ETid-2232GERMANY 2023 2,000 Private individual Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-2231 GERMANY 2023 Fine in four-digit amount Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-2230GERMANY 2023 Fine in four-digit amount Pizza delivery service Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-2229 GERMANY 2023 Unknown Private individual UnknownInsufficient legal basis for data processing
ETid-2228ITALY 2024-01-24 2,000 Istituto Comprensivo Statale “F.S. Cabrini Art. 5 (1) a) GDPR, Art. 6 (1) c), e) GDPR, Art. 2-ter (1), (3) Codice della privacy Insufficient legal basis for data processing
ETid-2227 ITALY 2024-02-08 2,800,000 UniCredit S.p.a. Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2226SPAIN 2024-01-24 1,200 VUKMAL TRADE, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2225 BELGIUM 2024-01-16 174,640 Black Tiger Belgium Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 15 GDPR Art. 24 GDPR, Art. 25 GDPR, Art. 30 GDPRInsufficient fulfilment of information obligations
ETid-2224ITALY 2024-01-31 2,000 Provincia di Sassari Art. 37 (7) GDPR Insufficient involvement of data protection officer
ETid-2223 ITALY 2024-01-31 2,000 Provincia di Catanzaro Art. 37 (7) GDPRInsufficient involvement of data protection officer
ETid-2222ITALY 2024-01-31 2,000 Libero Consorzio comunale di Caltanissetta Art. 37 (7) GDPR Insufficient involvement of data protection officer
ETid-2221 ITALY 2024-01-31 5,000 Municipality of Siracusa Art. 37 (7) GDPRInsufficient involvement of data protection officer
ETid-2220SPAIN 2023-10-25 6,100,000 ENDESA ENERGÍA, S.A.U. Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 34 GDPR, Art. 44 GDPR Non-compliance with general data processing principles
ETid-2219 SPAIN 2023-10-31 300 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2218SPAIN 2023-11-30 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2217 SPAIN 2023-10-23 50,000 Oney Servicios Financieros E.F.C. Art. 5 (1) d) GDPRNon-compliance with general data processing principles
ETid-2216SPAIN 2023-10-26 5,000,000 CAIXABANK, S.A. Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2215 SPAIN 2023-12-17 600 Private individual Art. 6 (1) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-2214SPAIN 2023-11-13 200,000 CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. Art. 6 GDPR Insufficient legal basis for data processing
ETid-2213 POLAND 2024-01-18 2,300 Unknown Art. 33 (1) GDPR, Art. 34 (1), (2) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2212ITALY 2024-01-24 8,000 Municipality of Salento Art. 58 (2) c) GDPR, Art. 157 Codice della privacy Insufficient cooperation with supervisory authority
ETid-2211 ITALY 2024-01-24 6,000 Municipality Art. 5 (1) a) GDPR, Art. 6 (1) c), e) GDPR, Art. 9 GDPR, Art. 37 (7) GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-septies (8) Codice della privacy, Art. 157 Codice della privacyInsufficient legal basis for data processing
ETid-2210ROMANIA 2024-02-26 3,000 VESTA CEU ROMÂNIA SRL. Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2209 ROMANIA 2024-02-07 2,000 Account Exchange SRL Art. 5 (1) a), c) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-2208ROMANIA 2024-02-05 500 Owners' association Art. 5 (1) a), c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 (3), (4) GDPR Non-compliance with general data processing principles
ETid-2207 AUSTRIA 2023-12-12 5,900 Unknown Art. 31 (1) GDPR, Art. 33 (1) GDPR, Art. 33 (3) a), d) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2206SPAIN 2023-08-23 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2205 SPAIN 2024-01-11 1,000 ATLAS ENTERTAINMENT, S.L. Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-2204SPAIN 2023-11-20 200 Private individual Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-2203 GREECE 2024-01-29 5,000 Municipality of Athens Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-2202GREECE 2024-01-29 25,000 Ministry of Rural Development and Food Art. 31 GDPR, Art. 37 GDPR Insufficient involvement of data protection officer
ETid-2201 SPAIN 2023-07-28 2,500,000 Open Bank, S.A. Art. 25 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2200LITHUANIA 2023-01-24 8,000 Company Art. 5 (1) a) GDPR, Art. 15 (1) a), b), c), d), g) GDPR, Art. 15 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-2199 THE NETHERLANDS 2023-12-11 10,000,000 Uber Technologies Inc.
Uber B.V.
Art. 12 (1), (2) GDPR, Art. 13 (1) f) GDPR, Art. 13 (2) a), b) GDPRInsufficient fulfilment of information obligations
ETid-2198SPAIN 2023-12-07 3,200 SOLAR PROGRESS, S.L. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-2197 SPAIN 2023-12-17 400 TITAN STRONG, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2196ITALY 2023-12-07 2,000 Mushtaq Rubina Kebabish Art. 5 GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2195 ROMANIA 2024-01-30 2,000 Sectorul 1 al Municipiului București Art. 58 (1) a), e) GDPRInsufficient cooperation with supervisory authority
ETid-2194POLAND 2023-12-21 4,300 Unknown Art. 31 GDPR, Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-2193 POLAND 2023-12-07 2,700 Unknown Art. 31 GDPR, Art. 58 (1) a), e) GDPRInsufficient cooperation with supervisory authority
ETid-2192FRANCE 2024-01-23 32,000,000 AMAZON FRANCE LOGISTIQUE Art. 5 (1) c) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2191 ITALY 2023-12-07 40,000 Azienda socio sanitaria territoriale nord Milano, C.F. Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2190SPAIN 2023-11-20 200 Private individual Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-2189 SPAIN 2023-11-17 4,000 LEADDESK, S.L Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2188ITALY 2023-12-07 1,000 Sirio S.p.A. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-2187 ITALY 2023-11-30 60,000 Limit Call S.r.l.s. Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 24 GDPR, Art. 130 Codice della privacyInsufficient legal basis for data processing
ETid-2186ROMANIA 2024-01-15 3,000 TECHNINK LEB SRL Art. 32 (1) a), b), d) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2185 ROMANIA 2024-01-12 17,000 Alior Bank SA Art. 5 (1) a), b) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-2184SPAIN 2023-12-01 30,000 UNIPREX, S.A. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2183 THE NETHERLANDS 2024-01-15 150,000 International Card Services B.V. Art. 35 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2182POLAND 2022-12-30 6,300 Company Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-2181 POLAND 2023-04-20 5,400 Disciplinary officer Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2180ITALY 2023-11-30 3,000 A R.L Spartan Gym Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy Non-compliance with general data processing principles
ETid-2179 ITALY 2023-06-08 40,000 RCS Mediagroup S.p.a. Art. 5 (1) a), c) GDPRNon-compliance with general data processing principles
ETid-2178ITALY 2023-11-16 50,000 Comune di Castel Goffredo Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 35 GDPR Insufficient legal basis for data processing
ETid-2177 ITALY 2023-11-16 20,000 Comune di Lonato del Garda Art. 5 (1) a), b) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-2176ITALY 2023-10-26 1,000 Homeowner administrator Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-2175 GREECE 2023-11-23 10,000 Alpha Bank Art. 12 (3) GDPR, Art. 15 (1), (3) GDPRInsufficient fulfilment of data subjects rights
ETid-2174ITALY 2023-11-30 1,000 Techno Security s.r.l. Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2173 SPAIN 2023-11-21 8,000 EASYJET AIRLINE COMPANY LIMITED Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2172SPAIN 2023-11-21 180 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2171 POLAND 2023-12-20 23,000 Polish Minister of Health Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR, Art. 34 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2170UNITED KINGDOM 2023-12-13 400,000 UK Ministry of Defense Unknown Insufficient technical and organisational measures to ensure information security
ETid-2169 FRANCE 2023-12-22 Unknown Unknown UnknownInsufficient cooperation with supervisory authority
ETid-2168FRANCE 2023-12-22 Unknown Municipality Unknown Non-compliance with general data processing principles
ETid-2167 FRANCE 2023-12-22 Unknown Candidate for parliamentary elections Art. 21 (2) GDPRInsufficient fulfilment of data subjects rights
ETid-2166FRANCE 2023-12-22 Unknown Company Art. 5 (1) b) GDPR Non-compliance with general data processing principles
ETid-2165 ITALY 2023-11-16 18,000 Cluster S.r.l. Art. 5 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2164ITALY 2023-11-16 40,000 Amazon Italia Transport s.r.l. Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2163 SPAIN 2023-11-03 600 Homeowners' association Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2162SPAIN 2023-11-07 1,000 Homeowners' association Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2161 SPAIN 2023-11-07 600 Store owner Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2160ROMANIA 2023-12-15 200 Private individual Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-2159 ROMANIA 2023-12-11 3,000 Veranda Obor S.A. Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2158SPAIN 2023-10-19 500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2157 SPAIN 2023-10-26 500 UPMOBILE SOLUTIONS, S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2156SPAIN 2023-10-23 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2155 FRANCE 2023-12-12 5,000 Kourou municipality Art. 31 GDPR, Art. 37 GDPRInsufficient cooperation with supervisory authority
ETid-2154ITALY 2023-11-16 100,000 Autostrade per l’Italia S.p.A. Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2153 ICELAND 2023-12-06 20,000 City of Kópavogur Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPRNon-compliance with general data processing principles
ETid-2152POLAND 2023-08-30 13,000 Unknown Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-2151 POLAND 2023-11-16 3,200 Unknown Art. 58 (1) a), e) GDPRInsufficient cooperation with supervisory authority
ETid-2150SPAIN 2023-10-28 10,000 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2149 ITALY 2023-10-26 20,000 Region of Lombardy Art.5 GDPR, Art. 6 (1) c), e) GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-2148ROMANIA 2023-12-07 24,000 Hora Credit IFN SA Art. 12 (3) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2147 GREECE 2023-11-10 20,000 Piraeus Leasing S.M.S.A. Art. 5 (1) GDPR, Art. 15 GDPRNon-compliance with general data processing principles
ETid-2146GREECE 2023-11-07 5,000 Municipality Art. 6 (1) GDPR, Art. 17 GDPR Insufficient legal basis for data processing
ETid-2145 ITALY 2023-10-12 40,000 Azienda socio sanitaria territoriale di Lodi CF Art. 5 (1) a), b), c), f) GDPR, Art. 9 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2144CYPRUS 2023-11-22 45,000 Open University of Cyprus Art. 5 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2143 SPAIN 2023-10-11 500 ALBEN AIRPORT FACILITIES S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2142ICELAND 2023-12-06 18,600 City of Hafnarfjörður Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPR Non-compliance with general data processing principles
ETid-2141 ICELAND 2023-12-06 16,600 Garðabær municipality Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPRNon-compliance with general data processing principles
ETid-2140ICELAND 2023-12-06 13,300 City of Reykjavik Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPR Non-compliance with general data processing principles
ETid-2139 ICELAND 2023-12-06 16,600 Reykjanesbær municipality Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPRNon-compliance with general data processing principles
ETid-2138POLAND 2023-10-08 24,000 Link4 Towarzystwo Ubezpieczeń S. A. Art. 33 (1) GDPR Insufficient fulfilment of data breach notification obligations
ETid-2137 SWEDEN 2023-11-28 26,500 Östersund Municipality's Department for Children and Education Art. 35 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2136NORWAY 2023-11-27 1,700,000 Norwegian Labor and Welfare Administration Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1) d) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2135 ROMANIA 2023-06-20 40,000 Dante International SA Art. 12 (2) GDPR, Art. 17 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-2134SPAIN 2023-11-22 56,000 VODAFONE ESPAÑA, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2133 SPAIN 2023-11-17 72,000 Eurocollege Oxford English Institute S.L. Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPRNon-compliance with general data processing principles
ETid-2132THE NETHERLANDS 2023-11-02 30,000 Voorschoten municipality Art. 5 (1) a) GDPR, Art. 6 (1) e) GDPR, Art. 14 (1) c), d) GDPR Non-compliance with general data processing principles
ETid-2131 SPAIN 2023-11-27 50,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2130AUSTRIA 2023-09-26 10,000 Phyisician Art. 5 (1) a), b), c) GDPR, Art. 9 GDPR Non-compliance with general data processing principles
ETid-2129 SPAIN 2023-11-20 10,000 Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-2128SPAIN 2023-11-24 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2127 SPAIN 2023-11-24 10,000 Pharmacy owner Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2126SPAIN 2023-11-22 400 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2125 SPAIN 2023-11-20 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2124ROMANIA 2023-11-20 1,500 Libra Internet Bank SA Art. 58 (2) GDRP Insufficient cooperation with supervisory authority
ETid-2123 SPAIN 2023-11-16 20,000 QUALITY-PROVIDER S.A. Art. 6 (1) GDPR, Art. 58 (1) GDPRInsufficient legal basis for data processing
ETid-2122LUXEMBOURG 2023-09-21 2,500 Unknown Art. 5 (1) b), c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2121 SPAIN 2023-11-16 20,000 FORO ASTURIAS Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2120SPAIN 2023-11-16 500 Private individual Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2119 SPAIN 2023-11-16 10,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2118ITALY 2023-08-31 25,000 Robin Srl Art. 5 (1) a) GDPR, Art. 137 (3) Codice della privacy, Art. 139 Codice della privacy, Art. 6 Regole deontologiche, Art. 7 Regole deontologiche, Non-compliance with general data processing principles
ETid-2117 GREECE 2023-09-25 50,000 Athens Urban Transport Organization Art. 5 (1) e) GDPR, Art. 25 (1) GDPR, Art. 35 (1) GDPRNon-compliance with general data processing principles
ETid-2116GREECE 2023-10-11 1,000 Unknown Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2115 SPAIN 2023-11-15 10,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2114ITALY 2023-07-18 100,000 Tiscali Italia SpA Art. 5 (1) a), b), c), e) GDPR, Art. 5 (2) GDPR, Art. 12 (1) GDPR, Art. 13 (1) a) GDPR, Art. 24 GDPR, Art. 130 Codice della privacy Non-compliance with general data processing principles
ETid-2113 ITALY 2023-07-18 40,000 Compara Facile S.r.l. Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 (2) GDPR, Art. 24 (1), (2) GDPR, Art. 25 (1) GDPR, Art. 130 Codice della privacyNon-compliance with general data processing principles
ETid-2112ROMANIA 2023-11-13 110,000 Rompetrol Downstream SRL Art. 32 (1) b), (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2111 ITALY 2023-09-14 5,000 Nimbus s.r.l. Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2110ITALY 2023-10-12 70,000 Scionti Selezioni Superiori S.r.l. Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 24 (1), (2) GDPR, Art. 25 GDPR, Art. 130 Codice della privacy Non-compliance with general data processing principles
ETid-2109 ITALY 2023-09-28 5,000 Ministero dell'Ambiente e della Sicurezza Energetica Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-septies (8) Codice della privacyNon-compliance with general data processing principles
ETid-2108ITALY 2023-09-28 50,000 Azienda Usl Toscana centro Art. 5 (1) a), e), f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2107 ITALY 2023-09-28 60,000 Salvator Mundi International Hospital s.r.l Art. 5 (1) a), b) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-2106SPAIN 2023-11-02 30,000 APOLLONIA TOPCO, S.L. Art. 5 (1) c) GDPR, Art. 38 GDPR Non-compliance with general data processing principles
ETid-2105 ITALY 2023-09-28 3,000 Palombaro s.r.l. Art. 5 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2104SPAIN 2023-09-23 12,000 CHATWITH.IO WORLDWIDE, S.L. Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 22 (2) LSSI Non-compliance with general data processing principles
ETid-2103 SWEDEN 2023-11-07 43,000 Indcap AB Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2102SPAIN 2023-11-13 1,000 TRACTAMENT D'AIGUES TEIA, S.L. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2101 ROMANIA 2023-11-03 3,000 OTP BANK ROMANIA SA Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2100SPAIN 2023-11-06 400 Private individual Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-2099 SPAIN 2023-11-06 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2098SPAIN 2023-11-06 200,000 DIGI SPAIN TELECOM, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2097 SPAIN 2023-11-07 70,000 THE BEE LOGISTICS, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2096SPAIN 2023-11-06 240 Private individual Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2095 ITALY 2023-09-28 5,000 Physician Art. 5 (1) a), c), f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-2094SPAIN 2023-11-03 600 Hotel Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2093 SPAIN 2023-10-18 600 FESTINA LOTUS S.A. Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-2092SPAIN 2023-10-18 2,000 UNIQUE HOTEL APARTMENT S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2091 SPAIN 2023-10-20 800,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A. Art. 25 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2090SPAIN 2023-10-31 180 Private individual Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2089 ROMANIA 2023-10-27 500 Homeowners Association Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2088ROMANIA 2023-10-25 1,000 SC Spark Car Sharing SRL Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR Non-compliance with general data processing principles
ETid-2087 ITALY 2023-07-18 75,000 Università Telematica E-Campus Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 130 Codice della privacyNon-compliance with general data processing principles
ETid-2086ROMANIA 2023-10-24 3,000 Mensajero SRL Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2085 ITALY 2023-09-14 42,000 Intesa Sanpaolo Spa Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2084ITALY 2023-08-31 10,000 Mednow Medical Center di Giugni Marco Art. 5 (1) d), f) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2083 ITALY 2023-08-31 20,000 Bar association Art. 5 GDPR, Art. 2-octies Codice della privacyNon-compliance with general data processing principles
ETid-2082POLAND 2023-07-18 3,400 Company Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-2081 ROMANIA 2023-10-02 1,000 Cez Vânzare S.A. Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2080ITALY 2023-09-28 30,000 Asl Napoli 3 Sud Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-2079 SPAIN 2023-10-25 500 BILBAO AD INFINITUM, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2078SPAIN 2023-10-30 240 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2077 ITALY 2023-09-28 10,000,000 Axpo Italia Spa Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 24 (2) GDPRNon-compliance with general data processing principles
ETid-2076AUSTRIA 2023-06-16 1,000 Private individual Art. 6 (1), (4) GDPR Insufficient legal basis for data processing
ETid-2075 ITALY 2023-09-14 10,000 San Severo municipality Art. 5 (1) a) GDPR, Art. 6 (1) c), e) GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-2074ROMANIA 2023-10-20 1,000 DANTE INTERNATIONAL SA Art. 6 GDPR Insufficient legal basis for data processing
ETid-2073 ITALY 2023-09-14 10,000 Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb Art. 12 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-2072FRANCE 2023-10-12 600,000 GROUPE CANAL + Art. 7 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. L. 34-5 CPCE Insufficient fulfilment of data subjects rights
ETid-2071 ITALY 2023-09-14 20,000 Shardana Working Soc. Coop. a r.l. Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2070SWEDEN 2023-10-17 30,000 H&M Hennes & Mauritz GBC AB Art. 12 (3) GDPR, Art. 21 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-2069 SPAIN 2023-10-15 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2068ITALY 2023-09-14 90,000 GFB One s.r.l. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 157 Codice della privacy Insufficient legal basis for data processing
ETid-2067 SWEDEN 2023-10-03 70,000 Schockholm School borard Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2066CYPRUS 2023 8,000 Cypriot Ministry of the Interior Art. 5 (1) a), c), f) GDPR Non-compliance with general data processing principles
ETid-2065 SPAIN 2023-10-11 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2064SPAIN 2023-10-11 5,300 Private individual Art. 6 (1) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-2063 CROATIA 2023-10-05 5,470,000 Debt collection company Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 (1) GDPR, Art. 32 (1) b) GDPRInsufficient legal basis for data processing
ETid-2062CROATIA 2023-09-14 30,000 Betting company Art. 6 (1) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPR Insufficient legal basis for data processing
ETid-2061 CROATIA 2023-09-14 20,000 Betting company Art. 6 (1) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPRInsufficient legal basis for data processing
ETid-2060CROATIA 2023-09-26 15,000 Hotel Art. 6 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 32 (1) a), d) GDPR, Art. 32 (4) GDPR, Art. 38 (6) GDPR Insufficient legal basis for data processing
ETid-2059 CROATIA 2023-09-13 25,000 Zagreb Holding d.o.o. Art. 13 (1) c) GDPR, Art. 13 (2) a), e) GDPR, Art. 25 (2) GDPRInsufficient fulfilment of information obligations
ETid-2058SPAIN 2023-10-09 500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2057 SPAIN 2023-10-09 4,000 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2056SPAIN 2023-10-10 1,500 NORDETIA CLINICS MÓSTOLES S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2055 SPAIN 2023-10-10 15,000 ILUNION SEGURIDAD, S.A. Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2054ITALY 2023-07-18 12,000 Azienda Socio Sanitaria Territoriale Ovest Milanese Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2053 POLAND 2023-07-12 2,500 Company Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-2052FINLAND 2023-09-04 1,600 Company Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-2051 ITALY 2023-07-18 400 Private individual Art. 5 (1) a) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-2050CYPRUS 2023 3,000 Breikot Management Ltd Art. 5 (1) c) GDPR, Art. 6 GDPR Non-compliance with general data processing principles
ETid-2049 SPAIN 2023-10-05 500 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2048SPAIN 2023-09-25 17,000 FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA Art. 9 GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-2047 ITALY 2023-08-31 10,000 RCS Mediagroup Spa Art. 5 (1) a), c) GDPR, Art. 2-quater (4) Codice della privacy, Art. 137 Codice della privacy, Art. 139 Codice della privacyNon-compliance with general data processing principles
ETid-2046ROMANIA 2023-09-25 2,000 UAT Comuna Albeni Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-2045 ROMANIA 2023-09-26 25,000 RESTART ENERGY ONE S.A. Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2044FRANCE 2023-09-18 200,000 SAF LOGISTICS Art. 5 (1) c) GDPR, Art. 9 GDPR, Art. 10 GDPR, Art. 31 GDPR Non-compliance with general data processing principles
ETid-2043 SPAIN 2023-09-27 420 CHINA CENTER LLEIDA Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2042SPAIN 2023-09-26 70,000 DIGI SPAIN TELECOM, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2041 SPAIN 2023-09-26 30,000 EUROPA PRESS DE CATALUNYA, S.A. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2040SPAIN 2023-09-25 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2039 HUNGARY 2023-06-22 205,000 Digi Telecommunications and Services Ltd. Art. 5 (1) a) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-2038SPAIN 2023-08-30 140,000 GENERAL LOGISTICS SYSTEMS SPAIN, S.A. Art. 6 GDPR Insufficient legal basis for data processing
ETid-2037 ITALY 2023-07-18 1,000 Prodav srl Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacyNon-compliance with general data processing principles
ETid-2036SPAIN 2023-09-07 70,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2035 SPAIN 2023-09-21 4,000 Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-2034SPAIN 2023-09-21 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2033 ITALY 2023-07-06 10,000 AcegasApsAmga SpA Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-2032IRELAND 2023-09-01 345,000,000 TikTok Limited Art. 5 (1) c), 5 (1) f) GDPR, Art. 12 (1) GDPR, Art. 13 (1) e) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR Non-compliance with general data processing principles
ETid-2031 FINLAND 2023-09-11 23,000 Suomen Yritysrekisteri Art. 12 (1), (2), (6) GDPR, Art. 15 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-2030ROMANIA 2023-09-18 1,000 NN Asigurări de Viață S.A. Art. 21 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-2029 ICELAND 2023-09-06 10,300 University of Iceland Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2028SPAIN 2023-08-30 300 Private individual Art. 6 (1) GDPR Insufficient fulfilment of information obligations
ETid-2027 SPAIN 2023-09-01 300 Private individual Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2026SPAIN 2023-09-05 80,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2025 SPAIN 2023-09-19 600 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2024SPAIN 2023-09-19 1,500 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-2023 ITALY 2023-06-22 1,000,000 Autostrade per l'Italia spa Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 28 GDPRNon-compliance with general data processing principles
ETid-2022ITALY 2023-06-08 300,000 Rinascente S.p.A. Art. 5 (1) a), b), c), e), f) GDPR, Art. 12 (1) GDPR, Art. 32 (1) b), d) GDPR, Art. 35 GDPR Non-compliance with general data processing principles
ETid-2021 SWEDEN 2023-08-28 3,000,000 Trygg-Hansa Art. 5 (1) f) GDPR, Art. 32 (1) GDPRNon-compliance with general data processing principles
ETid-2020SPAIN 2023-08-28 4,800 WALL BOX CHARGERS S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2019 SPAIN 2023-08-29 1,500 ALBEN AIRPORT FACILITIES S.L. Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-2018SPAIN 2023-08-30 180 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-2017 SPAIN 2023-08-30 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-2016SPAIN 2023-08-30 1,500 Private individual Art. 6 (1) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-2015 ITALY 2023-07-18 5,000 Ermeslink di Giovanni Di Stefano Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-2014ITALY 2023-07-18 10,000 Cat s.r.l. Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy Insufficient legal basis for data processing
ETid-2013 ROMANIA 2023-08-21 70,000 Uipath SRL Art. 25 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-2012SPAIN 2023-08-28 500 MULTIGAS ASESORES S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-2011 SPAIN 2023-08-28 10,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2010SPAIN 2023-08-25 1,500 Homeowners' association Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-2009 SPAIN 2023-08-23 300 Private individual Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-2008SPAIN 2023-08-16 5,000 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-2007 SPAIN 2023-08-18 20,000 JOLY DIGITAL, S.L.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-2006ITALY 2023-07-06 5,000 Ristorante Francesco srl Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy Non-compliance with general data processing principles
ETid-2005 SPAIN 2023-08-11 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2004SPAIN 2023-08-16 300 Private individual Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-2003 SPAIN 2023-08-16 600 MÁRMOLES Y GRANITOS MEJIAS, S. L. Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-2002SPAIN 2023-08-11 500 RING RING CLIN S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-2001 SPAIN 2023-08-11 6,000 ADENET SYSTEMS, S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-2000ITALY 2023-06-01 20,000 Azienda Usl Toscana Sud Est. Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR, Art. 25 (1), (2) GDPR, Art. 2-septies (8) Codice della privacy Non-compliance with general data processing principles
ETid-1999 SPAIN 2023-08-02 10,000 GYMOOGIMNASIOS S.L. Art. 5 (1) c) GDPR, Art. 7 GDPRNon-compliance with general data processing principles
ETid-1998SPAIN 2023-08-08 6,000 ODRIA COSTAS INTERNACIONAL, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1997 ITALY 2023-06-01 10,000 Camedi s.r.l. Art. 5 GDPR, Art. 9 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1996SPAIN 2023-08-08 6,000 ELECTRAWORKS - CEUTA, S.A. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1995 GERMANY 2023 215,000 Humboldt Forum Service GmbH UnknownInsufficient legal basis for data processing
ETid-1994ITALY 2023-06-01 20,000 Ew Business Machines S.p.A. Art. 5 (1) a), c) GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy Non-compliance with general data processing principles
ETid-1993 ITALY 2023-06-01 15,000 Thin Srl Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1992SPAIN 2023-07-27 1,200 FONTANORTE, S.L. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1991 SPAIN 2023-07-27 5,000 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1990ITALY 2023-06-07 5,000 Azienda Tutela della Salute della Sardegna Art. 5 GDPR, Art. 9 GDPR, Art. 2-septies Codice della privacy Insufficient legal basis for data processing
ETid-1989 SPAIN 2023-07-27 5,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1988ROMANIA 2023-08-03 2,000 Med Life SA Art. 12 (4) GDPR, Art. 15 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1987 SPAIN 2023-07-31 70,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1986SPAIN 2023-08-01 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1985 SPAIN 2023-08-01 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1984SPAIN 2023-08-01 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1983 SPAIN 2023-08-01 20,000 QUALITY-PROVIDER S.A. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1982POLAND 2023-01-25 4,100 Company Art. 31 GDPR, Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-1981 POLAND 2023-05-31 2,300 Company Art. 31 GDPR, Art. 58 (1) a), e) GDPRInsufficient cooperation with supervisory authority
ETid-1980POLAND 2023-06-02 4,300 Company Art. 31 GDPR, Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-1979 ITALY 2023-06-01 3,000 Comune di Napoli Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1978POLAND 2023-06-21 7,500 Company Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-1977 ITALY 2023-04-14 15,000 Citynews S.p.A. Art. 5 (1) a), c) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-1976ITALY 2023-05-17 10,000 La Gazzetta di Parma S.r.l. Art. 5 (1) a) GDPR Non-compliance with general data processing principles
ETid-1975 GERMANY 2022 Unknown Unknown Art. 6 GDPRInsufficient legal basis for data processing
ETid-1974GERMANY 2022 Fine in three-digit amount Data protection officer Art. 6 GDPR Insufficient legal basis for data processing
ETid-1973 LITHUANIA 2023-04-20 20,000 Company Art. 5 (1) e), f) GDPR, Art. 32 (1) b), d) GDPRNon-compliance with general data processing principles
ETid-1972SPAIN 2023-07-26 600 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1971 SPAIN 2023-07-26 1,200 SERVICIOS E INTERVENCIONES EN EDIFICACION DEL MEDITERRÁNEO, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1970SPAIN 2023-07-25 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1969 SPAIN 2023-07-24 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1968ROMANIA 2023-07-18 3,000 ING Bank NV Amsterdam Sucursala București Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1967 SPAIN 2023-07-12 10,000 Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-1966SPAIN 2023-07-16 300 Private individual Art. 13 GDRP Insufficient fulfilment of information obligations
ETid-1965 IRELAND 2023-06-16 22,500 Irish Departement of Health Art. 5 (1) c) GDPR, Art. 6 (1), (4) GDPR, Art. 9 (1) GDPRNon-compliance with general data processing principles
ETid-1964SPAIN 2023-07-17 10,000 NANDIVALE, S.L Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1963 SPAIN 2023-07-21 720 MADRID TOURISTIC
CAPITAL, S.L.
Art. 13 GDRPInsufficient fulfilment of information obligations
ETid-1962SPAIN 2023-07-18 70,000 DIGI SPAIN TELECOM, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1961 POLAND 2023-05-31 10,600 Company Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR, Art. 33 (1) GDPR, Art. 34 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1960SPAIN 2023-07-20 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1959 SPAIN 2023-07-20 1,000 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1958SPAIN 2023-07-12 48,000 Birou Gas, S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-1957 SPAIN 2023-06-07 1,200 CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L. Art. 21 (4) GDPRInsufficient fulfilment of data subjects rights
ETid-1956SPAIN 2023-06-06 3,000 Private individual Art. 5 (1) f) GDPR, Art. 32 (1) GDPR Non-compliance with general data processing principles
ETid-1955 SPAIN 2023-05-29 300 CBHNOS S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1954SPAIN 2023-03-30 1,800 LISMARTSA, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1953 SPAIN 2023-07-04 25,000 CaixaBank, S.A. Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1952ICELAND 2023-06-27 257,000 Creditinfo Lánstraust hf. Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 8 laga nr. 90/2018, Art. 9 laga nr. 90/2018 Insufficient legal basis for data processing
ETid-1951 ITALY 2023-04-27 4,000 Università degli studi di Cassino e del Lazio Meridionale Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-octies Codice della privacyNon-compliance with general data processing principles
ETid-1950ITALY 2023-05-17 10,000 Santander Consumer Bank S.p.a. Art. 12 (3), (4) GDPR Insufficient fulfilment of data subjects rights
ETid-1949 SPAIN 2023-07-10 300 Private individual Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1948ICELAND 2023-06-27 51,000 eCommerce 2020 ApS Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 8 laga nr. 90/2018, Art. 9 laga nr. 90/2018 Insufficient legal basis for data processing
ETid-1947 SPAIN 2023-05-29 180 CARROZADOS TECAI, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1946ICELAND 2023-06-27 24,000 Almennri innheimtu ehf Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 8 laga nr. 90/2018, Art. 9 laga nr. 90/2018 Insufficient legal basis for data processing
ETid-1945 SPAIN 2023-07-05 1,200 LISMARTSA, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-1944SPAIN 2023-07-07 5,000 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1943 SPAIN 2023-07-07 2,000 KUGELCHEN PROPIERTIES, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1942SPAIN 2023-07-07 15,000 RCL CRUISES LTD Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1941 SPAIN 2023-07-03 56,000 ODAFONE SERVICIOS, S.L.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1940ICELAND 2023-07-03 81,000 Heilsuveru Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 (1) b), d) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1939 SPAIN 2023-07-04 500 EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1938SWEDEN 2023-06-30 25,000 CDON AB Art. 44 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1937 SWEDEN 2023-06-30 1,000,000 Tele2 Sverige Aktiebolag Art. 44 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1936SPAIN 2023-06-30 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1935 ITALY 2023-05-17 60,000 Website operator Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 (1), (2) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 16 GDPR Art. 17 GDPR, Art. 24 GDPR, Art. 25 GDPRNon-compliance with general data processing principles
ETid-1934SPAIN 2023-06-29 1,000 PUNTO ROJO LIBROS, S.L. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-1933 ICELAND 2023-06-28 13,400 Sjúkratyringur Íslands Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1932ITALY 2023-05-17 10,000 Grizzaffi Management Srl Art. 5 (1) a) GDPR, Art. 17 GDPR, Art. 21 GDPR Insufficient fulfilment of data subjects rights
ETid-1931 ITALY 2023-04-27 240,000 Benetton Group S.r.l. Art. 5 (1) c), e) GDPR, Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPRNon-compliance with general data processing principles
ETid-1930ITALY 2023-04-27 2,000 Store owner Art. 5 (1) a) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1929 POLAND 2023-05-16 6,700 Municipality Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1928SWEDEN 2023-06-26 1,100,000 Bonnier News AB Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1927 ITALY 2023-04-13 13,000 Azienda socio sanitaria locale n. 3 di Nuoro Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-1926ITALY 2023-04-13 3,000 Comune di Cogollo del Cengio Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy Insufficient legal basis for data processing
ETid-1925 ITALY 2023-04-27 15,000 Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-1924ITALY 2023-03-23 40,000 La Risorsa Umana.it s.r.l. Art. 5 (1) a), c) GDPR, Art. 13 GDPR, Art. 28 GDPR Non-compliance with general data processing principles
ETid-1923 SPAIN 2023-06-27 1,000 TRC TRUCKS 2020, S.L. Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1922GREECE 2023-05-29 150,000 NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ
Α.Ε.,
Art. 12 (3), (4), (5) GDPR, Art. 15 (1) GDPR, Art. 21 (3) GDPR, Art. 25 (1) GDPR Insufficient fulfilment of data subjects rights
ETid-1921 GREECE 2023-06-12 210,000 Piraeus Bank Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 15 (1) GDPR, Art. 25 (1) GDPRNon-compliance with general data processing principles
ETid-1920ITALY 2023-05-17 10,000 Azienda ULSS 6 Euganea Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1919 ROMANIA 2023-06-27 2,500 Farmacia Ardealul SRL Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1918SPAIN 2023-06-22 90,000 Sociedad Vascongada de Publicaciones, S.A. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1917 SPAIN 2023-06-22 90,000 Corporación de Medios de Extremadura Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1916SPAIN 2023-06-23 180 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1915 ITALY 2023-04-27 239,000 Ama S.p.a. Art. 28 GDPR, Art. 29 GDPR, Art. 32 GDPR, Art. 2-quaderdecies Codice della PrivacyInsufficient legal basis for data processing
ETid-1914ITALY 2023-04-27 176,000 Roma Capitale Art. 5 (1) a), b), c), d), f) GDPR, Art. 9 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 32 GDPR, Art. 2-sexies Codice della privacy, Art. 2-septies Codice della privacy Non-compliance with general data processing principles
ETid-1913 ITALY 2023-05-17 40,000 Volkswagen Leasing GmbH Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1912FRANCE 2023-06-15 40,000,000 CRITEO Art. 7 (1), (3) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 (1) GDPR, Art. 17 (1) GDPR, Art. 26 GDPR Insufficient fulfilment of data subjects rights
ETid-1911 MALTA 2022 65,000 Unknown Art. 5 (1) f) GDPR, Art. 6 (1) GDPR, Art. 9 (1), (2) GDPR, Art. 32 (1) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPRNon-compliance with general data processing principles
ETid-1910MALTA 2023 2,500 Unknown Art. 5 (1) a) GDPR, Art. 12 (1), (3) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 (1), (3) GDPR, Art. 24 (2) GDPR, Art. 38 (1) GDPR Insufficient fulfilment of data subjects rights
ETid-1909 MALTA 2023 5,000 Unknown Art. 5 (1) a), b), c) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-1908POLAND 2023-05-05 2,200 Municipality Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1907 GERMANY 2022 Unknown Physician Art.5 GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-1906LATVIA 2022 Unknown Company Art.5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1905 BELGIUM 2023-06-16 30,000 Belgian Order of Pharmacists Art. 5 (1) a), b), c), d), e) GDPRNon-compliance with general data processing principles
ETid-1904ROMANIA 2023-06-21 1,000 Vodafone Romania SA Art. 15 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1903 SPAIN 2023-06-21 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1902LATVIA 2022 Unknown Unknown Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-1901 LATVIA 2022 Unknown Unknown Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1900SPAIN 2023-06-20 50,000 GRUPO TRANSAHER, SL. Art. 6 GDPR Insufficient legal basis for data processing
ETid-1899 SPAIN 2023-06-20 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1898SPAIN 2023-06-14 70,000 Digi Spain Telecom, S.L.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1897 SPAIN 2023-06-14 70,000 Digi Spain Telecom, S.L.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1896ITALY 2023-04-27 400 Private individual Art. 5 (1) a) GDPR, Art. 6 GDPR Non-compliance with general data processing principles
ETid-1895 ROMANIA 2023-06-15 8,000 Artima S.A. Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1894ROMANIA 2023-06-15 2,000 BRD-Groupe Société Générale S.A. Art. 5 (1) a), b), f) GDPR, Art. 5 (2) GDPR Non-compliance with general data processing principles
ETid-1893 ITALY 2023-04-14 676,956 Sorgenia S.p.a. Art. 5 (2) GDPR, Art. 12 (3) GDPR, Art. 25 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1892ITALY 2023-04-14 237,800 Green Network S.p.A. Art. 5 (2) GDPR, Art. 25 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1891 FRANCE 2023-06-08 150,000 KG COM Art. 5 (1) c), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 82 Loi informatique et libertésNon-compliance with general data processing principles
ETid-1890GERMANY 2022 Unknown Credit agency Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1889 GERMANY 2022 Unknown Job center employee Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1888GERMANY 2022 Unknown Job center employee Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1887 GERMANY 2022 500 Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-1886GERMANY 2022 8,900 Company Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1885 GERMANY 2022 50,000 Company Art. 15 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-1884SPAIN 2023-06-14 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1883 SPAIN 2023-06-14 400 Unknown Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1882SPAIN 2023-06-13 70,000 DIGI SPAIN TELECOM, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1881 SPAIN 2023-06-13 70,000 DIGI SPAIN TELECOM, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1880SPAIN 2023-06-09 70,000 DIGI SPAIN TELECOM, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1879 SPAIN 2023-06-08 180 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1878SPAIN 2023-06-07 400 LEADDESK, S.L Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-1877 SPAIN 2023-06-16 2,000 Unknown Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1876SWEDEN 2023-06-12 4,900,000 Spotify Art. 12 (1) GDPR, Art. 15 (1), (2) GDPR Insufficient fulfilment of data subjects rights
ETid-1875 SPAIN 2023-05-17 50,000 FUSIONA SOLUCIONES ENERGÉTICAS, S.A. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1874SPAIN 2023-05-23 70,000 Digi Spain Telecom, S.L.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1873 SPAIN 2023-06-06 70,000 Digi Spain Telecom, S.L.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1872SPAIN 2023-06-07 84,000 UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1871 ITALY 2023-04-13 7,631,175 TIM S.p.A. Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GPDR, Art. 12 (2), (3) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 (1) GDPR, Art. 32 (1) b) GDPRInsufficient legal basis for data processing
ETid-1870GERMANY 2022 Fine amount between EUR 200 and EUR 1000 Unknown Art. 6 GDPR Insufficient legal basis for data processing
ETid-1869 ITALY 2023-03-02 50,000 H&M Hennes & Mauritz s.r.l. EUR 50,000 Art. 5 (1) a) GDPR, Art. 114 Codice della privacyNon-compliance with general data processing principles
ETid-1868GERMANY 2022 Unknown Sports photography company Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1867 GERMANY 2022 Unknown Restaurant operator Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1866GERMANY 2022 Unknown Private individual Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1865 SPAIN 2023-05-31 500 Website operator Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1864SPAIN 2023-06-05 10,000 ALPA 57 PRODUCCIONES Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1863 SPAIN 2023-06-07 20,000 RCI BANQUE, S.A. SUCURSAL EN ESPAÑA Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-1862SPAIN 2023-06-01 42,000 PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1861 SPAIN 2023-06-02 20,000 QUALITY-PROVIDER S.A. Art. 6 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-1860SPAIN 2023-06-06 56,000 VODAFONE ONO, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1859 CROATIA 2023-05-18 380,000 Sports betting operator Art. 6 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1) a), d) GDPRInsufficient legal basis for data processing
ETid-1858SPAIN 2023-06-02 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1857 ROMANIA 2023-06-06 3,000 S.C. Apollo Salon S.R.L. Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-1856GERMANY 2023-05-31 300,000 Deutsche Kreditbank Art. 5 (1) a) GDPR, Art. 15 (1) h) GDPR, Art. 22 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1855 SPAIN 2023-05-17 900 WILLOUGHBY COLLEGE, S.A Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1854SPAIN 2023-05-24 3,000 NORDETIA CLINICS IBERIA, S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-1853 SPAIN 2023-05-24 10,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1852SPAIN 2023-05-25 480 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1851 SPAIN 2023-05-25 600 Private individual Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1850ROMANIA 2023-05-23 1,000 Global Baby Brand SRL Art. 7 GDPR Insufficient legal basis for data processing
ETid-1849 ROMANIA 2023-05-18 18,000 AUTOMOBILE BAVARIA SRL Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR, Art. 25 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1848ROMANIA 2023-05-16 5,000 Compania Națională Poșta Română S.A. Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1847 ROMANIA 2023-05-12 1,000 NN Asigurări de Viață S.A. Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1846ROMANIA 2023-05-12 1,500 NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A. Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1845 ROMANIA 2023-05-11 11,000 Libra Internet Bank SA Art. 12 (2), (4) GDPR, Art. 15 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-1844IRELAND 2023-05-12 1,200,000,000 Meta Platforms Ireland Limited Art. 46 (1) GDPR Insufficient legal basis for data processing
ETid-1843 MALTA 2020 4,000 Unknown Art. 13 GDPR, Art. 15 GDPR, Regulation 9 S.L 586.01Insufficient fulfilment of data subjects rights
ETid-1842MALTA 2020 20,000 Unknown Art. 13 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1841 MALTA 2020 2,500 Unknown Art. 5 (1) f) GDPR, Art. 32 (1) b) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1840MALTA 2020 2,000 Unknown Art. 32 (1) b) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1839 FRANCE 2023-05-10 5,200,000 Clearview AI UnknownInsufficient cooperation with supervisory authority
ETid-1838MALTA 2020 2,500 Unknown Art. 32 (1) b) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1837 MALTA 2020 2,500 Unknown Art. 32 (1) b) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1836MALTA 2020 5,000 Unknown Art. 5 (1) f) GDPR, Art. 32 (1) b) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1835 MALTA 2022 250,000 Unknown Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1834MALTA 2022 2,500 Unknown Art. 24 (2) GDPR, Art. 32 (1) (b) GDPR, Art. 32 (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1833 BULGARIA 2022 5,000 Trucking company Art. 6 GDPRInsufficient legal basis for data processing
ETid-1832BULGARIA 2022-05-04 500,000 Bulgarian Post EAD Art. 32 (1) b), c), d) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1831 BULGARIA 2022 12,800 Political party Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1830ITALY 2023-03-02 1,000 Razmataz Live s.r.l.. Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 28 GDPR Non-compliance with general data processing principles
ETid-1829 ITALY 2023-03-23 10,000 Informatica Alto Adige Spa Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1828ITALY 2023-03-23 30,000 Bolzano municipality Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1827 SPAIN 2023-05-09 5,000 ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1826SPAIN 2023-05-09 180 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1825 HUNGARY 2022 2,700 Credit institution Art. 6 (1) GDPR, Art. 5 (2) GDPRInsufficient legal basis for data processing
ETid-1824HUNGARY 2023-02-06 80,500 I&S Limited Kft Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR, Art. 13 (1), (2) GDPR, Art. 24 GDPR, Art. 25 GDPR Non-compliance with general data processing principles
ETid-1823 HUNGARY 2022 1,400 Dentist UnknownNon-compliance with general data processing principles
ETid-1822HUNGARY 2022-04-22 8,000 Political party Art. 5 (2) GDPR, Art. 32 (1) a), b) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1821 ITALY 2023-03-09 2,000 Consorzio Concessioni Reti Gas S.c.a.r.l. Art. 5 (1) a),c) GDPR, Art. 12 GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1820SPAIN 2023-04-28 2,000 ASSOCIACIO DE CAÇADORS D'ALZIRA Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1819 CYPRUS 2023-05-02 9,000 NAGA Markets Europe Ltd Art. 5 (1) f) GDPR, Art. 32 (1) b), d) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1818CYPRUS 2023-02-03 3,250 Epic Ltd. Art. 6 (1) GDPR, Art. 24 (1), (2) GDPR, Art. 32 (1) GDPR Insufficient legal basis for data processing
ETid-1817 CYPRUS 2023-01-16 7,000 Πολίτης newspaper Art. 5 (1) c) GDPR, Art. 6 (1) f) GDPRNon-compliance with general data processing principles
ETid-1816CROATIA 2023-05-04 2,265,000 Debt collection agency Art. 6 (1) GDPR, Art. 13 (1) GDPR, Art. 28 (3) GDPR, Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1815 HUNGARY 2022-09-12 80,700 Coin dealer Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 7 (2) GDPR, Art. 12 (1) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1814HUNGARY 2022 1,300 Website operator Art. 5 (1) a) GDPR, Art. 12 (2), (3) GDPR, Art. 31 GDPR Insufficient fulfilment of data subjects rights
ETid-1813 HUNGARY 2022 1,600 Physician Art. 5 (1) a) GDPR, Art. 12 (2) GDPR, Art. 13 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-1812HUNGARY 2022 80,700 Beauty salon Unknown Insufficient legal basis for data processing
ETid-1811 HUNGARY 2022-12-21 8,000 Hotel Art. 5 (1) e) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 31 GDPRInsufficient legal basis for data processing
ETid-1810SPAIN 2023-05-05 2,000 Homeowners' association Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1809 SPAIN 2023-05-05 1,200 FUNDACIÓ PRIVADA UNIVERSITARIA EADA Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1808POLAND 2023-02-08 7,200 Company Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1807 ITALY 2023-03-02 5,000 Private individual Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 130 Codice della privacyInsufficient legal basis for data processing
ETid-1806SPAIN 2023-05-03 200,000 GSMA LTD. Art. 35 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1805 ITALY 2023-03-09 3,000 Aesse S.r.l.s. Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 130 Codice della privacyInsufficient legal basis for data processing
ETid-1804HUNGARY 2023-04-12 253,000 Aldi Unknown Non-compliance with general data processing principles
ETid-1803 SPAIN 2023-05-03 5,000 BANQUETES SANTA ANA, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1802SPAIN 2023-02-22 30,000 DISPLAY CONNECTORS, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1801 SPAIN 2022-11-03 75,000 Burwebs S.L. Art. 5 (1) a), b), e) GDPR, Art. 12 (2) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 30 (1) GDPR, Art. 22 (2) LSSINon-compliance with general data processing principles
ETid-1800ITALY 2023-02-23 300,000 Ediscom S.p.a. Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 14 GDPR, Art. 25 GDPR, Art. 130 Codice della privacy Non-compliance with general data processing principles
ETid-1799 SPAIN 2023-04-28 5,000 INFINITY ECOM S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1798SPAIN 2023-04-28 12,000 ALBERO FORTE COMPOSITE, S.L. Art. 35 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1797 GERMANY 2022 Fine in five-digit amount Aid organization Art. 28 (3) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1796GERMANY 2022 Fine in five-digit amount Operator of a swimming pool Art. 6 (1) c) GDPR Insufficient legal basis for data processing
ETid-1795 GERMANY 2022 Fine in five-digit amount Restaurant operator Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1794GERMANY 2022 Fine in five-digit amount Bank Art. 28 (3) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1793 SPAIN 2023-04-25 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1792SPAIN 2023-04-26 1,000 Website operator Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1791 SPAIN 2023-04-24 70,000 Telefónica Móviles España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1790SPAIN 2023-04-25 70,000 DIGI SPAIN TELECOM, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1789 SPAIN 2023-04-21 25,000 SECURITAS DIREC ESPAÑA, S.A. Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1788AUSTRIA 2022-08-23 25,000 Operator of a public toilet Art. 5 (1) a), b), c) GDPR, Art. 6 (1) f) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-1787 SWEDEN 2023-04-26 17,600 Skåne region Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1786ITALY 2023-03-02 50,000 Azienda sanitaria locale di Bari Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR, Art. 25 (1), (2) GDPR Non-compliance with general data processing principles
ETid-1785 SPAIN 2023-04-20 25,000 KFC RESTAURANTS SPAIN, S.L. Art. 13 GDPR, Art. 37 GDPRInsufficient involvement of data protection officer
ETid-1784ROMANIA 2023-04-24 1,000 Tensa Art Design SA Art. 12 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1783 GERMANY 2022 800 Police officer UnknownInsufficient legal basis for data processing
ETid-1782GERMANY 2022 300 Police officer Unknown Insufficient legal basis for data processing
ETid-1781 GERMANY 2022 7,380 Police officer UnknownInsufficient legal basis for data processing
ETid-1780GERMANY 2022 1,800 Covid-19 test center Art. 5 (1) a), f) GDPR, Art. 6 (1) GDPR Non-compliance with general data processing principles
ETid-1779 GERMANY 2022 16,400 Covid-19 test center Art. 6 (1) GDPR, Art. 33 (1), (5) GDPRInsufficient legal basis for data processing
ETid-1778ITALY 2023-03-09 10,000 Banca Cambiano 1884 S.p.A. Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1777 ROMANIA 2023-04-19 3,000 Partidul Uniunea Salvați România Art. 5 (1) a), b) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1776THE NETHERLANDS 2023-01-19 150,000 Dutch Social Insurance Institution (SVB) Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1775 SPAIN 2023-03-10 40,000 VODAFONE ONO, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1774SPAIN 2023-02-28 800 GUUDJOB WORLDWIDE S.L. Art. 12 GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-1773 SPAIN 2023-04-13 112,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1772SPAIN 2023-04-13 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1771 GREECE 2022-12-19 7,000 ΜΑΡΙΑ ΠΕΔΙΩΤΗ ΚΑΙ ΣΙΑ Ο.Ε. Art. 12 GDPR, Art. 15 GDPR, Art. 31 GDPRInsufficient fulfilment of data subjects rights
ETid-1770ITALY 2023-03-09 1,600 Deca s.r.l. Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1769 HUNGARY 2023-04-04 13,300 Company Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1768SPAIN 2023-03-16 100,000 ORANGE ESPAGNE S.A.U. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1767 GREECE 2023-02-20 40,000 Vodafone Art. 15 GDPR, Art. 33 GDPRInsufficient fulfilment of data breach notification obligations
ETid-1766GREECE 2023-02-02 30,000 Piraeus Bank Art. 5 (1) a), f) GDPR, Art. 33 GDPR, Art. 34 GDPR Non-compliance with general data processing principles
ETid-1765 GREECE 2023-02-02 10,000 Vodafone Art. 5 (1) a), b) GDPR, Art. 6 (1), (4) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1764SPAIN 2023-04-04 10,000 Real Federación Española de Tenis de Mesa Art. 9 (2) GDPR Insufficient fulfilment of information obligations
ETid-1763 ITALY 2022-12-01 2,000 Store owner Art. 5 (1) a) GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1762ITALY 2022-12-15 120,000 Eurosanità S.P.A. Art. 5 GDPR, Art. 9 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1761 ITALY 2023-01-26 5,000 Misterbianco municipality Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1760CZECH REPUBLIC 2022 3,400 Company Unknown Insufficient legal basis for data processing
ETid-1759 POLAND 2023-03-01 11,100 Housing cooperative Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-1758SPAIN 2023-02-28 3,000 CITIZENGO FOUNDATION Art. 7 GDPR Insufficient legal basis for data processing
ETid-1757 SPAIN 2023-02-28 600 ECOMM MOVADGENCY S.L. Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-1756SPAIN 2023-02-28 1,800 WUNSCHURLAUB S.L. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1755 ITALY 2023-01-11 5,000 Azienda Ospedale-Università Padova Art. 5 (1) f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-1754ITALY 2023-01-26 7,000 Azienda Ospedaliera Bianchi Melacrino Morelli Art. 5 GDPR, Art 9 GDPR, Art. 32 GDPR, Art. 75 Codice della privacy Insufficient technical and organisational measures to ensure information security
ETid-1753 HUNGARY 2022-09-26 26,700 TV2 Média Csoport Zrt. Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1752SPAIN 2023-03-17 10,000 NGENIERÍA Y TELECOM JAÉN, S.L. Art. 6 GDPR Insufficient legal basis for data processing
ETid-1751 SPAIN 2023-04-04 84,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A. Art. 6 (1) GDPR, Art. 15 GDPRInsufficient legal basis for data processing
ETid-1750GERMANY 2022 1,400 Covid-19 test center Art. 6 (1) c) GDPR Insufficient legal basis for data processing
ETid-1749 ROMANIA 2023-04-07 3,000 REGENCY COMPANY SRL Art. 5 (1) a), b), c) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-1748SPAIN 2023-03-24 360 ALI MARKET Art. 13 GDPR, Art. 30 GDPR Insufficient fulfilment of information obligations
ETid-1747 LUXEMBOURG 2021-10-27 18,700 Company Art. 37 (7) GDPR, Art. 38 (1), (3) GDPR, Art. 39 (1) b) GDPRInsufficient involvement of data protection officer
ETid-1746SPAIN 2023-03-23 180 Private individual Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1745 GERMANY 2022 2,700 Covid-19 test center Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1744GERMANY 2022 1,000 Covid-19 test center Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-1743 GERMANY 2022 1,000 Physician Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1742GERMANY 2022 Unknown Logistics company Art. 32 (1) GDPR, Art. 33 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1741 GERMANY 2022 Fine in three-digit amount Private individual Art. 5 GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-1740ITALY 2023-03-23 4,000 Azienda socio-sanitaria locale n. 1 di Sassari Art. 5 GDPR, Art. 9 GPDR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1739 ITALY 2023-03-09 3,000 Store owner Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacyNon-compliance with general data processing principles
ETid-1738SPAIN 2023-03-24 1,000 INMARAN ASESORES S.L. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-1737 SPAIN 2023-04-03 300 Private individual Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1736SPAIN 2023-04-03 50,000 20 MINUTOS EDITORA, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1735 SPAIN 2023-04-05 300 Private individual Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1734SPAIN 2023-04-04 18,000 ENFOKA SISTEMAS GLOBALES, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1733 SPAIN 2023-04-03 50,000 ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1732POLAND 2023-02-07 321 Housing association Art. 5 (1) a) GDPR, Art. 28 (1), (3), (9) GDPR, Art. 33 (1) GDPR, Art. 34 (1), (2) GDPR Insufficient fulfilment of data breach notification obligations
ETid-1731 ROMANIA 2023-04-04 3,000 Tensa Art Design SRL Art. 21 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-1730UNITED KINGDOM 2023-04-04 14,500,000 TikTok Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1729 GERMANY 2022 Unknown Supermarket UnknownInsufficient legal basis for data processing
ETid-1728GERMANY 2022 Unknown Medical care center Unknown Insufficient legal basis for data processing
ETid-1727 GERMANY 2022 Fine in three-digit amount Company Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1726GERMANY 2022 Unknown Company Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-1725 GERMANY 2022 Fine in five-digit amount Company Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1724GERMANY 2022 Fine in five-digit amount Company Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1723 GERMANY 2022 Fine in five-digit amount Company Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1722GERMANY 2022 Unknown Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1721 GERMANY 2022 Unknown Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1720GERMANY 2022 Unknown Physician Art. 6 GDPR Insufficient legal basis for data processing
ETid-1719 GERMANY 2022 Unknown Physician Art. 6 GDPRInsufficient legal basis for data processing
ETid-1718GERMANY 2022 Unknown Company Art. 12 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1717 GERMANY 2022 Unknown Physician Art. 12 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-1716SPAIN 2023-03-21 50,000 UNIDAD EDITORIAL INFORMACION GENERAL S.L.U. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1715 SPAIN 2023-03-21 40,000 TITANIA COMPAÑÍA EDITORIAL, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1714SPAIN 2023-03-21 40,000 EDITORIAL DE PRENSA CANARIA, S.A. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1713 SPAIN 2023-03-21 50,000 EL DIARIO DE PRENSA DIGITAL SL. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1712SPAIN 2023-03-21 50,000 DISPLAY CONNECTORS, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1711 SPAIN 2023-03-21 50,000 CONECTA5 TELECINCO, S.A.U. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1710SPAIN 2023-03-21 50,000 DIARIO ABC, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1709 SPAIN 2023-03-21 50,000 LA VANGUARDIA EDICIONES, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1708SPAIN 2023-03-21 50,000 SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1707 LUXEMBOURG 2022-12-13 1,400 Company Art. 12 (1) GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1706LUXEMBOURG 2022-12-13 700 Company Art. 12 (1) GDPR, Art. 13 (1) f) GDPR Insufficient fulfilment of information obligations
ETid-1705 LUXEMBOURG 2022-12-13 2,100 Company Art. 12 (1) GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1704LUXEMBOURG 2022-12-13 2,500 Company Art. 12 (1) GDPR Insufficient fulfilment of information obligations
ETid-1703 LUXEMBOURG 2022-12-13 1,000 Company Art. 12 (1) GDPRInsufficient fulfilment of information obligations
ETid-1702SPAIN 2023-03-21 70,000 CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1701 SPAIN 2023-03-23 70,000 Orange Espagne S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1700ROMANIA 2023-03-27 450 Private individual Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1699 ROMANIA 2023-03-23 5,000 Tehnoplus Industry SRL Art. 5 (1) a), c), e) GDPR, Art. 5 (2) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-1698FRANCE 2023-03-16 125,000 CITYSCOOT Art. 5 (1) c) GDPR, Art. 28 (3) GDPR, Art. 82 Loi informatique et libertés Non-compliance with general data processing principles
ETid-1697 NORWAY 2023-03-08 220,000 Argon Medical Devices Art. 33 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-1696IRELAND 2023-02-27 750,000 Bank of Ireland 365 Art. 5 (1) f) GDPR, Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1695 SPAIN 2023-03-15 136,000 Vodafone España, S.A.U. Art. 6 GDPR, Art. 32 GDPRInsufficient legal basis for data processing
ETid-1694ITALY 2023-01-11 6,000 Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy Insufficient legal basis for data processing
ETid-1693 ITALY 2023-01-26 5,000 Azienda ULSS n.5 Polesana Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GPDRInsufficient technical and organisational measures to ensure information security
ETid-1692SPAIN 2023-03-14 240 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1691 SPAIN 2023-02-27 4,000 Attorney Art. 5 (1) f) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1690SPAIN 2023-03-15 480 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1689 SPAIN 2023-03-16 5,000 Private individual Art. 5 (1) f) GDPR, Art. 32 (1) GDPRNon-compliance with general data processing principles
ETid-1688POLAND 2023-01-19 6,400 Szczecin-Centrum District Court Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1687 ROMANIA 2023-03-16 3,000 Med Life S.A. Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1686ROMANIA 2023-03-16 1,000 Centrul Medical dr. Furtună Dan Art. 32 (1) b) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1685 ROMANIA 2023-03-14 3,000 Tinmar Energy SA Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1684ROMANIA 2023-03-15 4,000 Partidul Uniunea Salvați România Art. 32 (1) a) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1683 ROMANIA 2023-03-15 10,000 Alianța pentru Unirea Românilor Art. 5 (1) c) GDPR, Art. 5 (2) GDPRNon-compliance with general data processing principles
ETid-1682ROMANIA 2023-03-13 2,000 Modaone SRL Art. 12 GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1681 ROMANIA 2023-03-06 3,000 Integral Collection SRL Art. 32 (1) b), c) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1680ROMANIA 2023-03-06 2,250 Finopro IFN SA Art. 32 (1) b), c) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1679 CROATIA Unknown 20,000 Telecommunications company Art. 6 (1) GDPR, Art. 5 (1) d) GDPRInsufficient legal basis for data processing
ETid-1678FINLAND 2023-02-17 440,000 Suomen Asiakastieto Oy Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-1677 IRELAND 2022-12-30 15,000 A&G Couriers Limited T/A Fastway Couriers (Ireland) Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1676SPAIN 2023-02-28 800 EUROPYMES SERVICIOS INTEGRALES S.L. Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-1675 SPAIN 2023-02-28 15,000 GRUPO NORCONSULTING, S.L. Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-1674SPAIN 2023-02-21 300 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1673 SPAIN 2023-02-21 10,000 HERON CITY VALENCIA MANAGEMENT S.L. Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1672SPAIN 2023-02-21 1,500 Private individual Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1671 ITALY 2022-12-15 4,900,000 Edison Energia S.p.A. Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1), (2), (3) GDPR, Art. 21 (2) GDPR, Art. 24 (1), (2) GDPR, Art. 25 (1) GDPRNon-compliance with general data processing principles
ETid-1670ITALY 2022-12-15 30,000 Verizon Connect Italy S.p.A. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR Insufficient legal basis for data processing
ETid-1669 ITALY 2022-10-06 100,000 Veneto region Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1668ITALY 2022-04-28 150,000 Tarento municipality Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 28 GDPR, Art. 35 GDPR Insufficient fulfilment of information obligations
ETid-1667 ITALY 2022-04-28 200,000 Amiu S.p.A. Art. 5 GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 37 GDPRInsufficient legal basis for data processing
ETid-1666IRELAND 2023-01-23 460,000 Centric Health Ltd. Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR Non-compliance with general data processing principles
ETid-1665 SPAIN 2023-02-21 300 PLANET COSTA DORADA SOCIEDAD LIMITADA Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1664SPAIN 2023-02-21 1,200 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1663 SPAIN 2023-02-21 180 SUPER 24H LOS ROSALES, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1662SPAIN 2023-02-21 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1661 SPAIN 2023-02-21 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1660SPAIN 2023-02-21 300 Private individual Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1659 SPAIN 2023-02-21 300 COMANDANCIA DE LLEIDA Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1658SPAIN 2023-02-21 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1657 LUXEMBOURG 2022-07-22 10,000 Company Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1656NORWAY 2023-02-06 900,000 Sats ASA Art. 5 (1) a), e) GDPR, Art. 6 (1) GDPR, Art. 12 (1), (3) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-1655 BELGIUM 2022-08-23 2,500 Company Art. 5 (1) d) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1654ITALY 2022-11-24 4,000 Società Lombarda Sport s.r.l. Art. 5 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-1653 ITALY 2022-10-20 1,400,000 Douglas Italia S.p.a. Art. 5 (1) b), e) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 (2) a) GDPR, Art. 24 GDPR, Art. 25 (1) GDPRNon-compliance with general data processing principles
ETid-1652GERMANY 2022 Unknown Debt collection company Art. 6 (1) GDPR, Art. 14 (1), (2) GDPR Insufficient legal basis for data processing
ETid-1651 GERMANY 2022 500 Restaurant UnknownUnknown
ETid-1650GERMANY 2022 20,000 Company Unknown Unknown
ETid-1649 GERMANY 2022 6,500 Pharmacy Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-1648ITALY 2022-04-07 10,000 Tecnomed Trento s.r.l. Art. 5 (1) a), c) GDPR, Art. 13 GDPR, Art. 29 GDPR, Art. 32 GDPR, Art. 114 Codice della privacy Non-compliance with general data processing principles
ETid-1647 LUXEMBOURG 2022-12-13 1,500 Manager of a real estate co-ownership Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 (3), (4) GDPR, Art. 15 (1) b), c) GDPRInsufficient legal basis for data processing
ETid-1646ITALY 2022-08-05 1,000 Mister Brick S.a.s. Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 24 GDPR Insufficient legal basis for data processing
ETid-1645 HUNGARY 2022-11-15 5,200 News service Art. 6 (1) GDPR, Art. 7 (2), 4) GDPR, Art. 12 GDPRInsufficient legal basis for data processing
ETid-1644ITALY 2022-04-07 15,000 Rebirth s.r.l. Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 114 Codice della privacy, Art. 157 Codice della privacy Insufficient fulfilment of information obligations
ETid-1643 ITALY 2022-04-28 1,500 Direzione Didattica Statale 1° Circolo-Eboli Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacyInsufficient legal basis for data processing
ETid-1642ROMANIA 2023-02-08 5,000 Medijobs Platform SRL Art. 32 (1) b), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1641 ITALY 2022-04-28 3,000 Comune di Monte Sant'Angelo Art. 5 (1) a) GDPR, Art. 6 (1) e) GDPR, Art. 17 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1640ITALY 2022-11-24 3,000 Ordine dei Medici Chirurghi e degli Odontoiatri della Provincia di Cagliari Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy Insufficient legal basis for data processing
ETid-1639 ITALY 2022-10-20 12,000 Comune di Salento Art. 5 (1) a), b), e) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 30 GDPRNon-compliance with general data processing principles
ETid-1638ITALY 2022-05-26 2,000 Store owner Art. 5 (1) a) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1637 ITALY 2022-11-24 1,000 Private individual Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-1636ITALY 2022-12-15 6,000 Comune di Bracciano Art.5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy Insufficient legal basis for data processing
ETid-1635 ITALY 2022-12-15 8,000 Comune di Vicchio Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 (2), (4) GDPRInsufficient legal basis for data processing
ETid-1634ITALY 2022-12-15 5,000 Comune di Borgia Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 (2), (4) GDPR, Art. 37 (7) GDPR Insufficient legal basis for data processing
ETid-1633 ITALY 2023-01-11 2,500 Azienda Sanitaria Locale di Brindisi Art. 12 (3) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1632POLAND 2022-11-30 9,600 PIONIER (law firm) Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-1631 ITALY 2022-11-10 15,000 Poliambulatorio Radiologico 'il Sorriso' S.r.l. Art. 5 GDPR, Art. 13 GDPR, Art. 37 GDPRNon-compliance with general data processing principles
ETid-1630ITALY 2022-10-20 10,000 Italian Archery Federation (FITARCO) Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-octies Codice della privacy Insufficient legal basis for data processing
ETid-1629 ITALY 2022-10-20 900 Istituto di Istruzione Superiore G. Renda di Polistena, Reggio Calabria Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1628SPAIN 2023-02-03 600 HOTEL VILLA SORO, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1627 SPAIN 2023-02-03 500 MIRACLE IBIZA S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1626ITALY 2022-12-15 3,000 Scuola Statale Secondaria di I^ grado 'Bianco-Pascol' Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy Insufficient legal basis for data processing
ETid-1625 CYPRUS 2022 7,500 DW Dynamic Works LIMITED Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1624CYPRUS 2022 5,000 Cypriot Ministry of Defense Art. 24 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1623 CYPRUS 2022 5,000 Cyprus Electricity Authority Art. 5 (1) f) GDPR, Art. 24 (1) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1622CYPRUS 2022 17,000 Bank of Cyprus Public Company Ltd. Art. 5 (1) f) GDPR, Art. 24 (1) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1621 CYPRUS 2022 3,750 PRINTAFORM Ltd. Art. 28 (3) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1620CYPRUS 2022 3,500 Universal Life Insurance Public Co Ltd. Art. 24 (1) GDPR, Art. 28 (1) GDPR Insufficient data processing agreement
ETid-1619 CYPRUS 2022 5,000 DW Dynamic Works LIMITED Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1618CYPRUS 2022 6,000 Hermes Airport Ltd. Art. 24 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1617 GERMANY 2023 9,000 Magdeburg University Hospital Art. 33 GDPRInsufficient fulfilment of data breach notification obligations
ETid-1616ITALY 2022-11-10 6,000 Conservatorio di Musica S. Cecilia di Roma Art. 5 GDPR, Art. 6 GDPR, Art. 38 GDPR, Art. 2-ter Codice della privacy Insufficient legal basis for data processing
ETid-1615 ITALY 2022-11-10 5,000 Cisterna di Latina municipality Art. 5 GDPR, Art. 12 GDPR, Art. 37 GDPRInsufficient fulfilment of data subjects rights
ETid-1614ITALY 2022-10-20 9,000 Azienda Ospedaliero-Universitaria Careggi di Firenze Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GPDR Insufficient technical and organisational measures to ensure information security
ETid-1613 ITALY 2022-10-20 5,000 Fondazione Teatro Regio di Torino Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-1612ITALY 2022-10-06 10,000 Poste Italiane S.p.a. Art. 12 (3), (4) GDPR Insufficient fulfilment of data subjects rights
ETid-1611 ITALY 2022-10-06 3,000 Associazione Rescue Drones Network ODV Art. 12 GDPR, Art. 15 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-1610ITALY 2022-11-24 1,000 STS Di Prisinzano s.r.l Art. 5 (1) a) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1609 SPAIN 2023-01-02 24,000 FACTOR ENERGÍA,
S.A.
Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1608ITALY 2022-12-15 55,000 Azienda Universitaria Giuliano Isontina Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 35 GDPR, Art. 2-sexies Codice della privacy Insufficient legal basis for data processing
ETid-1607 ITALY 2022-12-15 55,000 Azienda Universitaria Friuli Centrale Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 35 GDPR, Art. 2-sexies Codice della privacyInsufficient legal basis for data processing
ETid-1606ITALY 2022-12-15 55,000 Azienda Universitaria Friuli Occidentale Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 35 GDPR, Art. 2-sexies Codice della privacy Insufficient legal basis for data processing
ETid-1605 ROMANIA 2023-02-01 1,000 Tensa Art Design SA Art. 21 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-1604SPAIN 2023-01-31 600 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1603 SPAIN 2023-01-31 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1602SPAIN 2023-01-31 180 Unknown Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1601 ROMANIA 2023-01-31 1,000 Dentist Art. 6 (1) a) GDPR, Art. 9 (2) a) GDPRInsufficient legal basis for data processing
ETid-1600ROMANIA 2023-01-31 1,000 Dent Estet Clinic SA Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-1599 ITALY 2021-09-21 2,000 Istituto Comprensivo - IC Cosenza III “V. Negroni” Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-1598SPAIN 2023-01-25 3,000 CASAL DE L'ESPLUGA DE FRANCOLÍ Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1597 SPAIN 2023-01-25 180 Unknown Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1596SPAIN 2023-01-27 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1595 CROATIA 2022-12-08 2,654 Retailer Art. 27 (2) Croatian Act on the Implementation of the GDPRInsufficient fulfilment of information obligations
ETid-1594CROATIA 2022-12-08 2,654 Jewelry manufacturer Art. 27 (2) Croatian Act on the Implementation of the GDPR Insufficient fulfilment of information obligations
ETid-1593 CROATIA 2022-12-07 1,991 Fish market Art. 27 (2) Croatian Act on the Implementation of the GDPRInsufficient fulfilment of information obligations
ETid-1592CROATIA 2022-12-07 2,654 Retailer Art. 27 (2) Croatian Act on the Implementation of the GDPR Insufficient fulfilment of information obligations
ETid-1591 CROATIA 2022-12-06 1,991 Retailer Art. 27 (2) Croatian Act on the Implementation of the GDPRInsufficient fulfilment of information obligations
ETid-1590CROATIA 2022-12-06 3,185 Retailer Art. 27 (2) Croatian Act on the Implementation of the GDPR Insufficient fulfilment of information obligations
ETid-1589 CROATIA 2022-12-05 3,583 Retailer Art. 27 (1) Croatian Act on the Implementation of the GDPRInsufficient fulfilment of information obligations
ETid-1588CROATIA 2022-12-05 1,991 Betting place Art. 27 (1), (2) Croatian Act on the Implementation of the GDPR Insufficient fulfilment of information obligations
ETid-1587 CROATIA 2022-11-25 1,991 Betting place Art. 27 (2) Croatian Act on the Implementation of the GDPRInsufficient fulfilment of information obligations
ETid-1586CROATIA 2022-11-25 1,991 Company in the hospitality industry Art. 27 (2) Croatian Act on the Implementation of the GDPR Insufficient fulfilment of information obligations
ETid-1585 SPAIN 2022-12-28 2,000 Homeowners Association Art. 6 (1) GDPR, Art. 15 GDPRInsufficient legal basis for data processing
ETid-1584SPAIN 2022-12-28 100,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1583 FINLAND 2022-12-27 122,000 Company Art. 9 GDPRInsufficient legal basis for data processing
ETid-1582SPAIN 2023-01-18 2,000 Private investigator Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1581 SPAIN 2023-01-20 360 TECNO MOTOR LA MUELA, S.L.L Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1580SPAIN 2023-01-20 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1579 SWEDEN 2023-01-17 17,900 Dalarna Region Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1578IRELAND 2023-01-19 5,500,000 WhatsApp Ireland Ltd. Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR Insufficient legal basis for data processing
ETid-1577 ROMANIA 2023-01-18 1,000 Dante Internațional SA Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-1576SPAIN 2023-01-16 40,000 Thomas International Systems, S.A. Art. 9 GDPR Insufficient legal basis for data processing
ETid-1575 ITALY 2022-12-01 20,000 Amazon Italia Logistica s.r.l. Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1574ITALY 2022-12-01 6,000 A.R.N.A.S. Civico Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy Insufficient legal basis for data processing
ETid-1573 ITALY 2022-12-01 3,000 Store owner (Woolen) Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacyInsufficient fulfilment of information obligations
ETid-1572SPAIN 2023-01-16 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1571 SPAIN 2023-01-16 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1570POLAND Unknown 960 Unknown Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-1569 POLAND 2022-08-30 6,800 TIMSHEL Sp. z o.o. Art. 58 (1) e) GDPRInsufficient cooperation with supervisory authority
ETid-1568POLAND 2022-03-23 490 Unknown Art. 31 GDPR, Art. 58 (1) e) GDPR Insufficient cooperation with supervisory authority
ETid-1567 POLAND 2022-08-31 1,450 Unknown Art. 31 GDPR, Art. 58 (1) a), e) GDPRInsufficient cooperation with supervisory authority
ETid-1566GREECE 2023-01-13 50,000 Intellexa SA Art. 31 GDPR Insufficient cooperation with supervisory authority
ETid-1565 FINLAND 2022-12-13 750,000 Alektum Oy Art. 12 (3) GDPR, Art. 15 (1), (3) GDPRInsufficient fulfilment of data subjects rights
ETid-1564IRELAND 2022-12-22 100,000 VIEC Limited Art. 5 (1) f) GDPR, Art. 32 (1) GDPR Non-compliance with general data processing principles
ETid-1563 LITHUANIA 2023-01-09 6,000 Praktiškas UAB Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 30 (1), (3) GDPR, Art. 35 (1), (3) GDPRInsufficient legal basis for data processing
ETid-1562ITALY 2022-12-01 6,000 Store owner (Joy Unique Collection) Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy Insufficient fulfilment of information obligations
ETid-1561 SPAIN 2022-12-29 24,000 SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1560SPAIN 2022-12-28 300 Store owner Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1559 SPAIN 2022-12-28 600 Homeowners Association Art. 6 (1) e) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-1558SPAIN 2023-01-09 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1557 SPAIN 2023-01-10 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1556SPAIN 2023-01-10 120 Homeowners Association Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1555 SPAIN 2023-01-12 3,000 SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1554SPAIN 2023-01-13 1,000 EDITORIAL RIBADEO S.L. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-1553 ITALY 2022-11-10 10,000 I-Model s.r.l. Art. 6 (1) GDPR, Art. 17 GDPRInsufficient legal basis for data processing
ETid-1552ROMANIA 2023-01-12 2,000 BRISTOL LOGISTICS SA Art. 32 (1) b) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1551 SPAIN 2022-12-29 3,000 ADENET SYSTEMS, S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1550SPAIN 2022-12-28 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1549 SPAIN 2023-01-03 3,000 Transport Workers' Union of Aragon Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-1548SPAIN 2022-12-28 400 MAE WEST SYSTEMS, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1547 SPAIN 2022-12-28 300 Homeowners Association Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1546ROMANIA 2023-01-04 3,000 Apă Canal Ilfov SA Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1545 ROMANIA 2023-01-03 500 Homeowners Association Art. 5 (1) e) GDPRNon-compliance with general data processing principles
ETid-1544ITALY 2022-11-10 5,000 Cisterna di Latina Municipality Art. 5 GDPR, Art. 12 GDPR, Art. 37 GDPR Non-compliance with general data processing principles
ETid-1543 IRELAND 2023-01-04 390,000,000 Meta Platforms Ireland Limited Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPRNon-compliance with general data processing principles
ETid-1542ITALY 2022-11-10 20,000 Sportitalia Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 30 (1) c) GDPR Non-compliance with general data processing principles
ETid-1541 ITALY 2022-11-24 1,000,000 Areti spa Art. 5 (1) d), e) GDPR, Art. 5 (2) GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 24 GDPRNon-compliance with general data processing principles
ETid-1540ROMANIA 2022-12-27 3,000 Kaufland Romania SCS Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1539 ROMANIA 2022-12-22 10,000 SUDREZIDENȚIAL Broker S.R.L. Art. 32 (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1538ITALY 2022-11-10 4,000 Villafranca di Verona municipality Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy Non-compliance with general data processing principles
ETid-1537 ITALY 2022-12-01 100,000 Lazio Region Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 113 Codice della privacy, Art. 114 Codice della privacyInsufficient legal basis for data processing
ETid-1536SPAIN 2022-12-20 3,000 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1535 SPAIN 2022-12-20 2,000 Property owner administrative board Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-1534SPAIN 2022-12-20 1,000 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1533 SPAIN 2022-12-15 30,000 ORANGE ESPAGNE, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1532SPAIN 2022-12-15 16,000 HOSPITAL RECOLETAS PONFERRADA, S.L. Art. 6 (1) GDPR, Art. 15 GDPR Insufficient legal basis for data processing
ETid-1531 ROMANIA 2022-12-15 5,000 Societatea Energetică Electrica S.A. Art. 28 (3) a) GDPRInsufficient data processing agreement
ETid-1530SPAIN 2022-12-13 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1529 SPAIN 2022-12-13 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1528ITALY 2022-10-20 7,000 I.S.P.R.O. Art. 5 (1) f) GDPR, Art. 9 GDPR Non-compliance with general data processing principles
ETid-1527 FRANCE 2022-12-08 300,000 FREE SAS Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient fulfilment of data subjects rights
ETid-1526FINLAND 2022-12-09 230,000 Viking Line Oy Abp Art. 5 (1) a), d) GDPR, Art. 12 (3) GDPR, Art. 13 GDPR, Art. 15 (1) GDPR, Art. 25 (1) GDPR Non-compliance with general data processing principles
ETid-1525 SPAIN 2022-12-13 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1524PORTUGAL 2022-11-02 4,300,000 Portuguese National Statistical Institute Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 28 (1), (6), (7) GDPR, Art. 35 (1), (2), (3) b) GDPR, Art. 44 GDPR, Art. 46 (2) GDPR Non-compliance with general data processing principles
ETid-1523 SPAIN 2022-12-09 120 Private individual Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1522SPAIN 2022-12-09 8,000 Notary Art. 6 GDPR Insufficient legal basis for data processing
ETid-1521 SPAIN 2022-12-09 480 Private individual Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-1520ROMANIA 2022-12-09 2,000 Casa Rusu S.R.L. Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1519 IRELAND 2022-01-26 5,000 Slane Credit Union Ltd. Art. 5 (1) f) GDPR, Art. 24 GDPR, Art. 28 (1), (3) GDPR, Art. 30 (1) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1518SPAIN 2022-11-25 5,000 Association for the prevention and study of crimes, abuses and negligence in information technology and advanced communications (APEDANICA) Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1517 SPAIN 2022-11-25 1,800 ALPA 57 PRODUCCIONES, S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1516SPAIN 2022-12-02 3,600 Federation of Sports for People with Intellectual Disabilities of Castilla la Mancha-FECAM Art. 9 (2) a) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-1515 SPAIN 2022-12-02 3,500 CASA 7 PERSONAL SHOPPER, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-1514ITALY 2022-11-10 40,000 Azienda Usl Valle d'Aosta Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1513 ITALY 2022-09-15 40,000 FCA Italy S.p.A. Art. 12 (1), (2), (3), (4) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1512ITALY 2022-10-06 10,000 Codess Sociale, Soc. Coop. sociale. Art. 12 (3), (4) GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-1511 ITALY 2022-10-06 2,000,000 Alpha Exploration Art. 5 (1) a), e), f) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 27 (4) GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-1510SPAIN 2022-12-03 300 Homeowners Association Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1509 SPAIN 2022-12-03 600 LORENT 2013, S.L Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1508SPAIN 2022-12-03 3,000 INDECEMI, S.L. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1507 SPAIN 2022-11-29 3,000 Company Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-1506FRANCE 2022-11-24 600,000 ÉLECTRICITÉ DE FRANCE Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. L. 34-5 CPCE Insufficient fulfilment of data subjects rights
ETid-1505 ITALY 2022-11-10 500,000 Vodafone Italia S.p.A. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 130 (1), (2), (3) Codice della privacyNon-compliance with general data processing principles
ETid-1504SPAIN 2022-11-29 500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1503 ROMANIA 2022-11-25 3,000 OTP LEASING ROMANIA IFN SA Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1502IRELAND 2022-11-25 265,000,000 Meta Platforms Ireland Limited Art. 25 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1501 ROMANIA 2022-11-24 1,000 Medicover S.R.L. Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1500ROMANIA 2022-11-21 20,000 ING Bank NV Amsterdam Sucursala București Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1499 SPAIN 2022-11-21 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1498PORTUGAL 2022-11-02 180,000 Setúbal municipality Art. 5 (1) e), f) GDPR, Art. 13 (1), (2) GDPR, Art. 37 (1), (7) GDPR Non-compliance with general data processing principles
ETid-1497 ROMANIA 2022-11-18 300 Homeowners Association Bld. Pipera 1-2E Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1496FRANCE 2022-11-10 800,000 DISCORD INC. Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 25 (2) GDPR, Art. 32 GDPR, Art. 35 GDPR Non-compliance with general data processing principles
ETid-1495 ROMANIA 2022-11-16 28,000 Raiffeisen Bank SA Art. 25 (1) GDPR, Art. 32 (1), (2), (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1494POLAND 2022-11-02 1,700 Mayor Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1493 HUNGARY 2022-08-11 197,000 AMPLIFON Hungary Trade and Service Provider LLC Art. 5 (1) b) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 14 GDPRNon-compliance with general data processing principles
ETid-1492SPAIN 2022-11-15 80,000 BANKINTER, S.A. Art. 5 (1) f) GDPR, Art. 32 (1) GDPR Non-compliance with general data processing principles
ETid-1491 SPAIN 2022-11-11 3,600 XASTRE DO PETO, S.L. Art. 6 (1) GDPR, Art. 13 GDPR, Art. 21 GDPRInsufficient legal basis for data processing
ETid-1490SPAIN 2022-11-11 48,000 Banco Bilbao Vizcaya Argentaria S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1489 SPAIN 2022-11-10 900 Homeowners Association Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1488SPAIN 2022-11-10 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1487 SPAIN 2022-11-03 70,000 UNITED PARCEL SERVICE ESPAÑA LTD Y COMPAÑIA SRC Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-1486SPAIN 2022-10-31 525,000 TECHPUMP SOLUTIONS S.L. Art. 5 (1) a), b), e) GDPR, Art. 6 (1) GDPR, Art. 8 GDPR, Art. 12 (1), (2) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 30 (1) GDPR, Art. 22 (2) LSSI Non-compliance with general data processing principles
ETid-1485 SPAIN 2022-11-02 2,000 Rapido Finance, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1484SPAIN 2022-11-02 5,000 CÍTRICOS TANTA, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1483 ITALY 2022-08-05 1,000 Colosseo S.r.l. Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 24 GDPRInsufficient fulfilment of data subjects rights
ETid-1482ROMANIA 2022-11-09 1,000 SC Das Sense Society SRL Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-1481 ROMANIA 2022-11-08 5,000 SC Prestige Media PHG SRL Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1480SPAIN 2022-10-31 56,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1479 ROMANIA 2022-11-07 2,000 Romanian Post Art. 32 (1) b), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1478SPAIN 2022-11-02 25,000 CAIXABANK S.A. Art. 16 GDPR Insufficient fulfilment of data subjects rights
ETid-1477 SPAIN 2022-10-31 70,000 BANCO BILBAO VIZCAYA ARGENTARIA, S.A. Art. 5 (1) b) GDPR, Art. 5 (1) f) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-1476SPAIN 2022-10-31 2,000 Private individual Art. 6 GDPR Insufficient legal basis for data processing
ETid-1475 SPAIN 2022-09-01 10,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1474SPAIN 2022-09-23 1,200 URBANO DIVERTIA, S.L. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1473 ITALY 2022-06-16 20,000 Deutsche Bank S.p.A. Art. 12 (3) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1472SPAIN 2022-10-25 9,000 EL RACO DEL PIS INVERSIONES S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1471 SPAIN 2022-10-26 10,000 ACKERMANN & SCHWARTZ ATTORNEYS AT LAW SLP Art. 6 (1) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-1470SPAIN 2022-10-17 35,000 OES GLOBAL ENERGY S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1469 ITALY 2022-09-15 3,000 Thiene municipality Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1468SPAIN 2022-10-24 8,000 ADSL HOUSE, S.L. Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD Insufficient fulfilment of data subjects rights
ETid-1467 SPAIN 2022-10-24 400 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1466SPAIN 2022-10-24 240 Company Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1465 ITALY 2022-07-21 20,000 Acqua Novara.VCO S.p.a. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1464ITALY 2022-07-21 5,000 Ginosa municipality Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 2-ter Codice della privacy Insufficient legal basis for data processing
ETid-1463 ITALY 2022-07-21 10,000 Clio S.r.l. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 30 (2) GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1462ITALY 2022-10-06 15,000 Servizio Idrico Integrato S.c.p.a. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1461 UNITED KINGDOM 2022-10-19 5,033,000 Interserve Group Limited Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1460ITALY 2022-09-15 10,000 Bper Banca S.p.A. Art. 12 GDPR Insufficient fulfilment of data subjects rights
ETid-1459 SPAIN 2022-10-20 1,000 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1458GREECE 2022-10-03 20,000 NATIONAL BANK OF GREECE S.A. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1457 GREECE 2022-10-03 20,000 PIRAEUS BANK S.A. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1456GREECE 2022-10-03 20,000 EUROBANK ERGASIAS S.A. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1455 GREECE 2022-10-03 20,000 ALFA BANK S.A. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1454GREECE 2022-09-09 15,000 School Art. 5 (1) a), b) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 30 GDPR Non-compliance with general data processing principles
ETid-1453 GREECE 2022-09-22 3,000 Gas station Art. 12 GDPR, Art. 14 GDPRInsufficient fulfilment of data subjects rights
ETid-1452ITALY 2022-09-15 2,000 Immobiliare Riscostruzione Meloria s.r.l. Art. 5 (1) a) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1451 SPAIN 2022-10-17 6,000 Company Art. 6 GDPRInsufficient legal basis for data processing
ETid-1450ROMANIA 2022-10-18 150 Private individual Art. 6 (1) a) GDPR Insufficient legal basis for data processing
ETid-1449 ROMANIA 2022-10-18 2,000 SC Materiale Constructii Online SRL Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1448FRANCE 2022-10-17 20,000,000 Clearview Al Inc. Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 31 GDPR Insufficient fulfilment of data subjects rights
ETid-1447 SPAIN 2022-10-17 500 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1446SPAIN 2022-10-19 5,000 RESTEXPERIENCE, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1445 ITALY 2022-07-07 20,000 Intesa Sanpaolo Vita S.p.a. Art. 5 (1) a), f) GDPRNon-compliance with general data processing principles
ETid-1444SPAIN 2022-10-17 180 INMUR JOYEROS, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1443 HUNGARY 2022-07-08 1,500 Physician Art. 5 (1) GDPR, Art. 12 (2) GDPR, Art. 13 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-1442ITALY 2022-08-05 20,000 Cosmopol Security S.p.A. Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1441 SPAIN 2022-10-14 12,000 SEAN SERIOS S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1440HUNGARY 2022-10-05 72,500 Bank Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR Insufficient legal basis for data processing
ETid-1439 GREECE 2022-08-08 5,000 IDIKA SA Art. 5 (1) e) GDPR, Art. 25 GDPRNon-compliance with general data processing principles
ETid-1438BELGIUM 2022-08-19 20,000 Medical laboratory Art. 5 (1) f) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 32 GDPR, Art. 35 (1), (3) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1437 GREECE 2022-09-06 5,000 EDYTE SA Art. 29 GDPRInsufficient legal basis for data processing
ETid-1436ROMANIA 2022-09-21 5,000 Curtea Veche Publishing SRL Art. 32 (1) b), c) GDPR, Art. 32 (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1435 ITALY 2022-09-01 4,000 Liceo Statale 'Edoardo Amaldi” Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-1434ROMANIA 2022-10-03 150 Website operator Art. 5 (1) a), f) GDPR, Art. 6 (1) a) GDPR Non-compliance with general data processing principles
ETid-1433 SPAIN 2022-10-04 600 Homeowners Association Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1432SPAIN 2022-10-09 64,000 EVERIS SPAIN S.L Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1431 SPAIN 2022-10-09 6,000 UNION DE OFICIALES DE LA GUARDIA CIVIL PROFESIONAL Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1430SPAIN 2022-10-09 800 Company Art. 6 (1) e) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-1429 SPAIN 2022-10-09 900 Private individual Art. 5 (1) f) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1428ICELAND 2022-05-03 10,600 HEI – Medical Travel Art. 15 (1), (3) GDPR, Art. 9 (1) Act 90/2018, Art. 17 (2) Act 90/2018 Insufficient fulfilment of data subjects rights
ETid-1427 ESTONIA 2020-08-17 56 Health care worker Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1426SPAIN 2022-10-09 24,000 CAJA DE SEGUROS REUNIDOS, COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1425 SPAIN 2022-10-09 4,000 PUNTO BADAL-BCN S.L. Art. 5 (1) f) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1424ITALY 2022-07-07 45,000 Senseonics Inc. Art. 5 (1) a), b), f) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 27 GDPR Non-compliance with general data processing principles
ETid-1423 ITALY 2022-09-15 100,000 Lazio Region Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 24 GDPRNon-compliance with general data processing principles
ETid-1422UNITED KINGDOM 2022-10-04 1,547,000 Easylife Ltd. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 (1) c) GDPR, Regulation 21 PECR Insufficient legal basis for data processing
ETid-1421 SPAIN 2022-10-04 6,000 Club Náutico el Estacio Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1420DENMARK 2021-08-17 20,100 Danish Immigration Agency Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1419 AUSTRIA 2021 600 Private individual Art. 5 (1) a) GDPR, Art. 9 (1), (2) GDPRNon-compliance with general data processing principles
ETid-1418AUSTRIA 2021 Unknown Private individual Art. 5 (1) a), c) GDPR Non-compliance with general data processing principles
ETid-1417 SPAIN 2022-09-28 31,200 BAYARD REVISTAS, S.A. Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1416ITALY 2022-07-21 3,000 Azienda Socio Sanitaria Territoriale Rhodense Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1415 ITALY 2022-07-21 10,000 Stay over s.r.l. Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 114 Codice della privacyInsufficient fulfilment of data subjects rights
ETid-1414ITALY 2022-07-21 2,000 Global Service s.r.l. Art. 5 (1) a) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1413 ITALY 2022-07-28 2,000 Auto Hi-Fi System S.n.c Art. 5 (1) a), c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1412DENMARK 2022-09-12 6,700 Hørsholm municipality Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1411 SPAIN 2022-09-28 720 CLUB NATACIO LLEIDA Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1410SPAIN 2022-09-28 180 Y OTRO MAS C.B. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1409 ROMANIA 2022-09-22 2,000 Bitfactor SRL Art. 25 (1) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1408GERMANY 2022-09-21 5,000 Surveyor Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1407 HUNGARY 2022-09-25 1,200 Health insurance provider Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 12 (3), (4) GDPR, Art. 31 GDPRNon-compliance with general data processing principles
ETid-1406HUNGARY 2022-08-08 735 Company Art. 5 (1) b), c) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1), (2) GDPR Non-compliance with general data processing principles
ETid-1405 POLAND 2022-09-07 530 Sułkowice Cultural Center Art. 28 (1), (3), (9) GDPRInsufficient data processing agreement
ETid-1404SPAIN 2022-09-23 3,000 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1403 ROMANIA 2022-09-19 2,000 Banca Comercială Română SA Art. 25 (1) GDPR, Art. 32 (1) b), d), e) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1402SPAIN 2022-09-20 1,800 Union Sindical Obrera Art. 6 GDPR Insufficient legal basis for data processing
ETid-1401 SPAIN 2022-09-16 2,000 Agent of the real estate agency BARCELONA DREAM HOUSE AGENCY Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1400SPAIN 2022-09-16 3,000 MARIELI GABRIELA, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1399 GERMANY 2022-09-21 50,000 Property development company Art. 6 (1) GDPR, Art. 14 GDPRInsufficient legal basis for data processing
ETid-1398GERMANY 2022-09-20 525,000 Company Art. 38 (6) GDPR Insufficient involvement of data protection officer
ETid-1397 SPAIN 2022-07-15 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1396SPAIN 2022-09-04 1,500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1395 SPAIN 2022-08-28 5,600 SOLIVESA MASTER FRANCHISE S.L. Art. 28 GDPR, Art. 48 (1) b) LGTInsufficient fulfilment of data subjects rights
ETid-1394SPAIN 2022-08-28 48,000 NATURGY ENERGY GROUP, S.A. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1393 ROMANIA 2022-09-08 8,000 Realmedia Network SA Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1392SPAIN 2022-09-16 10,000 SOPHIE ET VOILA, S.L Art. 6 GDPR Insufficient legal basis for data processing
ETid-1391 SPAIN 2022-09-16 480 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1390ITALY 2022-06-16 2,000 Federazione Italiana Nuoto Art. 12 (3), (4) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1389 ITALY 2022-06-30 5,000 Federazione Italiana Sommelier, Albergatori e Ristoratori Art. 5 (1) a), f) GDPR, Art. 6 (1) GDPRNon-compliance with general data processing principles
ETid-1388SPAIN 2022-09-04 360 Store owner Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1387 SPAIN 2022-09-06 20,000 MUXERS CONCEPT, S.L. Art. 6 GDPRInsufficient legal basis for data processing
ETid-1386SPAIN 2022-09-09 180 EURO DONER KEBAB Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1385 ROMANIA 2022-09-09 2,000 SC Raiffeisen Bank SA Art. 5 (1) d) GDPRNon-compliance with general data processing principles
ETid-1384SPAIN 2022-09-09 300 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1383 SPAIN 2022-09-13 2,000 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1382FRANCE 2022-09-13 250,000 GIE INFOGREFFE Art. 5 (1) e) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1381 SPAIN 2022-09-13 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1380NORWAY 2022-08-25 20,000 Recover AS Art. 6 (1) e) GDPR Insufficient legal basis for data processing
ETid-1379 SPAIN 2022-09-01 240 MH VILASECA S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1378SPAIN 2022-08-30 1,700 Bazar Pekin Art. 13 GDPR, Art. 30 GDPR Insufficient fulfilment of information obligations
ETid-1377 ROMANIA 2022-08-29 1,000 Alpha Bank Romania SA Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1376SPAIN 2022-08-28 1,200 DIGITECNIA SOLUTIONS, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1375 SPAIN 2022-08-30 3,000 COLEGIO VILLAEUROPA, S.C.L Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1374SPAIN 2022-08-25 480 SERVICIOS PROFESIONALES LA PARADA S.L. Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1373 IRELAND 2022-09-05 405,000,000 Meta Platforms, Inc. Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 24 GDPR, Art. 25 (1), (2) GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-1372SPAIN 2022-08-30 2,000 Sindicato Intersectorial Trabajadores/as Provincia de Alicante Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1371 ROMANIA 2022-07-07 4,000 E Software Concept SRL Art. 32 (1) b), (2) GDPR, Art. 58 (1) a), e) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1370ROMANIA 2022-08-22 10,000 Enel Energie Muntenia S.A. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1369 ITALY 2022-06-16 70,000 Unicredit S.p.A. Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1368ITALY 2022-06-09 10,000 Cribis Credit Management s.r.l. Art. 5 (1) a), c) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1367 SPAIN 2022-07-07 1,800 FINCAS ARENYS SL Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1366SPAIN 2022-07-12 800 SMART ELECTRIC SOLUTIONS, S.L. Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1365 SPAIN 2022-08-22 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1364SPAIN 2022-08-22 900 UNONO NET 3.0, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1363 GREECE 2022-07-19 20,000 DO VALUE GREECE LOANS & CREDITS CLAIM MANAGEMENT S.A. Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 (2) GDPRInsufficient fulfilment of data subjects rights
ETid-1362GREECE 2022-08-03 30,000 Private Polyclinic and Diagnostic Centre of Pyle Axiou Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1361 FRANCE 2022-08-19 600,000 ACCOR SA Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 32 GDPR, L. 34-5 CPCEInsufficient fulfilment of data subjects rights
ETid-1360SLOVAKIA 2021 40,000 Unknown Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 28 GDPR Non-compliance with general data processing principles
ETid-1359 SLOVAKIA 2021 100 Unknown UnknownUnknown
ETid-1358SLOVAKIA 2021 500 Unknown Art. 31 GDPR Insufficient cooperation with supervisory authority
ETid-1357 SPAIN 2022-07-12 1,600 JOYPAZAR, S.A. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1356SPAIN 2022-07-12 6,000 FREE SUN ENERGY S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1355 SPAIN 2022-07-15 3,600 ECOZONO Y CULTURA, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1354ITALY 2021-04-29 2,000 Santa Ninfa municipality Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) Art. 6 (2) GDPR, Art. 6 (3) b) GDPR GDPR, Art. 2-ter (1), (3) Codice della privacy Insufficient legal basis for data processing
ETid-1353 ITALY 2021-09-16 1,000 Farpa s.r.l. Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 88 GDPR, Art. 114 Codice della privacyNon-compliance with general data processing principles
ETid-1352ISLE OF MAN 2022-07-13 202,000 Manx Care Ltd Art. 5 (1) c), f) GDPR, Art. 5 (2) GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 34 GDPR, Art. 58 GDPR Non-compliance with general data processing principles
ETid-1351 SPAIN 2022-08-16 5,000 RODALI GESTIÓN INMOBILIARIA, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1350GERMANY 2021 Unknown Political organization Unknown Unknown
ETid-1349 GERMANY 2021 Unknown Restaurant Art. 24 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1348GERMANY 2021 Unknown Bank employee Unknown Insufficient legal basis for data processing
ETid-1347 GERMANY 2021 Unknown Unknown UnknownUnknown
ETid-1346GERMANY 2021 Unknown Physician Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1345 GERMANY 2021 Unknown Physician Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1344GERMANY 2021 Unknown Gym owner Unknown Unknown
ETid-1343 GERMANY 2021 Unknown Private individual UnknownUnknown
ETid-1342GERMANY 2021 Unknown Private individual Unknown Unknown
ETid-1341 SPAIN 2022-08-12 180 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1340GERMANY 2021 Unknown Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1339 GERMANY 2021 Fine amount between EUR 100 and EUR 1,000 Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-1338GERMANY 2021 Unknown Unknown Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1337 GERMANY 2021 Unknown Unknown Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1336GERMANY 2021 Unknown Company Art. 25 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1335 GERMANY 2021 16,000 Electronics store Art. 5 (1) c) GDPR, Art. 17 GDPR, Art. 35 (3) GDPRNon-compliance with general data processing principles
ETid-1334SPAIN 2022-08-05 9,000 Prodesspa Decoratius i Pintures , S.L. Art. 6 GDPR Insufficient legal basis for data processing
ETid-1333 SPAIN 2022-08-03 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1332SPAIN 2022-08-08 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1331 ROMANIA 2022-08-09 1,000 Wabag Water Services SRL Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1330DENMARK 2022-08-11 6,700 Lolland municipiality Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1329 SPAIN 2022-08-08 600 Restaurant owner Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1328ROMANIA 2022-08-09 7,000 CDI Transport Intern și Internațional SRL Art. 12 (1) GDPR, Art. 58 (1) a), e) GDPR Insufficient fulfilment of data subjects rights
ETid-1327 ITALY 2021-05-13 20,000 Synlab Med srl Art. 5 (1) a), c) GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacyNon-compliance with general data processing principles
ETid-1326ITALY 2022-08-01 26,000 Policoro municipality Art. 5 (1) a), e) GDPR, Art. 5 (2) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 38 (6) GDPR Non-compliance with general data processing principles
ETid-1325 SPAIN 2022-08-01 9,600 LAST LAP, S.L. Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-1324SPAIN 2022-07-29 3,000 ESTUDIOS EUROPEOS DE POSTGRADO Y EMPRESA, S.L. Art. 5 (1) f) GDPR, Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1323 SPAIN 2022-08-04 2,000 JAÉN SENTIDO Y COMÚN Art. 5 (1) f) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1322ROMANIA 2022-08-04 2,000 Sephora Cosmetics România SA Art. 21 GDPR Insufficient fulfilment of data subjects rights
ETid-1321 NORWAY 2022-08-02 30,200 Krokatjønnvegen 15 AS Art. 6 GDPRInsufficient legal basis for data processing
ETid-1320SPAIN 2022-08-02 42,000 Banco Bilbao Vizcaya Argentaria S.L. Art. 6 GDPR Insufficient legal basis for data processing
ETid-1319 SPAIN 2022-08-01 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1318FRANCE 2022-07-07 175,000 UBEEQO INTERNATIONAL Art. 5 (1) c), e) GDPR, Art. 12 GDPR Non-compliance with general data processing principles
ETid-1317 POLAND 2022-07-06 2,120 University Hospital of the Medical University of Warsaw Art. 33 GDPR, Art. 34 GDPRInsufficient fulfilment of data breach notification obligations
ETid-1316ITALY 2021-09-29 11,000 Territorial Administration of the Government of Genoa Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) Art. 6 (2) GDPR, Art. 6 (3) b) GDPR GDPR, Art. 2-ter (1), (3) Codice della privacy Insufficient legal basis for data processing
ETid-1315 SPAIN 2022-07-26 800 EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-1314SPAIN 2022-07-26 2,500 Homeowners Association Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1313 GERMANY 2022-07-28 900,000 Hannoversche Volksbank Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1312SPAIN 2022-07-26 15,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1311 SPAIN 2022-07-27 300 Private Person Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1310LUXEMBOURG 2022-06-30 1,000 Company Art. 5 (1) a) GDPR, Art. 12 (1), (7) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1309 LUXEMBOURG 2022-06-30 1,000 Company Art. 5 (1) a) GDPR, Art. 12 (1), (7) GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1308SPAIN 2022-07-22 500 CINCON S.C. Art. 13 (2) GDPR Insufficient fulfilment of information obligations
ETid-1307 LUXEMBOURG 2022-06-30 1,400 Company Art. 5 (1) e) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1306LUXEMBOURG 2022-06-22 3,000 Company Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1305 GERMANY 2022-07-26 1,100,000 Volkswagen Art. 13 GDPR, Art. 28 GDPR, Art. 30 GDPR, Art. 35 GDPRInsufficient fulfilment of information obligations
ETid-1304SPAIN 2022-07-22 40,000 ESVETEL, S.L. Art. 28 GDPR, Art. 48 (1) b) LGT Insufficient fulfilment of data subjects rights
ETid-1303 GERMANY 2021 10,100 Car trading group UnknownInsufficient legal basis for data processing
ETid-1302GERMANY 2021 12,500 Energy supplier Unknown Unknown
ETid-1301 GERMANY 2021 12,500 Energy supplier UnknownUnknown
ETid-1300GERMANY 2021 5,000 Private individual Art. 5 (1) a) GDPR, Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1299 ITALY 2022-05-22 12,000 Comune di Napoli Corpo di Polizia Municipale Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 88 GDPR, Art. 113 Codice della privacyInsufficient legal basis for data processing
ETid-1298ITALY 2022-05-26 50,000 Azienda sanitaria universitaria Friuli Occidentale Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1297 ITALY 2022-05-26 70,000 Azienda sanitaria universitaria Friuli Centrale Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1296ITALY 2022-05-12 2,000 Singh Market Art. 5 (1) a) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1295 ITALY 2022-05-26 4,000 Università Agraria di Nettuno Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1294ITALY 2022-05-26 16,000 Region of Tuscany Art. 5 (1) c) GDPR, Art. 6 (1) c) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 2-ter (1), (3) Codice della privacy Insufficient legal basis for data processing
ETid-1293 CROATIA 2022-07-21 285,000 Telecommunications company Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1292CROATIA 2022-07-21 4,000 Car dealership Art. 27 (1) Zakona o provedbi Opće uredbe o zaštiti podataka Insufficient fulfilment of information obligations
ETid-1291 ITALY 2021-03-25 6,000 Convitto Nazionale Statale 'Giordano Bruno' di Maddaloni (boarding school) Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter (1), (3) Codice della privacyInsufficient legal basis for data processing
ETid-1290ITALY 2022-05-12 6,000 Villabate municipality Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 37 (1) a) GDPR, Art. 37 (7) GDPR, Art. 38 (6) GDPR Non-compliance with general data processing principles
ETid-1289 ITALY 2022-05-26 10,000 Afragola municipality Art. 5 (1) a), c) GDPR, Art. 12 (3), (4) GDPR, Art. 2-ter Codice della privacyNon-compliance with general data processing principles
ETid-1288SPAIN 2022-07-18 56,000 BANKINTER, S.A. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1287 SPAIN 2022-07-19 4,000 Bookstore employee Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1286SPAIN 2022-07-19 2,000 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1285 SPAIN 2022-07-19 5,000 Bar owner Art. 5 (1) b) GDPRNon-compliance with general data processing principles
ETid-1284SPAIN 2022-07-19 600 Private individual Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-1283 SPAIN 2022-07-13 132,000 DKV Seguros y Reaseguros, S.A.E. Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1282GERMANY 2021 Fine in six-digit amount Company Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1281 GERMANY 2021 Unknown Police department § 32 Absatz 1 BbgDSGInsufficient legal basis for data processing
ETid-1280GERMANY 2021 Unknown Police department § 32 Absatz 1 BbgDSG Insufficient legal basis for data processing
ETid-1279 GERMANY 2021 Unknown Police department § 32 Absatz 1 BbgDSGInsufficient legal basis for data processing
ETid-1278ITALY 2021-01-27 10,000 City of Rome (Roma capitale) Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) Art. 6 (2) GDPR, Art. 6 (3) b) GDPR GDPR, Art. 2-ter (1), (3) Codice della privacy Insufficient legal basis for data processing
ETid-1277 GERMANY 2021 Fine in four-digit amount Physician Art. 6 GDPRInsufficient legal basis for data processing
ETid-1276GERMANY 2021 Fine in three-digit amount Private individual Art. 6 GDPR Insufficient legal basis for data processing
ETid-1275 GERMANY 2021 Fine in three-digit amount Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-1274ITALY 2022-05-22 7,000 Azienda Socio Sanitaria Territoriale Dei Sette Laghi Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1273 CYPRUS 2022 5,000 Cyprus Judo Federation Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-1272SPAIN 2022-07-01 300 Private Individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1271 ITALY 2022-05-26 2,000 Turkish City Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1270DENMARK 2022-07-14 67,200 SIRIUS (law firm) Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1269 POLAND 2022-07-06 12,450 Głównego Geodetę Kraju Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-1268GREECE 2022-07-13 20,000,000 Clearview Al Inc. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR Non-compliance with general data processing principles
ETid-1267 CYPRUS 2022 1,500 Physician Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-1266CYPRUS 2022-02-04 10,000 Εκδοτικού Οίκου Δίας Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1265 CYPRUS 2022 2,000 Oroklini Municipal Council Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-1264ITALY 2022-05-12 20,000 Bazar di Hu Xiaoyan Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy Insufficient fulfilment of information obligations
ETid-1263 FRANCE 2022-06-23 1,000,000 TotalEnergies Electricité et Gaz France Art. 14 GDPR, Art. 15 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-1262SPAIN 2022-07-06 3,000 ASOCIACIÓN DE AFICIONADOS Y PEQUEÑOS ACCIONISTAS UNIDAD HERCULANA Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1261 SPAIN 2022-07-05 600 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1260SPAIN 2022-07-06 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1259 NORWAY 2022-03-04 195,000 Norwegian Parliament Art. 5 (1) f) GDPR, Art. 32 (1) b), d) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1258ITALY 2022-05-26 100,000 Intesa Sanpaolo S.p.A Art. 5 (1) a), f) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1257 ITALY 2022-05-26 46,000 Azienda Sanitaria Locale Roma Art. 5 (1) c) GDPR, Art. 6 (1) c), d) GDPR, Art. 6 (2), (3) GDPR, Art. 9 (1), (2), (4) GDPR, Art. 2-ter (1), (2) Codice della privacy, Art. 2-septies (8) Codice della privacyInsufficient legal basis for data processing
ETid-1256GREECE 2022-06-20 2,000 WIND Ελλάς Τηλεπικοινωνίες ΑΕΒΕ Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1255 GREECE 2022-06-24 2,000 Parliamentary election candidate Art. 12 GDPR, Art. 11 Law 3471/2006Insufficient fulfilment of data subjects rights
ETid-1254FINLAND 2022-05-09 85,000 Otavamedia Oy Art. 5 (1) c) GDPR, Art. 12 (1), (2), (3), (4), (6) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 25 GDPR Insufficient fulfilment of data subjects rights
ETid-1253 SPAIN 2022-05-24 42,000 Alquiler Seguro SA Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1252SPAIN 2022-07-01 500 Private Individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1251 GREECE 2022-06-29 3,000 Pediatric psychologist Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-1250UNITED KINGDOM 2022-06-09 91,000 Tavistock & Portman NHS Foundation Trust Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1249 SPAIN 2022-06-28 3,000 FLY FUT, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1248ROMANIA 2022-06-30 2,000 Continental Automotive Romania SRL Art. 24 GDPR, Art. 32 (1) d) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1247 SPAIN 2022-06-23 30,000 RADIO TELEVISION MADRID, S.A. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1246SPAIN 2022-06-23 30,000 CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1245 SPAIN 2022-06-28 1,000 Company Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1244HUNGARY 2022-02-08 634,000 Budapest Bank Zrt. Art. 5 (1) a), b) GDPR, Art. 6 (1), (4) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 (1), (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR Insufficient legal basis for data processing
ETid-1243 POLAND 2022-05-31 2,100 Stołeczny Ośrodek dla Osób Nietrzeźwych Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1242ITALY 2022-05-22 3,000 Zito Auto di Gianfranco Zito Art. 5 (1) a), c) GDPR, Art. 114 Codice della privacy Non-compliance with general data processing principles
ETid-1241 DENMARK 2022-06-22 134,000 Gyldendal A/S Art. 5 (1) e) GDPRNon-compliance with general data processing principles
ETid-1240SPAIN 2022-06-24 180 Store owner Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1239 ROMANIA 2022-06-20 7,000 Asociația de Proprietari Aviației Park Art. 5 (1) a), c), e) GDPR, Art. 5 (2) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1238ROMANIA 2022-06-20 1,000 SC Interactions Marketing SRL Art. 32 (1) b) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1237 SPAIN 2022-06-17 1,000 Company Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1236SPAIN 2022-06-16 1,000 SCOTCH CORNER BAR Art. 5 (1) c) GDPR, Art. 58 (2) GDPR Non-compliance with general data processing principles
ETid-1235 ITALY 2022-04-28 70,000 Ospedale San Raffaele s.r.l. Art. 5 (1) f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-1234NORWAY 2022-05-16 14,500 Arbeidstilsynet Art. 6 (1) e) GDPR Insufficient legal basis for data processing
ETid-1233 BELGIUM 2022-06-16 0 SA Rossel & Cie Art. 6 (1) a) GDPR, Art. 7 (1) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient legal basis for data processing
ETid-1232ITALY 2022-04-28 20,000 Nos s.r.l.s. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 14 GDPR Insufficient legal basis for data processing
ETid-1231 SPAIN 2022-06-09 10,000 Private individual Art. 6 GDPRInsufficient legal basis for data processing
ETid-1230ROMANIA 2022-06-15 3,000 S.C. Wine Point S.R.L. Art. 32 (1) b) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1229 GERMANY 2021 Fine in four-digit amount Real estate agent Art. 6 GDPR, Art. 12 GDPRInsufficient legal basis for data processing
ETid-1228ITALY 2022-04-28 40,000 Il Sole 24 Ore S.p.a. Art. 5 GDPR, Art. 9 GDPR, Art. 12 GDPR Insufficient fulfilment of data subjects rights
ETid-1227 ITALY 2022-04-28 2,000 Ekss s.r.l. Art. 5 (1) a) GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1226SPAIN 2022-06-09 600 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1225 GERMANY 2021 Fine in four-digit amount Company UnknownUnknown
ETid-1224GERMANY 2021 Fine in three-digit amount Physician Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-1223 ITALY 2022-04-28 2,000 Comune di Partanna Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1222GERMANY 2021 Unknown Clinic Unknown Insufficient involvement of data protection officer
ETid-1221 GERMANY 2021 Unknown Attorney Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1220GERMANY 2021 Unknown Beverage retailer Unknown Unknown
ETid-1219 GERMANY 2021 Unknown Medical clinic Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1218GERMANY 2021 Unknown Job center employee Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1217 GERMANY 2021 Unknown Job center employee Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1216GERMANY 2021 Unknown Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1215 GERMANY 2021 Unknown Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1214GERMANY 2021 Unknown Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1213 GERMANY 2021 Unknown Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1212GERMANY 2021 Unknown Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1211 GERMANY 2021 Unknown Unknown UnknownUnknown
ETid-1210GERMANY 2021 Unknown Unknown Unknown Unknown
ETid-1209 GERMANY 2021 170 Restaurant Art. 5 (1) b) GDPRNon-compliance with general data processing principles
ETid-1208GERMANY 2021 400 Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1207 GERMANY 2021 600 Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1206GERMANY 2021 500 Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1205 GERMANY 2021 1,800 Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1204ITALY 2022-04-28 2,500 'Isabella Gonzaga' high school Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexties Codice della privacy Insufficient legal basis for data processing
ETid-1203 POLAND 2022-06-06 3,500 Esselmann Technika Pojazdowa Sp. z o.o. Sp. k. Art. 33 GDPRInsufficient fulfilment of data breach notification obligations
ETid-1202SPAIN 2022-06-03 3,000 LODEJU, S.L. Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1201 ROMANIA 2022-06-08 1,500 Wens Experience SRL Art. 28 (2) GDPRInsufficient data processing agreement
ETid-1200SPAIN 2022-06-03 360 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1199 SPAIN 2022-06-03 1,000 Store owner Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1198ROMANIA 2022-06-03 2,000 Kaufland Romania SCS Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1197 ITALY 2022-04-28 50,000 Istituto Nazionale Assicurazione Infortuni sul Lavoro Art. 5 (1) a), f) GDPR, Art. 6 (1) e) GDPR, Art. 9 (2) g) GDPR, Art. 32 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacyInsufficient technical and organisational measures to ensure information security
ETid-1196ITALY 2022-04-28 10,000 Italian Ministry of Defense Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-octies Codice della privacy Insufficient legal basis for data processing
ETid-1195 SPAIN 2022-06-01 300 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1194SPAIN 2022-05-31 1,600 CORON ISLAND SLU Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1193 ITALY 2022-04-28 1,000 Educationest s.r.l. Art. 5 (1) a), e) GDPR, Art. 6 (1) b), c) GDPRInsufficient legal basis for data processing
ETid-1192ITALY 2022-04-07 10,000 E-Mac Professional s.r.l. Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1191 BELGIUM 2022-05-25 50,000 Roularta Media Group Art. 5 (1) e) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 (1), (3) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 24 GDPRInsufficient legal basis for data processing
ETid-1190UNITED KINGDOM 2022-05-18 9,000,000 Clearview Al Inc. Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 35 GDPR Non-compliance with general data processing principles
ETid-1189 FINLAND 2022-04-29 8,300 Telemarketing company Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1188UNITED KINGDOM 2022-03-10 115,000 Tuckers Solicitors LLP Art. 5 (1) a) f) GDPR Non-compliance with general data processing principles
ETid-1187 ITALY 2022-04-07 10,000 Findomestic Banca spa Art. 5 (1) a), c) GDPRNon-compliance with general data processing principles
ETid-1186ITALY 2022-04-07 20,000 Made in Italy s.r.l.s. Art. 6 GDPR, Art. 7 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 130 (3) Codice della privacy, Art. 157 Codice della privacy, Art. 166 (2) Codice della privacy Insufficient legal basis for data processing
ETid-1185 ITALY 2022-04-07 50,000 Palumbo Superyacht Ancona s.r.l. Art. 5 (1) a), e) GDPR, Art. 13 GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 157 Codice della privacy, Art. 166 (2) Codice della privacyInsufficient legal basis for data processing
ETid-1184SPAIN 2022-05-20 2,000 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1183 SPAIN 2022-05-20 1,500 Private individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1182SPAIN 2022-05-20 2,000 Private individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1181 NORWAY 2022-03-15 9,700 Company Art. 6 (1) GDPR, Art. 13 GDPR, Art. 21 GDPRInsufficient legal basis for data processing
ETid-1180ROMANIA 2022-05-24 5,000 MED LIFE S.A. Art. 32 (1) b), (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1179 SPAIN 2022-05-17 42,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1178SPAIN 2022-05-18 600 SCF ZHU, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1177 ITALY 2022-03-10 10,000 Alfa Shipyard s.r.l. Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1176SPAIN 2022-05-18 10,000,000 Google LLC Art. 6 GDPR, Art. 17 GDPR Insufficient legal basis for data processing
ETid-1175 SPAIN 2022-05-17 4,000 INSEKT FOOD S.L. Art. 6 GDPRInsufficient legal basis for data processing
ETid-1174SPAIN 2022-05-17 18,000 RAMONA FILMS, S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-1173 SPAIN 2022-05-17 8,000 TIGERS MARKET, S.L. Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDDInsufficient fulfilment of data subjects rights
ETid-1172SPAIN 2022-05-17 1,500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1171 ROMANIA 2022-05-17 1,500 MAYR MELNHOF PACKAGING ROMANIA S.R.L. Art. 5 (1) b), c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-1170ROMANIA 2022-05-18 5,000 Kredyt Inkaso Investments RO S.A Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 33 GDPR Insufficient legal basis for data processing
ETid-1169 HUNGARY 2022-03-29 1,300 Workshop Art. 5 (1) b), c) GDPR, Art. 6 (1) f) GDPR, Art. 13 (1), (2) GDPRNon-compliance with general data processing principles
ETid-1168SPAIN 2022-05-13 170,000 Mercadona S.A. Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR Insufficient legal basis for data processing
ETid-1167 LUXEMBOURG 2022-02-02 1,000 Café owner Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1166SPAIN 2022-05-11 6,000 Homeowners Association Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1165 SPAIN 2022-05-12 2,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1164SPAIN 2022-05-12 500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1163 ROMANIA 2022-05-12 1,000 LORIS FUEL SHOP SRL Art. 29 GDPR, Art. 32 (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1162SPAIN 2022-05-11 600 Bar owner Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1161 DENMARK 2022-05-12 13,400 Civilstyrelsen Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1160ITALY 2022-04-07 40,000 ISWEB S.p.A. Art. 28 GDPR Insufficient data processing agreement
ETid-1159 ITALY 2022-04-07 40,000 Azienda ospedaliera di Perugia Art. 5 (1) a), f) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 25 GDPR, Art. 30 GDPR, Art. 32 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-1158ITALY 2022-04-26 1,000 ASST di Lodi Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1157 SPAIN 2022-04-28 40,000 Working Capital Management España, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1156SPAIN 2022-05-10 300 Store owner Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1155 SPAIN 2022-05-09 1,200 CONTIMAG INVEST, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1154ICELAND 2022-05-03 36,000 City of Reykjavík Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR Insufficient legal basis for data processing
ETid-1153 SPAIN 2022-04-28 15,000 MEDEROS MOVITEN, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1152SPAIN 2022-05-03 5,000 MISTORE CANARIAS, S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1151 BELGIUM 2022-05-04 10,000 Nationale Maatschappij der Belgische Spoorwegen Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (2) GDPR, Art. 21 (2), (3), (4) GDPRInsufficient legal basis for data processing
ETid-1150ITALY 2022-03-24 10,000 Brav s.r.l. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1149 NORWAY 2022-02-02 30,000 Lillestrøm Municipality Art. 5 GDPR, Art. 6 GDPR, Art. 32 (1) b) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1148ROMANIA 2022-05-04 4,000 Concordia Capital IFN S.A. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1147 SPAIN 2022-04-28 1,500 CAFFE VECCHIO, S.L. Art. 5 (1) f) GDPR, Art. 6 (1) a) GDPRInsufficient legal basis for data processing
ETid-1146CYPRUS 2021-09-17 10,000 Mediterranean Hospital of Cyprus Art. 31 GDPR, Art. 58 (1) a) GDPR Insufficient cooperation with supervisory authority
ETid-1145 ROMANIA 2022-05-03 4,000 Megareduceri TV S.R.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1144SPAIN 2022-04-29 16,000 LABORATORIOS GONZÁLEZ, S.L. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1143 SPAIN 2022-04-29 4,200 CLÍNICA DENTAL SAN FRANCISCO, S.L. Art. 17 GDPR, Art. 21 LSSIInsufficient fulfilment of data subjects rights
ETid-1142SPAIN 2022-04-22 5,600 Physician Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1141 SPAIN 2022-04-27 1,500 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1140SPAIN 2022-04-23 1,200 MOVALIA TRASLADOS, S.L.U. Art. 6 (1) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-1139 SPAIN 2022-04-19 600 DOOR2DOOR SPAIN, S.L. Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-1138HUNGARY 2022-03-02 13,500 Company Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (2) GDPR, Art. 17 (1) b) GDPR Insufficient legal basis for data processing
ETid-1137 GREECE 2022-04-04 5,000 Mayor Art. 5 (1) a) GDPRInsufficient legal basis for data processing
ETid-1136FRANCE 2022-04-15 1,500,000 DEDALUS BIOLOGIE Art. 28 GDPR, Art. 29 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1135 SPAIN 2022-04-18 1,800 Website operator Art. 6 (1) GDPR, Art. 13 GDPR, Art. 22 (2) LSSIInsufficient fulfilment of information obligations
ETid-1134SPAIN 2022-04-18 9,000 JIMBO NETWORKS, S.L. Art. 6 (1) GDPR, Art. 13 GDPR, Art. 22 (2) LSSI Insufficient fulfilment of information obligations
ETid-1133 ITALY 2022-03-10 8,000 Agenzia Regionale per la Tutela dell'Ambiente dell'Abruzzo Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-octies Codice della privacyInsufficient legal basis for data processing
ETid-1132GREECE 2022-04-04 10,000 Piraeus Bank Art. 5 (1) f) GDPR, Art. 33 GDPR, Art. 34 GDPR Non-compliance with general data processing principles
ETid-1131 ITALY 2022-03-10 6,000 Azienda sanitaria provinciale di Caltanissetta Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 37 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1130SPAIN 2022-04-13 8,000 RAMONA FILMS, S.L. Art. 13 GDPR, Art. 22 (2) LSSI Insufficient fulfilment of information obligations
ETid-1129 SPAIN 2022-04-11 150,000 BASER COMERCIALIZADORA DE REFERENCIA, S.A. Art. 6 GDPR, Art. 32 GDPRInsufficient legal basis for data processing
ETid-1128SPAIN 2022-04-18 1,800 FLORAQUEEN FLOWERING THE WORLD S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-1127 ITALY 2022-03-10 10,000 Azienda USL Toscana Centro Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 32 GDPR,Insufficient technical and organisational measures to ensure information security
ETid-1126ROMANIA 2022-04-18 1,000 IKEA România S.R.L. Art. 12 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1125 SPAIN 2022-04-12 500 Homeowners Association Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-1124THE NETHERLANDS 2022-04-07 3,700,000 Dutch Tax and Customs Administration Art. 5 (1) a), b), d), e) GDPR, Art. 6 (1) GDPR, Art. 32 (1) GDPR, Art. 35 (2) GDPR Non-compliance with general data processing principles
ETid-1123 ITALY 2022-02-10 1,500 Studio Colli Aniene Verderocca S.r.l. Art. 12 (3) GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-1122ITALY 2022-02-10 5,000 Arte del vivere S.r.l. Art. 12 GDPR, Art. 17 GDPR, Art. 157 Codice della privacy Insufficient fulfilment of data subjects rights
ETid-1121 BELGIUM 2022-04-01 7,500 Company Art. 5 (1) a) GDPR, Art. 6 (1) f) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 21 GDPR, Art. 28 GDPRInsufficient fulfilment of data subjects rights
ETid-1120ROMANIA 2022-04-07 500 Property owners' association Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-1119 THE NETHERLANDS 2022-02-24 565,000 Dutch Foreign Ministry Art. 13 (1) e) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1118BELGIUM 2022-04-04 20,000 Ambuce Rescue Team Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-1117 BELGIUM 2022-04-04 100,000 Brussels Airport Charleroi Art. 5 (1) a), b) GDPR, Art. 6 (1) c) GDPR, Art. 6 (3) GDPR, Art. 9 (2) i) GDPR, Art. 12 (1) GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) e) GDPR, Art. 35 (1), (7) GDPRInsufficient legal basis for data processing
ETid-1116BELGIUM 2022-04-04 200,000 Brussels Airport Zaventem Art. 5 (1) c) GDPR, Art. 6 (1) e) GDPR, Art. 9 (2) g) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) e) GDPR, Art. 35 (1), (3), (7) b) GDPR Insufficient legal basis for data processing
ETid-1115 IRELAND 2022-04-05 463,000 Bank of Ireland Art. 32 GDPR, Art. 33 GDPR, Art. 34 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1114DENMARK 2022-04-05 1,300,000 Danske Bank Art. 5 (2) GDPR Non-compliance with general data processing principles
ETid-1113 GREECE 2022-03-09 2,000 Foreign language school Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 13 GDPRInsufficient fulfilment of data subjects rights
ETid-1112SWEDEN 2022-03-28 720,000 Klarna Bank AB Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 12 (1) GDPR, Art. 13 (2) f) GDPR, Art. 14 (2) g) GDPR Insufficient fulfilment of information obligations
ETid-1111 ROMANIA 2022-03-28 2,000 Condor SA Art. 32 (1), (2), (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1110ROMANIA 2022-03-25 2,000 Kaufland Romania SCS Art. 15 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1109 CYPRUS 2022-03-21 5,000 English School staff union (ESSA) Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1108CYPRUS 2022-03-22 4,000 English School Cyprus Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1107 GREECE 2022-03-09 2,000 Employer Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 13 GDPRInsufficient fulfilment of data subjects rights
ETid-1106DENMARK 2022-03-25 6,700 Danish National Genome Center Art. 36 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1105 POLAND 2022-01-19 53,000 PIKA Sp. z o.o. Art. 28 (3) c), f) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1104POLAND 2022-01-19 1,000,000 Fortum Marketing and Sales Polska S.A. Art. 5 (1) f) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 28 (1) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1103 GERMANY 2022-03-03 1,900,000 BREBAU GmbH Art. 5 (1) GDPR, Art. 6 (1) GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-1102ITALY 2022-02-10 2,000 Comune di Guidizzolo Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy Insufficient legal basis for data processing
ETid-1101 ITALY 2022-02-10 10,000 Scanshare S.r.l. Art. 28 (2) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1100ITALY 2022-02-10 10,000 Region of Tuscany Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy Insufficient legal basis for data processing
ETid-1099 ITALY 2022-02-10 3,500 Azienda socio sanitaria territoriale Melegnano e della Martesana Art. 5 (1) f) GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-1098ITALY 2022-02-10 20,000,000 Clearview Al Inc. Art. 5 (1) a), b), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR Non-compliance with general data processing principles
ETid-1097 ICELAND 2022-03-08 7,000 Hörpu tónlistar- og ráðstefnuhúss ohf. Art. 5 (1) c) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-1096ROMANIA 2022-03-10 2,000 Operatorul Briza Land S.R.L. Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1095 ITALY 2022-02-10 10,000 Costampress S.p.A. Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-1094IRELAND 2022-03-15 17,000,000 Meta Platforms Ireland Limited Art. 5 (2) GDPR, Art. 24 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1093 CROATIA 2022-03-08 89,250 Retail company (name not available at the moment) Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1092CROATIA 2022-03-08 124,245 Energy company (name not available at the moment) Art. 15 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1091 GERMANY 2020-10-24 200 Private Individual Art. 5 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-1090SPAIN 2022-02-23 1,500 WORLDWIDE CLASSIC CARS NETWORK S.L. Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1089 THE NETHERLANDS 2022-01-14 525,000 DPG Media Magazines B.V. Art. 12 (2) GDPRInsufficient fulfilment of data subjects rights
ETid-1088FINLAND 2021-12-26 5,000 Medical clinic Art. 5 (1) a) GDPR, Art. 12 (1), (2), (3), (4) GDPR, Art. 13 (1), (2) GDPR, Art. 15 (1), (3) GDPR, Art. 25 GDPR Insufficient fulfilment of information obligations
ETid-1087 SPAIN 2022-02-23 1,200 FRUTAS Y VERDURAS LOS CAMPEONES, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1086SPAIN 2022-02-22 3,000 Hotel operator Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1085 POLAND 2022-01-19 117,000 Santander Bank Polska S. A. Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-1084SPAIN 2022-02-22 1,000 MALAGATROM, S.L.U. Art. 58 (2) GDPR Insufficient cooperation with supervisory authority
ETid-1083 ROMANIA 2022-02-22 3,000 IAMSAT Muntenia SA Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-1082ROMANIA 2022-02-22 1,000 Civil law firm 'Sabou, Burz & Cuc' Art. 5 (1) a), b), c), f) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1081 SPAIN 2022-02-21 1,000 Store owner Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1080SPAIN 2022-02-21 1,500 RESTATURANTE FUENTEBRO, S.C. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1079 SPAIN 2022-02-18 2,500 Private person Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1078ITALY 2022-01-27 40,000 T.S.M. s.r.l. Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 157 Codice della privacy, Art. 166 (2) Codice della privacy Insufficient fulfilment of data subjects rights
ETid-1077 GREECE 2022-02-15 30,000 ΛΙΜΕΝΟΣ ΗΡΑΚΛΕΙΟΥ Α.Ε. Art. 12 (1), (2) GDPR, Art. 15 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-1076ITALY 2022-01-27 2,000 Private club 'Ruian' Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-1075 ITALY 2022-01-13 1,000 A.S.L. Napoli 1 Centro Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacyInsufficient legal basis for data processing
ETid-1074SPAIN 2022-02-16 6,000 Private individual Art. 6 (1) a) GDPR Insufficient legal basis for data processing
ETid-1073 SPAIN 2022-02-11 2,000,000 Amazon Road Transport Spain S.L. Art. 6 (1) GDPR, Art. 10 GDPR, Art. 10 LOPDGDDInsufficient legal basis for data processing
ETid-1072ITALY 2022-01-13 1,000 Villa Masi Residenza per anziani Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-1071 SPAIN 2022-02-14 1,600 RECLAMADOR, S.L. Art. 17 GDPR, Art. 21 LSSIInsufficient fulfilment of data subjects rights
ETid-1070NORWAY 2022-02-01 5,000 Etterforsker1 Gruppen AS Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1069 POLAND 2021-12-01 4,000 Pactum Poland Sp. z o.o. Art. 31 GDPR, Art. 58 (1) e) GDPRInsufficient cooperation with supervisory authority
ETid-1068ITALY 2022-01-13 14,000 Azienda sanitaria unica regionale Marche Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 35 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1067 ITALY 2022-01-13 4,000 Medicina & Lavoro s.r.l. Art. 12 (3) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1066ITALY 2021-12-16 1,000 Università Telematica Internazionale Uninettuno Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1065 ITALY 2022-01-13 7,500 Azienda Sanitaria Locale Frosinone Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1064ITALY 2021-12-16 20,000 FCA Italy s.p.a. Art. 12 GDPR Insufficient fulfilment of data subjects rights
ETid-1063 ITALY 2021-12-16 100,000 Ubi Banca spa Art. 5 (1) a), c) GDPRNon-compliance with general data processing principles
ETid-1062SPAIN 2022-02-07 10,000 PINTODIS, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1061 SPAIN 2022-02-04 2,000 Private individual Art. 6 (1) a) GDPRInsufficient legal basis for data processing
ETid-1060SPAIN 2022-02-07 1,000 Cafe operator Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1059 SPAIN 2022-02-01 900,000 TELEFÓNICA MÓVILES ESPAÑA, S.A.U. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-1058SPAIN 2022-02-01 200,000 XFERA MÓVILES, S.A. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1057 SPAIN 2022-02-01 700,000 Orange Espagne S.A.U. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-1056SPAIN 2022-02-01 70,000 ORANGE ESPAÑA VIRTUAL, S.L. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-1055 SPAIN 2022-02-01 3,940,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPR, Art. 5 (2) GDPRNon-compliance with general data processing principles
ETid-1054ITALY 2021-12-17 10,000 ASL Latina Art. 5 (1) f) GDPR, Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-1053 SPAIN 2022-02-04 300,000 SEGURCAIXA ADESLAS, S.A. DE SEGUROS Y REASEGUROS Art. 6 GDPR, Art. 17 GDPR, Art. 28 GDPRInsufficient legal basis for data processing
ETid-1052SPAIN 2022-02-04 900 Private person Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1051 BELGIUM 2022-02-02 250,000 IAB Europe Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 9 (1), (2) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 24 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR, Art. 32 (1), (2) GDPR, Art. 37 GDPRInsufficient legal basis for data processing
ETid-1050GERMANY 2020 Fine amount between EUR 50 and EUR 100 Restaurant Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1049 GERMANY 2020 Fine amount between EUR 50 and EUR 100 Restaurant Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1048GERMANY 2020 Fine amount between EUR 50 and EUR 100 Restaurant Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1047 SPAIN 2022-02-02 2,000 ASESORES DE SEGURIDAD PRIVADA, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1046GERMANY 2020 13,000 Company Art. 26 (2) GDPR Insufficient data processing agreement
ETid-1045 GERMANY 2020 Unknown Company Art. 6 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1044GERMANY 2020 3,000 Restaurant Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1043 GERMANY 2020 Fine amount between EUR 300 and EUR 400 Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1042GERMANY 2020 Fine amount between EUR 300 and EUR 400 Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1041 GERMANY 2020 Fine amount between EUR 300 and EUR 400 Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1040GERMANY 2020 Fine amount between EUR 400 and EUR 600 Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1039 GERMANY 2020 Fine amount between EUR 400 and EUR 600 Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1038GERMANY 2020 Fine amount between EUR 400 and EUR 600 Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1037 GERMANY 2020 400 Police officer Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-1036GERMANY 2020 300 Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1035 GERMANY 2020 10,000 Clearview AI Inc. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-1034GERMANY 2020 Fine in five-digit amount Corporation Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-1033 GERMANY 2020 Fine in three-digit amount Medical assistant Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-1032GERMANY 2020 Fine in four-digit amount Operator of a ballet school Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 (1) GDPR Insufficient legal basis for data processing
ETid-1031 GERMANY 2019-11 5,000 Restaurant Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1030GERMANY 2020 300 Employee at a Covid 19 testing center Art. 5 (1) a) GDPR Non-compliance with general data processing principles
ETid-1029 GERMANY 2020 10,000 Restaurant Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1028GERMANY 2020 Unknown Police officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-1027 ITALY 2021-11-25 200,000 Aimon Srl Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 12 GDPR, Art. 21 GDPRInsufficient legal basis for data processing
ETid-1026ITALY 2021-11-25 400,000 B&T S.p.A. Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR Insufficient legal basis for data processing
ETid-1025 GREECE 2022-01-27 3,200,000 OTE Group Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1024GREECE 2022-01-27 6,000,000 Cosmote Mobile Telecommunications S.A. Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 25 (1) GDPR, Art. 26 GDPR, Art. 28 GDPR, Art. 35 (7) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1023 BELGIUM 2022-01-27 2,800 EU DisinfoLab Art. 5 (1) a), c), f) GDPR, Art. 6 (1) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 30 GDPR, Art. 32 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-1022BELGIUM 2022-01-27 1,200 Researcher Art. 5 (1) a), c), f) GDPR, Art. 6 (1) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-1021 SPAIN 2022-01-31 5,000 INCOPROSOL, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-1020SPAIN 2022-01-31 5,000 Cyrana España General S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-1019 SPAIN 2022-01-31 1,500 Property Owner Community Art. 6 GDPRInsufficient legal basis for data processing
ETid-1018ROMANIA 2022-02-01 1,000 SC Grupex 2000 SRL Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-1017 HUNGARY 2021-12-03 843 Lawyer Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPRInsufficient legal basis for data processing
ETid-1016ITALY 2021-12-16 20,000 Corradi s.r.l. Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 157 Codice della privacy Non-compliance with general data processing principles
ETid-1015 ITALY 2021-12-16 10,000 Centro di Medicina preventiva s.r.l. Art. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 37 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1014SWEDEN 2022-01-26 152,000 Uppsala hospital board Art. 5 (1) f) GDPR, Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-1013 SWEDEN 2022-01-26 28,500 Uppsala regional board Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-1012FINLAND 2021-12-16 52,000 Motor insurance center Art. 5 (1) a), c) GDPR, Art. 25 (2) GDPR Non-compliance with general data processing principles
ETid-1011 FINLAND 2021-12-16 6,500 Travel agency Art. 5 (1) f) GDPR, Art. 17 GDPR, Art. 25 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-1010ITALY 2021-12-02 5,000 Azienda USL di Parma Art. 5 (1) f) GDPR, Art. 9 GDPR Non-compliance with general data processing principles
ETid-1009 IRELAND 2021-12-09 110,000 Limerick City and County Council Art. 13 GDPR, Art. 12 GPDR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-1008SPAIN 2022-01-21 1,200 Property Owner Community Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-1007 SPAIN 2022-01-21 2,000 Website operator Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-1006ROMANIA 2022-01-20 3,000 Kaufland România SCS Art. 15 (3) GDPR Insufficient fulfilment of data subjects rights
ETid-1005 ITALY 2021-12-16 0 Enel Energia S.p.A Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR, Art. 130 (1), (2), (4) Codice della privacyInsufficient legal basis for data processing
ETid-1004SPAIN 2022-01-14 2,400 PHARMA TALENTS, S.L.U. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-1003 LUXEMBOURG 2021-11-09 1,500 Unknown Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1002SPAIN 2022-01-18 15,000 GARLEX SOLUTIONS, S.L. Art. 6 GDPR Insufficient legal basis for data processing
ETid-1001 LUXEMBOURG 2021-12-01 6,800 Unknown Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-1000SPAIN 2022-01-17 1,500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-999 SPAIN 2022-01-17 2,000 MEETING PUERTO C.B. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-998SPAIN 2022-01-14 1,500 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-997 SPAIN 2022-01-18 56,000 VODAFONE ESPAÑA, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-996MALTA 2022-01-17 65,000 C-Planet (IT Solutions) Limited Art. 5 (1) f) GDPR, Art. 6 (1) GDPR, Art. 9 (1), (2) GDPR, Art. 14 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 34 GDPR Insufficient technical and organisational measures to ensure information security
ETid-995 PORTUGAL 2021-12-21 1,250,000 Lisbon City Council Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 9 (1) a) GDPR, Art. 13 (1), (2) GDPR, Art. 35 (3) GDPRInsufficient legal basis for data processing
ETid-994BELGIUM 2021-12-16 75,000 Bank Art. 38 (6) GDPR Insufficient involvement of data protection officer
ETid-993 ITALY 2021-11-25 6,000 Società H San Raffaele Resnati s.r.l. Art. 5 (1) f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-992ITALY 2021-12-02 30,000 Casa di cura Fondazione Gaetano e Piera Borghi s.r.l. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-991 ITALY 2021-12-02 7,000 Società Med Store Saronno s.r.l. Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-990GREECE 2021-12-29 75,000 Greek Ministry of Tourism Art. 13 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 37 GDPR Insufficient technical and organisational measures to ensure information security
ETid-989 SPAIN 2022-01-13 1,500 Private individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-988AUSTRIA 2022-01-14 8,000,000 REWE International AG Unknown Unknown
ETid-987 IRELAND 2021-12-02 60,000 Irish Teacher Council Art. 5 (1) GDPR, Art. 32 (1) GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-986GREECE 2021-12-31 30,000 INFO COMMUNICATION SERVICES Art. 13 GDPR, Art. 14 GDPR, Art. 11 Law 3471/2006 Insufficient fulfilment of information obligations
ETid-985 GREECE 2021-12-31 25,000 PLUS REAL ADVERTISEMENT Art. 13 GDPR, Art. 14 GDPR, Art. 11 Law 3471/2006Insufficient fulfilment of information obligations
ETid-984POLAND 2021-12-09 10,000 Warsaw University of Technology Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-983 SPAIN 2022-01-11 9,000 EDUCANDO JUNTOS SL Art. 6 (1) GDPR, Art. 17 GDPRInsufficient legal basis for data processing
ETid-982SPAIN 2022-01-11 3,000 Property Owner Community Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-981 GREECE 2022-01-05 1,000 Εγνατία Οδός Α.Ε. Art. 12 (3) GDPRInsufficient fulfilment of data subjects rights
ETid-980FRANCE 2021-12-31 60,000,000 Facebook Ireland Ltd. Art. 82 loi Informatique et Libertés Insufficient legal basis for data processing
ETid-979 FRANCE 2021-12-31 60,000,000 Google Ireland Ltd. Art. 82 loi Informatique et LibertésInsufficient legal basis for data processing
ETid-978FRANCE 2021-12-31 90,000,000 Google LLC Art. 82 loi Informatique et Libertés Insufficient legal basis for data processing
ETid-977 ROMANIA 2021-12-06 6,000 Telekom Romania Communications SA Art. 5 (1) d), f) GDPR, Art. 5 (2) GDPR, Art. 17 GDPRNon-compliance with general data processing principles
ETid-976ITALY 2021-11-11 150,000 TIM S.p.A. Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-975 ITALY 2021-12-02 30,000 Ica s.r.l. Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-974NORWAY 2021-12-13 20,000 Elektro & Automasjon Systemer AS Art. 6 (1) f) GDPR Insufficient legal basis for data processing
ETid-973 SPAIN 2021-12-28 2,000 Call shop manager Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-972FRANCE 2021-12-28 300,000 FREE MOBILE Art. 12 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 25 GDPR, Art. 32 GDPR Insufficient fulfilment of data subjects rights
ETid-971 FRANCE 2021-12-28 180,000 SLIMPAY Art. 28 GDPR, Art. 32 GDPR, Art. 34 GDPRInsufficient technical and organisational measures to ensure information security
ETid-970SPAIN 2021-12-28 6,000 REAL CLUB NÁUTICO DE RIBADEO Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-969 SPAIN 2021-12-28 2,000 VENTANAS MAKE YOURSELF, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-968SPAIN 2021-12-16 60,000 Banco Bilbao Vizcaya Argentaria S.A. Art. 6 GDPR Insufficient legal basis for data processing
ETid-967 SPAIN 2021-12-22 5,000 HUBSIDE IBÉRICA S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-966SPAIN 2021-12-22 5,000 Sfam España General s.l. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-965 SPAIN 2021-12-21 6,000 Private individual Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-964SPAIN 2021-12-23 1,500 LA OFICINA BAR Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-963 SPAIN 2021-12-17 4,000 CLUB DEPORTIVO RITMO DE ANDALUCÍA Art. 7 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-962SPAIN 2021-12-21 2,000 FUNDACION ESPANOLA DE MEDICINA ESTETICA Y LONGEVIDAD Art. 7 GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-961 AUSTRIA 2021-08-05 600 Private individual Art. 9 GDPRInsufficient legal basis for data processing
ETid-960NORWAY 2021-12-17 3,900 T. Stene Transport AS Unknown Unknown
ETid-959 SPAIN 2021-12-17 2,000 Online retailer Art. 6 GDPRInsufficient legal basis for data processing
ETid-958SPAIN 2021-12-17 2,000 Private individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-957 GREECE 2021-12-08 30,000 One Way Private Company Art. 28 (3) c) GDPR, Art. 32 (2), (4) GDPR, Art. 11 (1) Νόμος 3471/2006Insufficient technical and organisational measures to ensure information security
ETid-956SPAIN 2021-12-14 50,000 IZA OBRAS Y PROMOCIONES, S.A. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-955 HUNGARY 2021-10-27 13,500 Car importer Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-954DENMARK 2021-12-16 13,450 Municipality of Frederiksberg Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-953 SPAIN 2021-12-16 1,200 Private individual Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-952FINLAND 2021-12-07 608,000 Psykoterapiakeskus Vastaamo Art. 5 (1) f) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR Non-compliance with general data processing principles
ETid-951 AUSTRIA 2021-02-12 3,000 Unknown Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-950NORWAY 2021-12-13 6,300,000 Grindr LLC Art. 6 (1) GDPR, Art. 9 (1) GDPR Insufficient legal basis for data processing
ETid-949 ROMANIA 2021-12-13 2,000 SC Nobiotic Pharma SRL Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-948NORWAY 2021-11-24 98,000 Norwegian State Pension Fund (SPK) Art. 5 (1) c), e) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR Insufficient legal basis for data processing
ETid-947 BELGIUM 2021-12-08 10,000 Unknown Art. 12 (3) GDPR, Art. 14 (1), (2), (3) GDPR, Art. 15 GDPR, Art. 17 (1) c) GDPR, Art. 21 (2) GDPRInsufficient fulfilment of data subjects rights
ETid-946THE NETHERLANDS 2021-11-25 2,750,000 Dutch Minister of Finance Art. 5 (1) a) GDPR, Art. 6 (1) e) GDPR, Art. 8 Wbp Insufficient legal basis for data processing
ETid-945 SPAIN 2021-12-07 24,000 NBQ Technology, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-944SPAIN 2021-12-03 1,000 Store owner Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-943 GERMANY 2019 Fine amount between EUR 350 and EUR 1000 Unknown Art. 6 GDPRInsufficient legal basis for data processing
ETid-942GERMANY 2019 Fine amount between EUR 50 and EUR 800 Unknown Art. 6 GDPR Insufficient legal basis for data processing
ETid-941 GERMANY 2019 500 Unknown Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-940GERMANY Unknown 600 Unknown Art. 6 GDPR Insufficient legal basis for data processing
ETid-939 GERMANY Unknown 300 Unknown Art. 6 GDPRInsufficient legal basis for data processing
ETid-938GERMANY Unknown 50 Unknown Art. 6 GDPR Insufficient legal basis for data processing
ETid-937 SPAIN 2021-11-02 2,000 COOPERA RC SERVICES, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-936SPAIN 2021-11-23 40,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-935 SPAIN 2021-11-23 40,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-934SPAIN 2021-12-02 2,000 IMAGINA FRAN SPORT, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-933 SPAIN 2021-12-01 5,000 INTRODUCTION BUSINESS CAPITAL MEDIA, S.L. Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDDInsufficient fulfilment of data subjects rights
ETid-932ITALY 2021-10-14 8,000 Health Protection Agency of Sardinia (ATS) Art. 5 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-931 ITALY 2021-09-29 2,000 Physician Art. 5 (1) a) GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-930UNITED KINGDOM 2021-11-25 585,000 Cabinet Office Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-929 ITALY 2021-10-28 2,000 Anfiteatro Flavio s.r.l. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-928ITALY 2021-10-28 2,000 OTTO s.r.l. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-927 LITHUANIA 2021-11-29 110,000 UAB Prime Leasing Art. 32 (1) b), d) GDPRInsufficient technical and organisational measures to ensure information security
ETid-926SPAIN 2021-11-30 5,000 ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE Art. 17 (1) GDPR, Art. 21 LSSI Insufficient fulfilment of data subjects rights
ETid-925 SPAIN 2021-11-30 20,000 DAVISER SERVICIOS, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-924SPAIN 2021-11-30 5,000 ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE Art. 17 (1) GDPR, Art. 21 LSSI Insufficient fulfilment of data subjects rights
ETid-923 SPAIN 2021-11-30 1,500 Neighborhood community Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-922SPAIN 2021-11-29 1,000 Restaurant owner Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-921 SPAIN 2021-11-29 4,000 TIGERS MARKET, S.L. Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDDInsufficient fulfilment of data subjects rights
ETid-920LUXEMBOURG 2021-10-27 15,400 Unknown Art. 38 (1), (3) GDPR, Art. 39 (1) a), b) GDPR Insufficient involvement of data protection officer
ETid-919 GREECE 2021-10-14 20,000 ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ Art. 6 GDPR, Art. 12 (2) GDPR, Art. 21 GDPRInsufficient legal basis for data processing
ETid-918SPAIN 2021-11-24 9,000 UNIÓN FINANCIERA ASTURIANA S.A. E.F.C. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-917 ICELAND 2021-11-23 27,200 YAY ehf. Art. 5 GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-916ICELAND 2021-11-23 51,000 Icelandic Ministry of Industry and Innovation Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-915 ROMANIA 2021-11-26 2,000 Valoris Center S.R.L. Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-914SPAIN 2021-11-23 40,000 Vodafone España, SAU Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-913 SPAIN 2021-11-23 3,000 FUENSANTA S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-912SPAIN 2021-11-22 2,000 ANIVERSALIA NETWORKS, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-911 SPAIN 2021-11-22 3,000 Unknown Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-910FRANCE 2021-11-04 400,000 Régie autonome des transports parisiens Art. 5 (1) c) GDPR, Art. 5 (1) e) GDPR, Art. 5 (2) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-909 CYPRUS 2021-11-12 925,000 WS WiSpear Systems Ltd Art. 5 (1) a) GDPRNon-compliance with general data processing principles
ETid-908SPAIN 2021-11-15 40,000 Vodafone España, SAU Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-907 SPAIN 2021-11-22 1,000 Neighborhood community Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-906BULGARIA 2021-10-26 380 Bank Art. 5 (1) b) GDPR Non-compliance with general data processing principles
ETid-905 SPAIN 2021-11-15 30,000 Vodafone España, SAU Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-904SPAIN 2021-11-15 1,000 Private Individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-903 SPAIN 2021-11-15 1,000 Supermarket Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-902THE NETHERLANDS 2021-11-12 400,000 Transavia Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-901 POLAND 2021-10-14 78,000 Bank Millennium S.A Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-900SPAIN 2021-11-12 3,000 AD735 DATA MEDIA ADVERTISING S.L. Art. 58 (1) GDPR Insufficient cooperation with supervisory authority
ETid-899 SPAIN 2021-11-12 1,500 Company Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-898ROMANIA 2021-11-14 2,900 Vodafone România SA Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 3 (1) Law No. 506/2004, Art. 3 (3) a), b) Law No. 506/2004 Insufficient technical and organisational measures to ensure information security
ETid-897 GREECE 2021-10-04 5,000 PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ Art. 21 (3) GDPR, Art. 25 GDPRInsufficient fulfilment of data subjects rights
ETid-896LUXEMBOURG 2021-10-13 18,000 Unknown Art. 37 (7) GDPR, Art. 38 (1), (2) GDPR, Art. 39 (1) b) GDPR Insufficient involvement of data protection officer
ETid-895 LUXEMBOURG 2021-10-13 13,200 Unknown Art. 38 (1) GDPR, Art. 39 (1) b) GDPRInsufficient involvement of data protection officer
ETid-894LUXEMBOURG 2021-10-06 5,300 Unknown Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-893 IRELAND 2021-08-20 1,500 MOVE Ireland Art. 5 (1) f) GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-892ITALY 2021-09-16 5,000 Comune di Montalbano Jonico Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 9 (1), (2), (4) GDPR, Art. 2-ter (1), (3) Codice della privacy, Art. 2-septies (8) Codice della privacy Non-compliance with general data processing principles
ETid-891 ROMANIA 2021-11-01 5,000 S.P.E.E.H. Hidroelectrica S.A. Art. 32 (1) b), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-890ROMANIA 2021-11-01 1,000 IKEA ROMÂNIA SA Art. 32 (1) b), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-889 SPAIN 2021-10-26 40,000 VODAFONE SERVICIOS, S.L.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-888SPAIN 2021-10-26 40,000 VODAFONE SERVICIOS, S.L.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-887 SPAIN 2021-10-26 16,000 SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L. Art. 35 GDPRNon-compliance with general data processing principles
ETid-886SPAIN 2021-10-26 64,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-885 SPAIN 2021-10-25 3,000 MERCEDES GERENCIA, S.L. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-884SPAIN 2021-10-21 3,000,000 CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-883 UNITED KINGDOM 2021-10-18 11,800 HIV Scotland Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-882SPAIN 2021-10-19 2,000 BEEPING FULFILMENT S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-881 SPAIN 2021-10-19 40,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-880ROMANIA 2021-10-21 5,000 Glove Technology SRL Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR Insufficient legal basis for data processing
ETid-879 SPAIN 2021-10-19 70,000 Vodafone España, S.A.U. Art. 21 GDPR, Art. 21 LSSIInsufficient fulfilment of data subjects rights
ETid-878NORWAY 2021-10-18 412,000 Østre Toten municipality Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-877 ITALY 2021-09-16 3,296,326 Sky Italia S.r.l. Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR, Art. 12 (2) GDPR, Art. 14 GDPR, Art. 21 GDPR, Art. 28 GDPR, Art. 29 GDPRInsufficient legal basis for data processing
ETid-876ITALY 2021-09-16 200,000 Bocconi University Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 35 GDPR, Art. 44 GDPR, Art. 46 GDPR, Art. Art. 2-sexies Codice della Privacy Non-compliance with general data processing principles
ETid-875 IRELAND 2021-10-06 Only intention to issue fine Facebook Ireland Limited Art. 5 (1) a) GDPR, Art. 12 (1) GDPR, Art. 13 (1) c) GDPRInsufficient fulfilment of information obligations
ETid-874ITALY 2021-09-16 5,000 Ciechi Ardizzone Gioeni di Catania Art. 5 (1) a), c) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 35 GDPR Non-compliance with general data processing principles
ETid-873 AUSTRIA 2021 1,200,000 Customer loyalty program UnknownUnknown
ETid-872AUSTRIA 2021 4,000,000 Bank Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-871 AUSTRIA 2021-09-28 9,500,000 Austrian Post Art. 12 (2) GDPRInsufficient fulfilment of data subjects rights
ETid-870SPAIN 2021-10-13 40,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-869 ITALY 2021-09-16 5,000 La Prima S.r.l. Art. 5 GDPR, Art. 6 GDPR, Art. 24 GDPR, Art. 25 GDPRInsufficient legal basis for data processing
ETid-868SPAIN 2021-10-11 10,000 MAF.COM ESQUI CLUB Art. 7 GDPR Insufficient legal basis for data processing
ETid-867 SPAIN 2021-10-08 30,000 ORANGE ESPAGNE, S.A.U. Art. 6 (1) a) GDPRInsufficient legal basis for data processing
ETid-866LUXEMBOURG 2021-08-05 135,000 Insurance company Art. 5 (1) f) GDPR, Art. 32 (1) a), b) GDPR, Art. 33 (1), (5) GDPR Insufficient technical and organisational measures to ensure information security
ETid-865 SPAIN 2021-10-05 4,000 CLUB DEPORTIVO SANSUEÑA, S.L. Art. 5 (1) e) GDPR, Art. 6 GDPR, Art. 32 (1) b), d) GDPRInsufficient legal basis for data processing
ETid-864SPAIN 2021-10-04 5,000 CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L. Art. 6 GDPR Insufficient legal basis for data processing
ETid-863 NORWAY 2021-09-21 12,500 Ultra-Technology AS Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-862SPAIN 2021-10-04 1,000 Store owner Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-861 SPAIN 2021-10-04 2,000 Store owner Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-860SPAIN 2021-09-04 1,500 AMPUDIA DIAZ, S.L. Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-859 NORWAY 2021-09-20 75,600 ST. OLAVS HOSPITAL HF Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-858NORWAY 2021-09-20 40,200 Høylandet Municipality Art. 32 (1) b), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-857 DENMARK 2021-09-29 107,000 Danish Cancer Society Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-856SPAIN 2021-09-29 10,000 ACONCAGUA JUEGOS S.A. Art. 37 GDPR Insufficient involvement of data protection officer
ETid-855 SPAIN 2021-09-29 5,000 CYNGASA, S.L. Art. 6 GDPRInsufficient legal basis for data processing
ETid-854SPAIN 2021-09-28 3,000 Bar owner Art. 5 (1) b) GDPR Non-compliance with general data processing principles
ETid-853 SPAIN 2021-09-14 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-852SPAIN 2021-09-14 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-851 NORWAY 2021-09-27 496,000 Ferde AS Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 28 (3) GDPR, Art. 32 (2) GDPR, Art. 44 GDPRNon-compliance with general data processing principles
ETid-850SPAIN 2021-09-14 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-849 SPAIN 2021-09-14 56,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-848SPAIN 2021-09-24 3,000 Unknown Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-847 ISLE OF MAN 2020-12-11 3,250 Cosmetic Medical Limited Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-846GERMANY 2021-09-24 900,000 Vattenfall Europe Sales GmbH Art. 12 GDPR, Art. 13 GDPR Insufficient data processing agreement
ETid-845 SPAIN 2021-09-14 40,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-844SPAIN 2021-09-20 18,000 CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-843 GREECE 2021-08-26 5,000 NOW DOCTOR – Εταιρία Παροχής Ηλεκτρονικών Υπηρεσιών Αναζήτησης και Προβολής Ιατρών Ε.Π.Ε. Art. 5 (1) a), e) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3) GDPR, Art. 17 GDPRNon-compliance with general data processing principles
ETid-842GREECE 2021-09-03 8,000 Rhodes Municipal Transport Company Art. 5 (1) c) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-841 GREECE 2021-08-26 20,000 National Bank of Greece Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-840GREECE 2021-08-26 20,000 Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPR Insufficient fulfilment of data subjects rights
ETid-839 DENMARK 2021-09-17 67,200 Syddanmark Region Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-838SPAIN 2021-09-16 4,000 Frigorifica Botana S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-837 FRANCE 2021-09-15 3,000 Société nouvelle de l’annuaire français Art. 16 GDPR, Art. 17 GDPR, Art. 30 GDPR, Art. 31 GDPRInsufficient fulfilment of data subjects rights
ETid-836DENMARK 2021-09-16 10,000 Favrskov municipality Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-835 SPAIN 2021-09-13 9,000 Website operator Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-834SPAIN 2021-09-13 1,000 Hairdressing salon Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-833 SPAIN 2021-09-13 1,000 GESTIONES AUTO LOW COST S. L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-832CYPRUS 2021-09-06 25,000 Hellenic Technical Enterprises Ltd. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-831 CYPRUS 2021-09-06 40,000 AC Omonia Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-830CYPRUS 2021-09-06 40,000 APOEL FC Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-829 ITALY 2021-07-22 400,000 Atac s.p.a. Art. 5 GDPR, Art. 6 GDPR, Art. 30 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-828ITALY 2021-07-22 30,000 Flowbird Italia s.r.l. Art. 5 GDPR, Art. 6 GDPR, Art. 30 GDPR Non-compliance with general data processing principles
ETid-827 ITALY 2021-07-22 800,000 Roma Capitale Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-826ITALY 2021-07-22 200,000 Regione Lombardia Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR Non-compliance with general data processing principles
ETid-825 IRELAND 2021-09-07 1,400 Vodafone Ireland Limited Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-824DENMARK 2021-09-08 53,800 Midtjylland Region Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-823 SPAIN 2021-09-02 4,000 Automecanica Jerez, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 21 LSSIInsufficient technical and organisational measures to ensure information security
ETid-822SPAIN 2021-08-23 1,800 Agency Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-821 SPAIN 2021-08-30 6,000 Furnishyourspace S.L. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 (4) GDPRInsufficient fulfilment of information obligations
ETid-820IRELAND 2021-09-02 225,000,000 WhatsApp Ireland Ltd. Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR Insufficient fulfilment of information obligations
ETid-819 SPAIN 2021-08-25 120,000 Banco Bilbao Vizcaya Argentaria, S.A. Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-818SPAIN 2021-08-26 1,000 Owners Association Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-817 POLAND 2021-08-13 2,200 President of the Zgierz District Court Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b), d), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-816ROMANIA 2021-08-24 3,000 Actamedica SRL Art. 28 (1) GDPR, Art. 32 GDPR, Art. 33 GDPR Insufficient technical and organisational measures to ensure information security
ETid-815 SPAIN 2021-08-23 2,000 Company owner Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-814SPAIN 2021-08-13 1,000 Employer Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-813 HUNGARY 2021-06-18 28,400 Magyar Telekom Nyrt. Art. 5 (1) d) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3), (4) GDPR, Art. 17 (1) GDPR, Art. 25 GDPRInsufficient fulfilment of data subjects rights
ETid-812HUNGARY 2021-04-20 2,800 Website operator Art. 5 (2) GDPR, Art. 24 GDPR Non-compliance with general data processing principles
ETid-811 SPAIN 2021-08-03 96,000 Vodafone España, S.A.U. Art. 6 (1) GDPR, Art. 17 GDPRInsufficient legal basis for data processing
ETid-810SPAIN 2021-08-10 2,000 DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-809 NORWAY 2021-08-12 9,600 Waxing Palace AS Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-808ITALY 2021-06-10 40,000 aiComply S.r.l. Art. 28 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-807 ITALY 2021-06-10 40,000 Aeroporto Guglielmo Marconi di Bologna S.p.a. Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-806SPAIN 2021-08-05 6,000 Future Vinline S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-805 SPAIN 2021-08-09 5,000 CLUB GIMNASIA RÍTMICA SAN ANTONIO Art. 6 GDPRInsufficient legal basis for data processing
ETid-804SPAIN 2021-08-09 1,000 BAZTANDIS, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-803 SPAIN 2021-07-30 4,000 Gas inspector Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-802SPAIN 2021-07-30 2,000 Private Individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-801 SPAIN 2021-07-30 600 Private Individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-800SPAIN 2021-07-27 4,000 Private Individual Art. 5 (1) c), e) GDPR Non-compliance with general data processing principles
ETid-799 SPAIN 2021-07-27 3,000 INSTAPACK, S.L. Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPRInsufficient legal basis for data processing
ETid-798SPAIN 2021-07-27 3,000 UST GLOBAL ESPAÑA, S.A. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-797 SPAIN 2021-08-05 3,000 Private Individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-796SPAIN 2021-07-27 1,000 APARTAMENTOS PLAYA DE COVACHOS, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-795 SPAIN 2021-07-27 2,000 Vasco Andaluza de Inversiones S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-794SPAIN 2021-07-27 2,000 Gerco Fit S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-793 SPAIN 2021-07-27 2,000 Body Tonic Shop S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-792AUSTRIA 2021-08-02 2,000,000 Unser Ö-Bonus Club GmbH Art. 6 GDPR, Art. 7 GDPR, Art. 12 GPDR Insufficient legal basis for data processing
ETid-791 GERMANY 2020 65,000 Company Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-790ITALY 2021-07-22 2,500,000 Deliveroo Italy s.r.l. Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 22 (3) GDPR, Art. 25 GDPR, Art. 30 (1) c), f), g) GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 37 (7) GDPR Non-compliance with general data processing principles
ETid-789 SPAIN 2021-08-02 3,000 Club Náutico el Estacio Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-788SPAIN 2021-07-27 60,000 PRA Iberia S.L. Art. 6 (1) GDPR, Art. 15 GDPR Insufficient legal basis for data processing
ETid-787 ROMANIA 2021-07-30 200 Private Individual Art. 5 (1) a), b), (2) GDPR, Art. 6 (1) GDPR, Art. 14 (1), (4) GDPRInsufficient legal basis for data processing
ETid-786FINLAND 2021-07-05 25,000 Higher Education Institution Art. 5 (1) c) GDPR, Art. 6 GDPR, § 3 Law 759/2004 Non-compliance with general data processing principles
ETid-785 SPAIN 2021-07-27 2,000 Owners Association Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-784SPAIN 2021-07-27 900 Owners Association Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-783 SPAIN 2021-07-27 2,400 PODEMOS PARTIDO POLÍTICO Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-782SPAIN 2021-07-27 10,000 PERSONAL MARK, S.L. Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-781 SPAIN 2021-07-27 1,000 NEXTSTEPAGENCY, S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-780SPAIN 2021-07-27 500 Website operator Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-779 SPAIN 2021-07-29 3,000 UNIVERSIDAD A DISTANCIA DE MADRID, S.A. Art. 17 (1) GDPR, Art. 21 LSSIInsufficient fulfilment of data subjects rights
ETid-778LUXEMBOURG 2021-07-16 746,000,000 Amazon Europe Core S.à.r.l. Unknown Non-compliance with general data processing principles
ETid-777 SPAIN 2021-07-26 2,520,000 Mercadona S.A. Art. 5 (1) c) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 (1) GDPR, Art. 35 GDPRInsufficient legal basis for data processing
ETid-776FRANCE 2021-07-26 400,000 Monsanto Company Art. 14 GDPR, Art. 28 GDPR Insufficient fulfilment of information obligations
ETid-775 SPAIN 2021-07-26 2,000 Fincas Miguel García S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-774SPAIN 2021-07-26 2,000 Intersumi S.C. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-773 ITALY 2021-05-27 150,000 Azienda Provinciale per i Servizi Sanitari di Trento Art. 5 (1) a), f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-772ITALY 2021-05-27 120,000 Azienda Usl della Romagna Art. 5 (1) f) GDPR, Art. 9 GDPR Non-compliance with general data processing principles
ETid-771 FRANCE 2021-07-20 1,750,000 SGAM AG2R LA MONDIALE Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principles
ETid-770THE NETHERLANDS 2021-04-09 750,000 TikTok Art. 12 GDPR Insufficient fulfilment of information obligations
ETid-769 POLAND 2021-06-30 3,000 Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-768SPAIN 2021-07-12 45,000 Telefónica Móviles España, S.A.U. Art. 6 GDPR Insufficient legal basis for data processing
ETid-767 GREECE 2021-07-08 5,000 Pediatrician Art. 12 (1) GDPR, Art. 15 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-766SPAIN 2021-07-01 6,000 Private Individual Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-765 SPAIN 2021-07-01 1,000 Unknown Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-764SPAIN 2021-07-07 2,000 Homeowners Association Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-763 SPAIN 2021-07-02 1,500 Private Individual Art. 6 (1) a) GDPRInsufficient legal basis for data processing
ETid-762SPAIN 2021-07-06 4,200 Marbella Resorts S.L. Art. 28 (3) GDPR Insufficient data processing agreement
ETid-761 SPAIN 2021-07-09 1,500 Aparcamiento Arcusa S.L.U. Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-760LUXEMBOURG 2021-06-29 12,500 Unknown Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-759 DENMARK 2021-07-16 67,900 Region of Syddanmark Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-758GERMANY 2020 7,000 Unknown Art. 58 (1) f) GDPR Insufficient cooperation with supervisory authority
ETid-757 DENMARK 2021-07-09 80,700 Medicals Nordic I/S UnknownNon-compliance with general data processing principles
ETid-756CROATIA 2021-07-05 Unknown Insurance company Art. 13 GDPR, Art. 14 GDPR, Art 27 (1) of the National Implementation Law Insufficient fulfilment of information obligations
ETid-755 SPAIN 2021-07-08 4,000 Malagatrom S.L.U. Art. 6 GDPRInsufficient legal basis for data processing
ETid-754SPAIN 2021-07-08 50,000 Caixabank S.A. Art. 6 (1) f) GDPR Insufficient legal basis for data processing
ETid-753 LUXEMBOURG 2021-06-11 15,000 Unknown Art. 38 (1), (3) GDPR, Art. 39 (1) a), b) GDPRInsufficient involvement of data protection officer
ETid-752UNITED KINGDOM 2021-07-05 29,000 Mermaids Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-751 THE NETHERLANDS 2021-05-31 450,000 UWV (Dutch employee insurance service provider) Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-750ITALY 2021-06-10 20,000 Dentist Art. 5 (1) a), c) GDPR Insufficient legal basis for data processing
ETid-749 LUXEMBOURG 2021-06-11 7,600 Unknown Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-748LUXEMBOURG 2021-06-11 7,200 Unknown Art. 5 (1) c), e) GDPR, Art. 13 GDPR, Art. 32 (1) GDPR Non-compliance with general data processing principles
ETid-747 ITALY 2021-05-13 84,000 Comune di Bolzano Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-746DENMARK 2021-07-07 53,800 Nordbornholms Byggeforretning Aps Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-745 CROATIA 2021-07-05 Unknown IT services company Art. 32 (1) b), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-744FINLAND 2021-06-24 8,500 Magazine publisher Art. 5 (1) a) GDPR, Art. 7 (2), (4) GDPR, Art. 12 (2) GDPR, Art. 21 (2) GDPR, Art. 24 (1) GDPR, Art. 28 (1), (3) GDPR Insufficient legal basis for data processing
ETid-743 ITALY 2021-06-10 2,600,000 Foodinho s.r.l. Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 22 (3) GDPR, Art. 25 GDPR, Art. 30 (1) a), b), c), f), g) GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 37 (7) GDPRNon-compliance with general data processing principles
ETid-742LUXEMBOURG 2021-04-08 2,800 Unknown Art. 5 (1) e) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-741 POLAND 2021-06-21 35,300 Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A. Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-740ICELAND 2021-06-15 34,000 Huppuís ehf Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 (1), (2) GDPR Non-compliance with general data processing principles
ETid-739 LITHUANIA 2020 8,000 Unknown Art. 5 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-738NORWAY 2021-06-04 49,200 Moss municipality Art. 32 (1) b), d) GDPR Insufficient technical and organisational measures to ensure information security
ETid-737 ITALY 2021-05-13 2,856,169 Iren Mercato S.p.A. Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 (1) GDPRInsufficient legal basis for data processing
ETid-736SPAIN 2021-06-22 10,000 TNT EXPRESS WORLDWIDE SPAIN, S.L. Art. 5 (1) d) GDPR Non-compliance with general data processing principles
ETid-735 NORWAY 2021-06-22 24,800 Unknown Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 17 GDPR, Art. 21 GDPRInsufficient legal basis for data processing
ETid-734FRANCE 2021-06-14 500,000 BRICO PRIVÉ Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 17 GDPR, Art. 32 GDPR, Art. 82 Loi informatique et libertés, Art. L. 34-5 CPCE Non-compliance with general data processing principles
ETid-733 SWEDEN 2021-06-21 1,600,000 Storstockholms Lokaltrafik Art. 5 (1) a), c) GDPR, Art. 6 (1) f) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-732LITHUANIA 2021-06-21 20,000 UAB VS FITNESS Art. 5 (1) a), c) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 30 GDPR, Art. 35 (1) GDPR Non-compliance with general data processing principles
ETid-731 GREECE 2021-06-03 15,000 PURPLE SEA MΟΝΟΠΡΟΣΩΠΗ ΙΚΕ Art. 5 (1) a), b) GDPR, Art. 5 (2) GDPRNon-compliance with general data processing principles
ETid-730DENMARK 2021-06-16 27,000 Vejle Municipality Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-729 POLAND 2021-03-19 4,900 Funeda Sp. z o.o. Art. 31 GDPR, Art. 58 (1) a), e) GDPRInsufficient cooperation with supervisory authority
ETid-728ROMANIA 2021-06-09 2,000 La Santrade S.R.L. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-727 SPAIN 2021-06-14 1,200 Inmopiso Zaragoza S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-726LUXEMBOURG 2021-05-31 18,000 Unknown Art. 38 (1), (2) GDPR, Art. 39 (1) a) GDPR Insufficient involvement of data protection officer
ETid-725 THE NETHERLANDS 2021-02-04 12,000 Orthodontic Clinic Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-724LIECHTENSTEIN 2020 4,100 Unknown Unknown Non-compliance with general data processing principles
ETid-723 NORWAY 2021-05-28 39,700 BRAbank ASA Art. 24 GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-722SWEDEN 2021-06-09 34,800 Directorate of the Östra Skaraborg Rescue Service Art. 5 (1) a), c) GDPR, Art. 32 (1), (4) GDPR Non-compliance with general data processing principles
ETid-721 POLAND 2021-04-27 5,050 PNP S.A. Art. 31 GDPR, Art. 58 (1) e) GDPRInsufficient cooperation with supervisory authority
ETid-720ROMANIA 2021-06-09 2,000 S.C. Dreamtime Call S.R.L. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-719 SWEDEN 2021-06-07 64,500 Voice Integrate Nordic AB Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-718SWEDEN 2021-06-07 1,200,000 MedHelp AB Art. 5 (1) a), f) GDPR, Art. 6 GDPR, Art. 9 (1) GDPR, Art. 13 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-717 SWEDEN 2021-06-07 50,000 Region Stockholm Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligations
ETid-716SWEDEN 2021-06-07 25,000 Region Värmland Art. 5 (1) a) GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-715 SWEDEN 2021-06-07 25,000 Region Sörmland Art. 5 (1) a) GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-714LUXEMBOURG 2021-05-12 1,000 Unknown Art. 5 (1) c) GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-713 LUXEMBOURG 2021-05-12 2,600 Unknown Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-712LUXEMBOURG 2021-05-12 2,400 Unknown Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-711 LUXEMBOURG 2021-05-12 1,900 Unknown Art. 5 (1) c), e) GDPRNon-compliance with general data processing principles
ETid-710SPAIN 2021-06-07 19,600 Radiotelevisión del principado de Asturias Art. 5 (1) c) GDPR, Art. 12 GDPR Non-compliance with general data processing principles
ETid-709 SPAIN 2021-06-07 20,000 Master Distancia S.A. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-708SPAIN 2021-06-04 6,000 Creator Energy S.L. Art. 6 (1) b) GDPR Insufficient legal basis for data processing
ETid-707 ITALY 2021-04-15 12,000 Istituto Nazionale Previdenza Sociale (INPS) Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-706SPAIN 2021-06-02 4,000 Avalos Consultores, S.L. Art. 6 GDPR Insufficient legal basis for data processing
ETid-705 SPAIN 2021-05-21 45,000 Telefónica de España, S.A.U Art. 6 GDPRInsufficient legal basis for data processing
ETid-704ITALY 2021-04-21 15,000 Fondazione Policlinico Tor Vergata di Roma Art. 5 (1) a), f) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPR Non-compliance with general data processing principles
ETid-703 GREECE 2021-05-12 5,000 KARIERA A.E. Art. 17 GDPR, Art. 21 GDPR, Art. 25 GDPRInsufficient fulfilment of data subjects rights
ETid-702SPAIN 2021-05-21 3,000 Homeowners Association Art. 5 (1) c) GDPR, Art. 12 GDPR Non-compliance with general data processing principles
ETid-701 SPAIN 2021-05-27 2,000 Private Individual Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-700NORWAY 2021-05-18 95,500 Innovasjon Norge Art. 5 (1) GDPR, Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-699 GREECE 2021-05-17 10,000 Municipal Organization for Pre-School Education and Social Solidarity (DOPAKA) of the municipality of Tavros Moschato Art. 6 (1) c) GDPR, Art. 12 (3), (4) GDPR, Art. 17 (1) d) GDPRInsufficient legal basis for data processing
ETid-698ITALY 2021-03-25 7,000 TECNOMEDICAL S.r.l. Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-697 SPAIN 2021-05-26 3,000 Vodafone España, S.A.U. Art. 58 (1) GDPRInsufficient cooperation with supervisory authority
ETid-696SPAIN 2021-05-25 6,000 Desolasol Restauración, S.L. Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-695 SPAIN 2021-05-25 4,000 Alava Norte, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-694SPAIN 2021-05-25 100,000 Vodafone España, SAU Art. 28 GDPR Insufficient technical and organisational measures to ensure information security
ETid-693 HUNGARY 2021-04-27 570 Company Art. 5 (1) a), (2) GDPR, Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-692HUNGARY 2021-04-27 1,400 Company Art. 5 (1), (2) GDPR, Art. 6 GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-691 SPAIN 2021-05-25 900 Managing Director of a company Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-690SPAIN 2021-05-21 3,000 Physician Art. 6 GDPR Insufficient legal basis for data processing
ETid-689 IRELAND 2021-03-23 90,000 Irish Credit Bureau DAC Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-688NORWAY 2021-05-20 39,000 Municipality of Oslo Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-687 THE NETHERLANDS 2020-03-24 15,000 CP&A Art. 9 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-686ITALY 2021-04-15 40,000 Comune di Palermo Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-685 ROMANIA 2021-05-19 2,000 Banca Comercială Română S.A. Art. 5 (1) a), d), (2) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-684ROMANIA 2021-05-19 500 Owners Association of Iasi Municipality Art. 58 (1) a), e) GDPR Insufficient cooperation with supervisory authority
ETid-683 ITALY 2021-04-15 5,000 Physician Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-682ITALY 2021-04-15 2,000 Società triveneta di chirurgia Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-681 POLAND 2021-04-22 245,000 Cyfrowy Polsat S.A. Art. 24 (1) GDPR, Art. 32 (1), (2) GDPR, Art. 34 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-680GREECE 2021-05-12 5,000 A. ΕΠΙΛΟΓΗ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ Art. 5 (1) a), b) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPR Non-compliance with general data processing principles
ETid-679 HUNGARY 2021-03-25 1,425 Operator of a care facility Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 13 (1), (2) GDPRInsufficient legal basis for data processing
ETid-678THE NETHERLANDS 2020-12-20 525,000 Locatefamily.com Art. 27 GDPR Non-compliance with general data processing principles
ETid-677 SPAIN 2021-05-14 30,000 Allianz Compañia de Seguros y Reaseguros, S.A. Art. 6 GDPRInsufficient legal basis for data processing
ETid-676ROMANIA 2021-05-13 2,000 Telekom Romania Communications SA Art. 6 GDPR, Art. 21 GDPR Insufficient fulfilment of data subjects rights
ETid-675 ROMANIA 2021-05-14 200 Website operator Art. 5 (1) a), b), (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1), (2), (3) GDPR, Art. 32 (2) GDPRNon-compliance with general data processing principles
ETid-674ITALY 2021-03-25 4,000 Comune di Castellanza Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR Insufficient legal basis for data processing
ETid-673 SPAIN 2021-05-12 3,000 Solram T Y R S.L. Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-672THE NETHERLANDS 2020-06-16 7,500 PVV Overijssel Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-671 SPAIN 2021-05-04 1,500,000 EDP Energía, S.A.U Art. 13 GDPR, Art. 25 GDPRInsufficient fulfilment of information obligations
ETid-670SPAIN 2021-05-04 1,500,000 EDP Comercializadora, S.A.U. Art. 13 GDPR, Art. 25 GDPR Insufficient fulfilment of information obligations
ETid-669 ICELAND 2021-04-29 23,100 InfoMentor ehf Art. 32 (1) b), d) GDPRInsufficient technical and organisational measures to ensure information security
ETid-668ROMANIA 2021-05-07 2,000 World Class România S.A. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-667 NORWAY 2021-05-05 Only intention to issue fine Disqus Inc. Art. 5 (1), (2) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-666HUNGARY 2021-03-24 27,700 Budapest Főváros Kormányhivatala XI. kerületi Hivatalát (11th District Public Health Department of the Government Office of the Capital City Budapest) Art. 32 (1) a), b) GDPR, Art. 32 (2) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-665 FINLAND 2021-04-21 75,000 ParkkiPate Oy Art. 5 (1) c) GDPR, Art. 12 (3), (4), (6) GDPR, Art. 14 (2) a) GDPR, Art. 14 (3) GDPR, Art. 15 GDPR, Art. 17 (1) a) GDPR, Art. 25 (2) GDPRInsufficient fulfilment of data subjects rights
ETid-664BELGIUM 2021-04-26 100,000 Financial company Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-663 ITALY 2021-03-25 20,000 GEDI News Network Spa Art. 12 (3), (4) GDPRInsufficient legal basis for data processing
ETid-662ITALY 2021-03-25 30,000 OneDirect Srl Art. 6 (1) GDPR, Art. 7 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR Insufficient legal basis for data processing
ETid-661 ITALY 2021-03-11 80,000 Planet Group Spa Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 21 (2), (3) GDPR, Art. 12 (3) GDPR, Art. 25 (1) GDPRInsufficient legal basis for data processing
ETid-660ITALY 2021-03-11 15,000 Mediacom s.r.l. Art. 5 (1) a) GDPR, Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-659 THE NETHERLANDS 2021-03-11 600,000 Municipality of Enschede Art. 5 (1) a) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-658SPAIN 2021-04-27 15,000 Anytime Fitness Iberia S.L. Art. 17 GDPR, Art. 21 LSSI Insufficient fulfilment of data subjects rights
ETid-657 SPAIN 2021-04-27 3,000 Pagamastarde S.L. Art. 17 (1) GDPR, Art. 21 LSSIInsufficient fulfilment of data subjects rights
ETid-656SPAIN 2021-04-23 1,000,000 Equifax Iberica S.L. Art. 5 (1) a), b), c), d) GDPR, Art. 6 (1) GDPR, Art. 14 GDPR Insufficient legal basis for data processing
ETid-655 CZECH REPUBLIC 2020 19,200 Unknown Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3) GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR, Art. 22 GDPRNon-compliance with general data processing principles
ETid-654CZECH REPUBLIC 2020 Unknown Unknown Art. 5 (1) a) GDPR Insufficient legal basis for data processing
ETid-653 CZECH REPUBLIC 2020 Unknown Municipality Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR, Art. 14 (3) GDPRInsufficient legal basis for data processing
ETid-652CZECH REPUBLIC 2020 3,850 Television broadcaster Art. 12 (1) GDPR Insufficient fulfilment of information obligations
ETid-651 CZECH REPUBLIC 2020 Unknown Unknown Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-650CZECH REPUBLIC 2020 Unknown Bank Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD Non-compliance with general data processing principles
ETid-649 CZECH REPUBLIC 2020 Unknown Healthcare provider Art. 5 (1) a) GDPR, Art. 12 (1) GDPR, Art. 28 (2), (3) GDPRInsufficient fulfilment of information obligations
ETid-648CZECH REPUBLIC 2020 Unknown Public university Art. 6 (1) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-647 ITALY 2021-03-11 3,000 Comune di San Marco in Lamis Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPRInsufficient legal basis for data processing
ETid-646GREECE 2021-04-16 2,000 Candidate for parliamentary elections Art. 15 GDPR, Art. 11 Law 3471/2006 Insufficient fulfilment of data subjects rights
ETid-645 SPAIN 2021-04-22 4,000 HazteOir.Org Art. 6 GDPRInsufficient legal basis for data processing
ETid-644SPAIN 2021-04-22 1,500 Private Individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-643 NORWAY 2021-03-21 19,900 Basaren Drift AS Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-642SPAIN 2021-04-20 8,000 Highcliffe Estates Marbella S.L. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-641 CZECH REPUBLIC 2020 1,900 Unknown Art. 12 (2) GDPR, Art. 15 (1) GDPRInsufficient fulfilment of data subjects rights
ETid-640CZECH REPUBLIC 2020-05-26 Unknown Unknown Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-639 CZECH REPUBLIC 2020 387 Private healthcare provider Art. 24 GDPR, Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-638SPAIN 2021-04-19 1,500 Pub owner Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-637 ROMANIA 2021-04-19 1,500 Lugera & Makler Broker S.R.L. Art. 29 GDPR, Art. 32 (2), (4) GDPRInsufficient technical and organisational measures to ensure information security
ETid-636SPAIN 2021-04-13 90,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-635 SPAIN 2021-04-15 3,000 Private Individual Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-634GREECE 2020-04-07 2,000 Ιγνατιάδης Νικόλαος και ΣΙΑ Ε.Ε. Art. 5 (1) c) GDPR, Art. 6 (1) f) GDPR Non-compliance with general data processing principles
ETid-633 ROMANIA 2021-04-15 5,000 S.C. Tip Top Food Industry S.R.L Art. 5 (1) b), c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processing
ETid-632CZECH REPUBLIC 2020 Unknown Ski rental company Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 7 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR Non-compliance with general data processing principles
ETid-631 CZECH REPUBLIC 2020 2,700 Mall.tv Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-630SPAIN 2021-04-08 60,000 Kutxabank, S.A. Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-629 ITALY 2021-02-25 6,000 Azienda Ospedaliera Universitaria Careggi Art. 5 GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-628NORWAY 2021-04-09 3,400 Miljø- og Kvalitetsledelse AS Art. 5 (1) a) GDPR, Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-627 NORWAY 2021-03-15 100,000 Asker Municipality Art. 5 GDPR, Art. 6 GDPR, Art. 32 (1) b) GDPR, Art. 24 GDPRInsufficient technical and organisational measures to ensure information security
ETid-626GREECE 2021-03-22 2,000 Candidate for parliamentary elections Art. 15 GDPR, Art. 11 Law 3471/2006 Insufficient fulfilment of data subjects rights
ETid-625 ITALY 2021-02-11 45,000 Istituti ospedalieri bergamaschi Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-624SPAIN 2021-04-06 2,400 Promotech Digital S.L. Art. 21 GDPR Insufficient fulfilment of data subjects rights
ETid-623 SPAIN 2021-04-05 4,000 Stockhunters S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-622SPAIN 2021-04-05 3,000 Electrotecnica Bastida S.L. Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-621 SPAIN 2021-04-05 3,000 Kukimbia S.L. Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-620ITALY 2021-03-25 4,500,000 Fastweb S.p.A. Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 32 GPDR, Art. 33 (1) GDPR, Art. 34 (1) GDPR Non-compliance with general data processing principles
ETid-619 ITALY 2021-02-25 4,000 Ministero dell’Istruzione, Ufficio Scolastico Regionale per il Lazio Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-618ITALY 2021-02-11 60,000 Roma Servizi per La Mobilita S.r.l. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-617 ITALY 2021-02-11 350,000 Roma Capitale Art. 5 GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-616ITALY 2021-02-25 20,000 Gedi Gruppo Editoriale S.p.A. Art. 5 (1) a) GDPR Insufficient legal basis for data processing
ETid-615 ITALY 2021-02-11 5,000 Fondazione di religione e di culto “Casa sollievo della sofferenza” Opera di San Pio da Pietrelcina Art. 5 (1) a), f) GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-614ITALY 2021-02-25 6,000 Comune di Commezzadura Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-613 ROMANIA 2021-03-30 10,000 Telekom Romania Mobile Communications S.A. Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-612THE NETHERLANDS 2020-12-10 475,000 Booking.com B.V. Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-611 NORWAY 2021-03-08 14,900 Dragefossen AS Art. 5 (1) a) GPDR, Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-610ITALY 2021-02-25 2,000 Comune di Conflenti Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR Insufficient legal basis for data processing
ETid-609 SPAIN 2021-03-15 600,000 Air Europa Lineas Aereas, SA. Art. 32 (1) GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-608NORWAY 2021-03-15 4,900 Ålesund Municipality Art. 32 (1) b) GDPR, Art. 24 (1) GDPR, Art. 35 GDPR Insufficient technical and organisational measures to ensure information security
ETid-607 SPAIN 2021-03-23 1,000 Laboratorio Octogón, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-606ROMANIA 2021-03-23 2,000 S.C. Medicover S.R.L. Art. 32 (1) b), (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-605 SPAIN 2021-03-16 60,000 Vodafone España, S.A.U. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-604SPAIN 2021-03-18 3,000 Asesoría Alpi-Clúa S.L. Art. 5 (1) f) GDPR, Art. 32 (1) GDPR Non-compliance with general data processing principles
ETid-603 SPAIN 2021-03-15 2,000 Heredad de Urueña S.A. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-602SPAIN 2021-03-15 3,000 Cultural association Art. 6 (1) a) GDPR Insufficient legal basis for data processing
ETid-601 BELGIUM 2021-03-15 1,000 School Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 8 GDPRInsufficient legal basis for data processing
ETid-600ITALY 2021-01-14 75,000 Regione Lazio Art. 5 (2) GDPR, Art. 28 GDPR Insufficient data processing agreement
ETid-599 ITALY 2021-02-11 75,000 Ministero dello Sviluppo Economico Art. 5 (1) a), b), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 37 (1), (7) GDPRNon-compliance with general data processing principles
ETid-598ITALY 2020-12-17 2,000 Ordine degli Assistenti Sociali della Regione Lazio Art. 12 (3), (4) GDPR Insufficient fulfilment of data subjects rights
ETid-597 SPAIN 2021-03-15 5,000 Certime S.A. Art. 5 (1) b) GDPRNon-compliance with general data processing principles
ETid-596SPAIN 2021-03-12 12,000 NBQ Technology, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-595 SPAIN 2021-03-12 1,500 Private Person Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-594SPAIN 2021-03-11 8,150,000 Vodafone España, S.A.U. Art. 28 GDPR, Art. 24 GDPR, Art. 44 GDPR, Art. 21 LSSI, Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD Insufficient fulfilment of data subjects rights
ETid-593 SPAIN 2021-03-10 90,000 Xfera Moviles S.A. Art. 5 (1) f) GDPR, Art. 17 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-592SPAIN 2021-03-10 50,000 Equifax Iberica S.L. Art. 6 (1) f) GDPR Insufficient legal basis for data processing
ETid-591 ITALY 2021-02-25 300,000 Istituto Nazionale Previdenza Sociale (INPS) Art. 5 (1) a), c), d) GDPR, Art. 25 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-590ITALY 2020-12-17 10,000 Comune di Luino Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 37 (1) a) GDPR, Art. 37 (7) GDPR Non-compliance with general data processing principles
ETid-589 ITALY 2020-12-17 4,000 Comune di Santo Stefano Belbo Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPRNon-compliance with general data processing principles
ETid-588SPAIN 2021-03-10 8,000 Filigrana Comunicación S.L.U. Art. 6 (1) GDPR, Art. 13 GPDR, Art. 14 GDPR Insufficient fulfilment of information obligations
ETid-587 SPAIN 2021-03-10 10,000 Hospital Campogrande DE Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-586GERMANY 2021-03-10 300,000 VfB Stuttgart 1893 AG Art. 5 (2) GDPR Non-compliance with general data processing principles
ETid-585 SPAIN 2021-03-09 15,000 Homeowners Association Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-584POLAND 2021-01-11 30,000 Enea S.A. Art. 33 (1) GDPR Insufficient fulfilment of data breach notification obligations
ETid-583 POLAND 2021-01-15 4,600 Anwara Sp. z.o.o. Art. 31 GDPR, Art. 58 (1) a) GDPRInsufficient cooperation with supervisory authority
ETid-582ROMANIA 2021-03-04 500 Natural person holding the position of General Secretary for a political party in Bucharest Art. 32 (1), (2) GDPR, Art. 58 (1) a), e) GDPR Insufficient technical and organisational measures to ensure information security
ETid-581 CYPRUS 2021-03-03 40,000 Electricity Authority of Cyprus Art. 6 (1) GDPR, Art. 9 (2) GDPRInsufficient legal basis for data processing
ETid-580CYPRUS 2021-03-03 6,000 KEPIDES Art. 32 (4) Insufficient technical and organisational measures to ensure information security
ETid-579 CYPRUS 2021-03-03 10,000 Cypriot Real Estate Registration Authority Art. 12 GDPR, Art. 15 GDPR, Art. 31 GDPR, Art. 58 (1) e) GDPRInsufficient fulfilment of information obligations
ETid-578CYPRUS 2021-03-03 25,000 Hellenic Bank Art. 5 (1) e), f) GDPR, Art. 32 (1) b), c) GDPR, Art. 33 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-577 SPAIN 2021-03-02 200,000 I-DE Redes Eléctricas Inteligentes, S.A.U Art. 5 (1) b), c) GDPR, Art. 6 (1) b) GDPRNon-compliance with general data processing principles
ETid-576LITHUANIA 2021-03-02 15,000 Registrų Centras Art. 32 (1) b), c) GDPR Insufficient technical and organisational measures to ensure information security
ETid-575 GERMANY 2021-03-03 0 Private Individual Art. 5 GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-574SPAIN 2021-03-02 9,000 Unknown Art. 6 GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-573 NORWAY 2021-03-02 24,400 Unknown Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-572LITHUANIA 2021-02-26 3,000 IT sprendimai sėkmei Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR Non-compliance with general data processing principles
ETid-571 LITHUANIA 2021-02-26 12,000 Nacionaliniam visuomenės sveikatos centrui (NVSC) Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPRNon-compliance with general data processing principles
ETid-570IRELAND 2020-08-12 85,000 Tusla Child and Family Agency Art. 32 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-569 HUNGARY 2020-12-10 22,200 Budapesti Műszaki és Gazdaságtudományi Egyetem (Budapest University of Technology and Economics) Art. 5 (1) a), b), c) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR, Art. 12 GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-568HUNGARY 2020-12-16 97,150 Unknown Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 12 GDPR Insufficient legal basis for data processing
ETid-567 SPAIN 2021-02-24 12,000 Avilon Center 2016 S.L. Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDDInsufficient fulfilment of data subjects rights
ETid-566CROATIA 2021-02-22 Unknown Security company (name not available at the moment) Art. 32 (1) b), d) GDPR, Art. 32 (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-565 SPAIN 2021-02-12 1,600 Ripobruna 207, S.L. Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-564POLAND 2021-02-11 22,200 Krajowa Szkoła Sądownictwa i Prokuratury Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 28 (3) GDPR, Art. 32 (1), (2) GDPR Insufficient technical and organisational measures to ensure information security
ETid-563 ITALY 2021-01-14 18,000 Azienda Usl di Bologna Art. 5 (1) f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-562ITALY 2021-01-14 2,000 Poliambulatorio Talenti S.r.l. Art. 12 (3) GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-561 ITALY 2021-01-27 10,000 Azienda Ospedaliero Universitaria di Parma Art. 5 (1) f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-560ITALY 2021-01-27 50,000 Azienda Ospedaliero Universitaria Senese Art. 5 (1) f) GDPR, Art. 9 GDPR Non-compliance with general data processing principles
ETid-559 ITALY 2021-01-27 50,000 Azienda USL della Romagna Art. 5 (1) a), d), f) GDPR, Art. 9 GDPR, Art. 32 (1) b) GDPRNon-compliance with general data processing principles
ETid-558ITALY 2021-01-14 30,000 Azienda sanitaria provinciale di Enna Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-557 SPAIN 2021-02-16 1,000 The Washpoint S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-556ITALY 2021-01-14 8,000 Agenzia regionale protezione ambientale Campania (ARPAC) Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-555 THE NETHERLANDS 2021-02-11 440,000 OLVG Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-554SPAIN 2021-02-12 120,000 Vodafone España, SAU Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-553 LATVIA 2021-02-09 65,000 Lursoft IT SIA Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-552IRELAND 2020-12-17 70,000 University College Dublin Art. 5 (1) e), f) GDPR, Art. 32 (1) GDPR, Art. 33 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-551 POLAND 2021-01-05 19,000 Unknown Art. 34 (1), (2) GDPR, Art. 58 (2) e) GDPRInsufficient fulfilment of data breach notification obligations
ETid-550ROMANIA 2021-02-10 1,000 ING Bank N.V. Amsterdam - Bucharest office Art. 29 GDPR, Art. 32 (2), (4) GDPR Insufficient technical and organisational measures to ensure information security
ETid-549 SPAIN 2021-02-11 24,000 Vamavi Phone S.L. Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD, Art. 28 GDPRInsufficient fulfilment of data subjects rights
ETid-548SPAIN 2021-02-09 5,000 Predase Servicios Integrales S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-547 SPAIN 2021-02-08 5,000 Private Person Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-546SPAIN 2021-02-08 3,000 Patio Ancestral S.L. Art. 6 GDPR Insufficient legal basis for data processing
ETid-545 SPAIN 2021-02-04 2,000 Private Person Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-544SPAIN 2021-02-03 100,000 Iberdrola Clientes Art. 5 (1) d) GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-543 ITALY 2020-11-26 3,000 Charly Mike s.r.l. Art. 5 (1) a) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-542SPAIN 2021-02-01 3,000 IDFINANCE Spain, S.L. Art. 5 (1) f) GDPR Insufficient technical and organisational measures to ensure information security
ETid-541 SPAIN 2021-02-01 24,000 Xfera Moviles S.A. Art. 58 (2) GDPRInsufficient cooperation with supervisory authority
ETid-540NORWAY 2021-02-03 19,300 Cyberbook AS Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-539 ITALY 2020-12-17 100,000 Azienda Unità Sanitaria Locale Toscana Sud Est Art. 5 (1) f) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 28 GDPR, Art. 30 GDPR, Art. 32 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-538POLAND 2020-12-09 2,850 Smart Cities Sp. z o.o. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-537 BELGIUM 2021-01-27 50,000 Family Service / N.D.P.K. nv. Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPRInsufficient legal basis for data processing
ETid-536FRANCE 2021-01-27 75,000 Unknown Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-535 FRANCE 2021-01-27 150,000 Unknown Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-534SPAIN 2021-01-21 75,000 Telefónica Móviles España, SAU Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-533 BELGIUM 2021-01-22 25,000 Unknown Art. 5 (1) f), (2) GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 (1), (5) GDPR, Art. 34 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-532ITALY 2020-12-17 40,000 Miropass S.r.l. Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 28 GDPR Insufficient legal basis for data processing
ETid-531 ITALY 2020-12-17 500,000 Roma Capitale (Rome Municipality) Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 28 (2), (3) GDPR, Art. 32 GDPRNon-compliance with general data processing principles
ETid-530NORWAY 2021-01-19 9,700 Aquateknikk AS Art. 5 GPDR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-529 SPAIN 2021-01-21 50,000 Alterna Operador Integral S.L. Art. 6 (1) b) GDPRInsufficient legal basis for data processing
ETid-528SPAIN 2021-01-20 1,200 Individual Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-527 POLAND 2021-01-05 5,500 Śląski Uniwersytet Medyczny (Medical University of Silesia) Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-526BELGIUM 2021-01-12 10,000 Unknown Art. 6 (1) GDPR, Art. 12 (3) GDPR, Art. 21 (1) GDPR Insufficient legal basis for data processing
ETid-525 NORWAY 2021-01-14 38,600 Coop Finnmark SA Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-524NORWAY 2021-01-12 38,600 Unknown Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-523 HUNGARY 2020-11-18 28 Unknown Art. 5 (1) d) GDPRNon-compliance with general data processing principles
ETid-522SPAIN 2021-01-13 6,000,000 Caixabank S.A. Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR Insufficient legal basis for data processing
ETid-521 ITALY 2020-10-29 4,000 Borgo Fonte Scura s.r.l. Art. 5 (1) a) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-520ITALY 2020-10-29 20,000 Gaypa s.r.l. Art. 5 (1) a), c), e) GDPR, Art. 12 GDPR, Art. 13 GDPR Non-compliance with general data processing principles
ETid-519 GERMANY 2021-01-08 10,400,000 notebooksbilliger.de Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-518ESTONIA 2020-12-01 100,000 Azeta.ee e-apteek Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-517 ESTONIA 2020-12-01 100,000 Südameapteegi e-apteek Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-516ESTONIA 2020-12-01 100,000 Apotheka e-apteek Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-515 NORWAY 2021-01-07 7,250 Gveik AS Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-514NORWAY 2021-01-06 9,700 Lindstrand Trading AS Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-513 CZECH REPUBLIC 2021-01-04 118,500 Unknown Art. 6 (1) GDPR, Art. 14 GDPRInsufficient legal basis for data processing
ETid-512POLAND 2019-11 1,770 L. Sp. z o.o. Art. 5 (1) a), f) GDPR Non-compliance with general data processing principles
ETid-511 FRANCE 2021-01-05 20,000 Nestor SAS Art. 12 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-510POLAND 2020-12-09 18,850 TUiR Warta S.A. Art. 33 (1) GDPR, Art. 34 (1) GDPR Insufficient fulfilment of data breach notification obligations
ETid-509 POLAND 2020-12-17 235,300 ID Finance Poland Sp. z o.o. Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b), d), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-508FRANCE 2020-12-07 7,300 Perfomeclic Art. 5 (1) c), e) GDPR, Art. 14 GDPR, Art. 21 GDPR, Art. 28 GDPR Insufficient legal basis for data processing
ETid-507 NORWAY 2021-01-04 95,500 Innovasjon Norge Art. 5 (1) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-506SPAIN 2021-01-04 54,000 Vodafone España, S.A.U. Art. 5 (1) d), f) GDPR Non-compliance with general data processing principles
ETid-505 ROMANIA 2020-12-30 3,000 ING Bank N.V. Amsterdam - Bucharest office Art. 5 (1) a) - d) GDPR, Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-504ROMANIA 2020-12-29 1,000 Qualitance QBS SA Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-503 ITALY 2020-11-26 20,000 Concentrix Cvg Italy s.r.l. Art. 5 (1) a), c) GDPR, Art. 6 (1) b), c) GDPR, Art. 9 (1) b) GDPRInsufficient legal basis for data processing
ETid-502ITALY 2020-11-26 10,000 Reti Televisive Italiane S.p.a. Art. 5 (1) a) GDPR Non-compliance with general data processing principles
ETid-501 POLAND 2020-12-28 18,930 Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-500BELGIUM 2020-12-23 15,000 Unknown Art. 14 (1), (2) GDPR, Art. 12 (3) GDPR, Art. 6 GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPR Insufficient fulfilment of data subjects rights
ETid-499 BELGIUM 2020-12-23 50,000 Unknown Art. 14 (1), (2) GDPR, Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPRInsufficient fulfilment of data subjects rights
ETid-498ROMANIA 2020-12-22 2,000 S.C. C&V Water Control S.A. Art. 58 (1) a), e) GDPR, Art. 58 (2) i) GDPR Insufficient cooperation with supervisory authority
ETid-497 SPAIN 2020-12-22 6,000 Iberdrola Clientes, SAU Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDDInsufficient fulfilment of data subjects rights
ETid-496SPAIN 2020-12-21 36,000 Banco Bilbao Vizcaya Argentaria, S.A. Art. 5 (1) d) GDPR Non-compliance with general data processing principles
ETid-495 HUNGARY 2020-12-16 1,385 Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.) Art. 32 (1) GDPRInsufficient technical and organisational measures to ensure information security
ETid-494HUNGARY 2020-12-16 55,400 Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) Art. 25 (1), (2) GDPR, Art. 32 (1) b) GDPR, Art. 34 (1) GDPR Insufficient technical and organisational measures to ensure information security
ETid-493 HUNGARY 2020-12-16 1,940 Unknown Art. 5 (1) b), c) GDPR, Art. 13 (1) GDPRInsufficient fulfilment of information obligations
ETid-492SPAIN 2020-12-15 10,000 Online Services Art. 13 GDPR, Art. 8 (1) GDPR, Art. 6 (1) a) GDPR Insufficient fulfilment of information obligations
ETid-491 FRANCE 2020-12-17 6,000 Doctor Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-490FRANCE 2020-12-17 3,000 Doctor Art. 32 GDPR, Art. 33 GDPR Insufficient technical and organisational measures to ensure information security
ETid-489 ROMANIA 2020-12-17 100,000 Banca Transilvania SA Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-488LATVIA 2020-12-15 6,250 Unknown Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-487 LATVIA 2020-12-15 15,000 HH Invest SIA Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-486SWEDEN 2020-12-15 29,500 Uppsalahem AB Art. 5 GDPR,
Art. 6 (1) f) GDPR
Insufficient legal basis for data processing
ETid-485 IRELAND 2020-12-15 450,000 Twitter International Company Art. 33 (1), (5) GDPRInsufficient fulfilment of data breach notification obligations
ETid-484GREECE 2020-10-29 1,000 American College of Greece Art. 12 (3), (4) GDPR Insufficient fulfilment of information obligations
ETid-483 POLAND 2020-12-14 443,000 Virgin Mobile Polska Art. 5 (1) f), (2) GDPR,
Art. 25 (1) GDPR,
Art. 32 (1) b), d), (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-482SWEDEN 2020-12-11 54,000 Umeå University Art. 5 (1) f) GDPR,
Art. 32 (1), (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-481 SPAIN 2020-12-11 5,000,000 Banco Bilbao Vizcaya Argentaria, S.A. Art. 6 GDPR, Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-480SPAIN 2020-12-10 4,000 Borjamotor, S.A. Art. 7 GDPR Insufficient legal basis for data processing
ETid-479 BELGIUM 2020-11-13 1,500 Unknown Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 30 GDPR, Art. 37 (5) GDPR, Art. 37 (7) GDPRNon-compliance with general data processing principles
ETid-478SPAIN 2020-12-09 10,000 Unknown Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-477 SPAIN 2020-12-09 40,000 Xfera Moviles S.A. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-476SPAIN 2020-12-02 10,000 Losada Advocats S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-475 SPAIN 2020-11-27 1,200 Private Individual Art. 5 (1) a) GDPRNon-compliance with general data processing principles
ETid-474NORWAY 2020-12-03 18,840 Municipality of Indre Østfold Art. 6 GDPR, Art. 32 (1) b) GDPR Insufficient technical and organisational measures to ensure information security
ETid-473 SWEDEN 2020-12-03 2,900,000 Capio St. Göran AB Art. 5 (1) f) GDPR,
Art. 5 (2) GDPR,
Art. 32 (1) GDPR,
Art. 32 (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-472SWEDEN 2020-12-03 390,100 Karolinska University Hospital of Solna Art. 5 (1) f) GDPR,
Art. 5 (2) GDPR,
Art. 32 (1) GDPR,
Art. 32 (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-471 SWEDEN 2020-12-03 341,300 Sahlgrenska University Hospital Art. 5 (1) f) GDPR,
Art. 5 (2) GDPR,
Art. 32 (1) GDPR,
Art. 32 (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-470SWEDEN 2020-12-03 243,800 Västerbotten Region Art. 5 (1) f) GDPR,
Art. 5 (2) GDPR,
Art. 32 (1) GDPR,
Art. 32 (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-469 SWEDEN 2020-12-03 243,800 Östergötland Region Art. 5 (1) f) GDPR,
Art. 5 (2) GDPR,
Art. 32 (1) GDPR,
Art. 32 (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-468SPAIN 2020-12-03 2,400 Dr Marín Cirugia Plástica, S.L.P. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-467 SWEDEN 2020-12-03 1,168,000 Aleris Sjukvård AB Art. 5 (1) f) GDPR,
Art. 5 (2) GDPR,
Art. 32 (1) GDPR,
Art. 32 (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-466SWEDEN 2020-12-03 1,463,000 Aleris Sjukvård AB Art. 5 (1) f) GDPR,
Art. 5 (2) GDPR,
Art. 32 (1) GDPR,
Art. 32 (2) GDPR
Insufficient technical and organisational measures to ensure information security
ETid-465 SPAIN 2020-12-02 5,000 Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA) Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-464SPAIN 2020-12-02 3,000 Comercio Online Levante, S.L. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-463 SPAIN 2020-12-02 6,000 Servicio de Alojamientos Responsables, S.L. Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-462AUSTRIA 2020-10-19 150 Private Individual Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-461 AUSTRIA 2020-10-19 600 Private Individual Art. 5 (1) a) GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-460BELGIUM 2020-11-25 1,500 Private Individual Art. 6 GDPR, Art. 25 GDPR Insufficient legal basis for data processing
ETid-459 ITALY 2020-11-23 20,000 Burgo Group S.p.A Art. 5 GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-458SPAIN 2020-11-25 40,000 Miraclia Telecomunicaciones S.L. Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR Insufficient legal basis for data processing
ETid-457 FRANCE 2020-11-18 2,250,000 Carrefour France Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR, Art. 33 GDPRNon-compliance with general data processing principles
ETid-456SWEDEN 2020-11-25 19,500 Gnosjö Municipality Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 36 GDPR Insufficient legal basis for data processing
ETid-455 SWEDEN 2020-11-24 394,000 City of Stockholm Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-454FRANCE 2020-11-18 800,000 Carrefour Banque Art. 5 GDPR Non-compliance with general data processing principles
ETid-453 ROMANIA 2020-11-24 5,000 Dada Creation S.R.L. Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-452SPAIN 2020-11-18 2,000 Anmavas 61, S.L. Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-451 ROMANIA 2020-11-23 4,000 Vodafone România SA Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-450SPAIN 2020-11-23 12,000 Recambios Villalegre S.L. Art. 6 GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-449 IRELAND 2020-08-18 65,000 Cork University Maternity Hospital Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-448ITALY 2020-11-17 2,000 Comune di Collegno Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR Insufficient fulfilment of data subjects rights
ETid-447 ITALY 2020-11-17 30,000 Provincial Health Authority of Cosenza Art. 9 GDPRInsufficient legal basis for data processing
ETid-446SPAIN 2020-11-16 42,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-445 SPAIN 2020-11-16 1,600 Homeowners Association Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-444SPAIN 2020-11-11 42,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-443 SPAIN 2020-10-26 50,000 Conseguridad SL Art. 37 GDPRInsufficient involvement of data protection officer
ETid-442SPAIN 2020-10-26 4,000 Organic Natur 03 S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-441 SPAIN 2020-11-10 3,000 Miguel Ibáñez Bezanilla, S.L. Art. 13 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-440UNITED KINGDOM 2020-11-13 1,405,000 Ticketmaster UK Limited Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-439 SPAIN 2020-11-06 20,000 Xfera Moviles S.A. Art. 31 GDPRInsufficient legal basis for data processing
ETid-438ITALY 2020-11-12 12,251,601 Vodafone Italia S.p.A. Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR, Art. 15 (1) GDPR, Art. 16 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 32 GDPR, Art. 33 GDPR Non-compliance with general data processing principles
ETid-437 SPAIN 2020-11-19 36,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-436SPAIN 2020-11-05 75,000 Telefonica Moviles Espana, S.A.U. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-435 SPAIN 2020-11-03 30,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-434SPAIN 2020-10-28 4,000 Play Orenes, S.L. Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-433 ITALY 2020-10-26 20,000 Università Campus Bio-medico di Roma (Polyclinic) Art. 5 (2) a), f) GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-432CYPRUS 2020-10-22 6,000 Cyprus Police Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-431 SPAIN 2020-10-28 36,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-430HUNGARY 2020-10-23 54,800 Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak Art. 12 GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 25 GDPR Insufficient fulfilment of data subjects rights
ETid-429 LITHUANIA 2020-10-21 15,000 Vilnius City Municipality Administration Art. 5 (1) d) GDPR, Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-428ITALY 2020-09-03 2,000 Comune di Casaloldo Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-427 HUNGARY 2020-07-23 1,700 Employer Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-426SPAIN 2020-09-22 7,800 Iweb Internet Learning, S.L. Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-425 ROMANIA 2020-10-20 2,000 Globus Score SRL Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-424SPAIN 2020-10-06 4,000 Callesgarcia, S.L. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-423 SPAIN 2020-10-03 3,000 Avata Hispania, S.L. Art. 5 GDPR, Art. 6 GDPR, Art. 28 (3) g) GDPRInsufficient legal basis for data processing
ETid-422CYPRUS 2020-10-19 15,000 Bank of Cyprus Public Company Ltd Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPR Insufficient technical and organisational measures to ensure information security
ETid-421 CYPRUS 2020-10-19 1,000 Grant Ideas Ltd Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-420ROMANIA 2020-10-15 3,000 S.C. Marsorom S.R.L. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-419 SPAIN 2020-10-09 5,000 Caja Rural San José de Nules S. Cooperativa de Crédito Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-418SPAIN 2020-10-09 50,000 Centro de Investigación y Estudio para la Obesidad, SL Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-417 SPAIN 2020-10-09 2,000 Private Person Art. 5 (1) c) GDPR, Art. 6 GDPRNon-compliance with general data processing principles
ETid-416NORWAY 2020-09-25 13,900 Odin Flissenter AS Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-415 SPAIN 2020-10-09 900 Café Restaurante B.B.B Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-414SPAIN 2020-09-30 3,000 Venu Sanz Chef, S.L. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-413 ROMANIA 2020-10-01 2,000 Asociația de proprietari Militari R Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-412ROMANIA 2020-10-01 3,000 Megareduceri TV S.R.L. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-411 SPAIN 2020-10-06 60,000 Lycamobile Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-410POLAND 2020-06-03 1,168 Entrepreneur running a non-public nursery and pre-school Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-409 HUNGARY 2020-07-16 28 Google Ireland Ltd. Art. 12 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-408SPAIN 2020-09-25 60,000 Xfera Moviles S.A. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-407 ITALY 2020-09-30 60,000 Scanshare s.r.l. Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-406ITALY 2020-09-30 80,000 Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital) Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-405 GERMANY 2020-10-01 35,258,708 H&M Hennes & Mauritz Online Shop A.B. & Co. KG Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-404SPAIN 2020-09-22 60,000 GLP Instalaciones 86, SL Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-403 BELGIUM 2020-09-07 5,000 Former mayor of a community Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-402ITALY 2020-09-07 2,000 Istituto Comprensivo Statale Crucoli Torretta Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-401 ROMANIA 2020-09-08 2,000 Sanatatea Press Group S.R.L. Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-400GREECE 2020-09-11 8,000 Private Person Art. 5 GDPR Non-compliance with general data processing principles
ETid-399 SPAIN 2020-09-11 1,500 Political Party Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-398SPAIN 2020-09-16 10,000 Property owners community Art. 5 GDPR Non-compliance with general data processing principles
ETid-397 SPAIN 2020-09-17 3,000 Grupo Carolizan Art. 5 GDPRNon-compliance with general data processing principles
ETid-396SPAIN 2020-09-17 60,000 Vodafone España, SAU Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-395 ROMANIA 2020-09-01 500 Apartment building owners association Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPRInsufficient legal basis for data processing
ETid-394HUNGARY 2020-07-23 560 Forbes Hungary Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-393 GREECE 2020-08-03 3,000 Candidate for parliamentary elections Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-392POLAND 2020-09-08 11,200 Warsaw University of Life Sciences Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-391 ITALY 2020-07-02 15,000 Mapei S.p.A. Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-390SPAIN 2020-09-07 3,000 Barcelona Airport Security Guard Association ('AVSAB') Art. 5 (1) f) GDPR Non-compliance with general data processing principles
ETid-389 SPAIN 2020-09-01 75,000 Telefónica Móviles España, SAU Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-388SPAIN 2020-07-31 1,500 Tour & People Max S.L. Art. 21 GDPR Insufficient fulfilment of data subjects rights
ETid-387 POLAND 2020-08-31 22,700 Surveyor General of Poland ('GKK') Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-386SPAIN 2020-08-28 5,000 Basketball Federation of Castilla and Leon Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-385 SPAIN 2020-08-28 50,000 Bankia S.A. Art. 5 (1) b) GDPRNon-compliance with general data processing principles
ETid-384ESTONIA 2020-08-17 48 Police Officer Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-383 SPAIN 2020-08-17 5,000 Party of the Socialists of Catalonia Art. 5 (1) b) GDPRNon-compliance with general data processing principles
ETid-382SPAIN 2020-07-31 45,000 Vodafone España SAU Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-381 POLAND 2020-07-15 22,300 Office for geodesy and cartography Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-380BELGIUM 2020-07-28 3,000 Communal political association Art. 5 GDPR, Art. 6 GDPR, Art. 14 GDPR Insufficient legal basis for data processing
ETid-379 ITALY 2020-07-29 4,000 Region of Campania Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-378ITALY 2020-07-29 3,000 Community of San Giorgio Jonico Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-377 ITALY 2020-07-30 2,000 Community of Manduria Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-376ITALY 2020-08-04 1,000 Supermarket Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-375 ITALY 2020-08-04 5,000 National Institute for Social Security - Department of the Province of Brescia Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-374ITALY 2020-08-04 15,000 Mapei S.p.A. Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR Insufficient legal basis for data processing
ETid-373 ITALY 2020-08-05 2,000 School Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-372AUSTRIA 2020-08-05 100 Bank Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-371 SPAIN 2020-08-05 3,000 Restaurant Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-370FINLAND 2020-08-05 7,000 Acc Consulting Varsinais-Suomi Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-369 SPAIN 2020-08-06 3,000 Just Landed S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-368ITALY 2020-08-06 3,000 GTL S.R.L. Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-367 ITALY 2020-08-10 10,000 Community of Baronissi Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-366ITALY 2020-08-10 10,000 Cavauto S.R.L. Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR Insufficient legal basis for data processing
ETid-365 SPAIN 2020-08-04 60,000 Vodafone España, SAU Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-364SPAIN 2020-08-06 3,000 GROW BEATS SL Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR Insufficient fulfilment of information obligations
ETid-363 DENMARK 2020-08-04 20,100 PrivatBo A.M.B.A. Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-362FRANCE 2020-08-05 250,000 Spartoo Art. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR Non-compliance with general data processing principles
ETid-361 DENMARK 2020-07-28 147,800 Arp Hansen Hotel Group A/S Art. 5 (1) e) GDPRNon-compliance with general data processing principles
ETid-360ROMANIA 2020-07-27 5,000 SC Cntar Tarom SA Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-359 ROMANIA 2020-07-30 2,000 Romanian Post National Company Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-358ROMANIA 2020-07-30 2,000 SC Viva Credit IFN SA Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-357 BELGIUM 2020-07-14 5,000 Operator of CCTV of a residential building Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processing
ETid-356SPAIN 2020-07-23 5,000 El Real Sporting de Gijón S.A.D. Art. 6 GDPR, Art. 7 GDPR Insufficient legal basis for data processing
ETid-355 SPAIN 2020-07-23 5,000 Xfera Moviles S.A. Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-354SPAIN 2020-07-23 75,000 Telefónica Móviles España, SAU Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-353 SPAIN 2020-07-23 70,000 Telefónica Móviles España, SAU Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-352SPAIN 2020-07-23 55,000 Telefónica Móviles España, SAU Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-351 SPAIN 2020-07-23 10,000 El Periódico de Catalunya, S.L.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-350SPAIN 2020-07-20 70,000 Xfera Moviles S.A. Art. 5 GDPR Non-compliance with general data processing principles
ETid-349 SPAIN 2020-07-20 80,000 Orange Espagne S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-348GREECE 2020-06-29 5,000 New York College S.A. Art. 5 GDPR Non-compliance with general data processing principles
ETid-347 SPAIN 2020-07-20 1,500 Comercial Vigobrandy, SL Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligations
ETid-346SPAIN 2020-07-20 40,000 Iberia Lae SA Operadora Unipersonal Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-345 SPAIN 2020-07-20 24,000 Banco Bilbao Vizcaya Argentaria, SA Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-344BELGIUM 2020-07-14 600,000 Google Belgium SA Art. 5 GDPR, Art. 6 GDPR, Art. 17 (1) a) GDPR, Art. 12 GDPR Insufficient fulfilment of data subjects rights
ETid-343 SPAIN 2020-07-10 55,000 Xfera Moviles S.A. Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-342SPAIN 2020-07-10 5,000 School Fitness Holiday & Franchising S.L. Art. 5 GDPR Non-compliance with general data processing principles
ETid-341 SPAIN 2020-07-10 5,000 Global Business Travel Spain SLU Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-340SPAIN 2020-07-10 12,000 Vodafone España, SAU Art. 5 GDPR Non-compliance with general data processing principles
ETid-339 SPAIN 2020-07-10 1,000 Centro Internacional De Crecimiento Laboral Y Profesional S.L. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-338SPAIN 2020-07-10 1,500 Auto Desguaces Iglesias S.L. Art. 5 GDPR Non-compliance with general data processing principles
ETid-337 ITALY 2020-07-13 800,000 Iliad Italia S.p.A. Art. 5 GDPR, Art. 25 GDPRNon-compliance with general data processing principles
ETid-336ITALY 2020-07-13 16,700,000 Wind Tre S.p.A. Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 24 GDPR, Art. 25 GDPR Insufficient legal basis for data processing
ETid-335 ITALY 2020-07-13 200,000 Merlini s.r.l. Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 28 GDPR, Art. 29 GDPRInsufficient legal basis for data processing
ETid-334THE NETHERLANDS 2020-07-06 830,000 Bureau Krediet Registration ('BKR') Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-333 NORWAY 2020-07-10 46,660 Municipality of Rælingen Art. 32 GDPR, Art. 35 GDPRInsufficient technical and organisational measures to ensure information security
ETid-332POLAND 2020-07-10 3,400 East Power Sp. z o.o. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-331 ROMANIA 2020-07-09 15,000 Proleasing Motors SRL Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-330SPAIN 2020-07-02 5,000 Xfera Moviles S.A. Art. 31 GDPR, Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-329 SPAIN 2020-07-02 3,600 Saunier-Tec Mantenimientos de Calor y Frio, SL. Art. 33 GDPRInsufficient fulfilment of data breach notification obligations
ETid-328NORWAY 2020-07-02 Only intention to issue fine Odin Flissenter AS Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-327 SPAIN 2020-07-02 4,000 De Vere Spain S.L. Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-326SPAIN 2020-07-02 24,000 Iberdrola Clientes Art. 5 GDPR Non-compliance with general data processing principles
ETid-325 ITALY 2020-03-05 3,000 San Giorgio Jonico Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPRInsufficient legal basis for data processing
ETid-324ITALY 2020-01-30 4,000 Comune di Colledara Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-323 SPAIN 2020-06-19 6,000 National Police Brigade Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-322NORWAY 2020-06-19 Only intention to issue fine Aquateknikk AS Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-321 NORWAY 2020-06-22 112,000 Østfold HF Hospital Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-320IRELAND 2020-06-30 40,000 Tusla Child and Family Agency Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-319 DENMARK 2020-06-30 6,700 Lejre Municipality Art. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPRNon-compliance with general data processing principles
ETid-318ISLE OF MAN 2020-06-25 13,500 Department of Home Affairs Art. 12 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-317 BELGIUM 2020-06-08 5,000 Municipal employee Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-316BELGIUM 2020-06-16 1,000 Unknown Art. 17 GDPR, Art. 21 GDPR, Art. 31 GDPR Insufficient fulfilment of data subjects rights
ETid-315 BELGIUM 2020-06-19 10,000 Unknown Art. 5 GDPR, Art. 6 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-314SWEDEN 2020-06-16 1,900 Housing Association Art. 5 GDPR, Art. 6 GDPR Non-compliance with general data processing principles
ETid-313 HUNGARY 2020-06-12 288,000 Digi Távközlési Szolgáltató Kft. ('Digi') (electronic communication service provider) Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPRInsufficient technical and organisational measures to ensure information security
ETid-312ROMANIA 2020-06-11 3,000 Telekom Romania Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-311 SPAIN 2020-06-15 75,000 Xfera Moviles S.A. Art. 6 GDPRInsufficient legal basis for data processing
ETid-310ROMANIA 2020-06-18 4,000 Enel Energie Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-309 SPAIN 2020-06-16 2,000 Café Bar Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principles
ETid-308SPAIN 2020-06-22 2,000 Comunidad de propietarios demelza beach Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR Non-compliance with general data processing principles
ETid-307 SPAIN 2020-06-23 7,500 Miraclia (telecommunications company) Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-306GERMANY 2020-06-30 1,240,000 Allgemeine Ortskrankenkasse ('AOK') (health insurance company) Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-305 HUNGARY 2020-01-24 1,450 Accounting firm Art. 24 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-304HUNGARY 2020-03-19 5,800 Unknown Company Art. 6 GDPR, Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-303 HUNGARY 2020-03-26 2,890 Bank Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-302ESTONIA 2020-04-30 500 Housing Association Art. 6 GDPR Insufficient legal basis for data processing
ETid-301 ROMANIA 2020-04-23 3,000 Telekom Romania Communications SA Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-300SPAIN 2020-06-09 2,000 Property Owner Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-299 SPAIN 2020-06-09 2,000 Attorney Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-298SPAIN 2020-06-09 3,000 Salad Market S.L. (Catering Company) Art. 13 GDPR, Art. 14 GDPR Insufficient fulfilment of information obligations
ETid-297 ROMANIA 2020-04-23 3,000 Estee Lauder Romania Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-296BELGIUM 2020-05-14 50,000 Social Media Provider Art. 6 GDPR Insufficient legal basis for data processing
ETid-295 BULGARIA 2020-04-14 2,000 Political Party Art. 6 GDPRInsufficient legal basis for data processing
ETid-294NORWAY 2020-05-03 134,000 Telenor Norge AS Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-293 SPAIN 2020-06-09 40,000 TELEFONICA MOVILES ESPAÑA, S.A.U. Art. 6 GDPRInsufficient legal basis for data processing
ETid-292NORWAY 2020-09-03 276,000 Bergen Municipality Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-291 SPAIN 2020-06-04 4,000 Iberdrola Clientes Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-290SPAIN 2020-06-09 25,000 Glovoapp23 Art. 37 GDPR Insufficient involvement of data protection officer
ETid-289 SPAIN 2020-06-09 39,000 Xfera Moviles S.A. Art. 5 (1) f) GDPRInsufficient legal basis for data processing
ETid-288SPAIN 2020-06-09 75,000 Equifax Iberica, S.L. Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-287 SPAIN 2020-06-09 1,000 Property Owner Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-286SPAIN 2020-06-09 540 Chenming Ye (Bazar Real) Art. 13 GDPR, Art. 14 GDPR Insufficient fulfilment of information obligations
ETid-285 SPAIN 2020-06-09 5,000 Consulting de Seguridad e Investigacion Mira Dp Madrid S.L. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-284HUNGARY 2020-03-09 870 Creditor Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-283 FINLAND 2020-05-29 72,000 Taksi Helsinki Art. 5 GDPR, Art. 6 GDPR, Art. 35 GDPRNon-compliance with general data processing principles
ETid-282BELGIUM 2020-05-29 1,000 Non-profit organisation Art. 6 GDPR, Art. 21 GDPR Insufficient fulfilment of data subjects rights
ETid-281 FINLAND 2020-05-22 12,500 Unknown Company Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-280FINLAND 2020-05-22 16,000 Kymen Vesi Oy Art. 35 GDPR Non-compliance with general data processing principles
ETid-279 FINLAND 2020-05-22 100,000 Posti Group Oyj Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-278IRELAND 2020-05-17 75,000 Tusla Child and Family Agency Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-277 DENMARK 2020-05-15 6,700 JobTeam A/S DKK Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-276SWEDEN 2020-05-12 11,200 Health and Medical Board of the Region of Örebro County Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-275 ROMANIA 2020-05-05 5,000 Banca Comercială Română SA Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-274THE NETHERLANDS 2020-04-30 725,000 Unknown Organisation Art. 5 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-273 SWEDEN 2020-04-29 18,700 National Government Service Centre (NGSC) Art. 33 GDPR, Art. 34 GDPRInsufficient fulfilment of data breach notification obligations
ETid-272BELGIUM 2020-04-28 50,000 Proximus SA Art. 31 GDPR, Art. 58 GDPR, Art. 37 GDPR Insufficient involvement of data protection officer
ETid-271 GERMANY 2019 50,000 Unknown Company Art. 15 GDPR, Art. 28 GDPRInsufficient fulfilment of data subjects rights
ETid-270BULGARIA 2020-01-06 5,110 Utility Company Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-269 BULGARIA 2020-02-20 2,560 L.E. EOOD Art. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPRInsufficient technical and organisational measures to ensure information security
ETid-268BULGARIA 2020-02-20 2,560 T.K. EOOD Art. 25 (1) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-267 POLAND 2020-03-09 4,400 Vis Consulting Sp. z o.o. Art. 31 GDPR, Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-266SPAIN 2020-03-25 5,000 Xfera Moviles S.A. Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-265 ITALY 2020-02-13 4,000 Comune di Urago Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-264ROMANIA 2020-03-25 3,000 Dante International Art. 6 GDPR, Art. 21 GDPR Insufficient legal basis for data processing
ETid-263 ROMANIA 2020-03-25 4,150 Vodafone Romania Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-262ROMANIA 2020-03-25 3,000 Enel Energie Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-261 ROMANIA 2020-03-25 2,000 SOS Infertility Association Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-260HUNGARY 2020-03-04 290 Representative of a local government Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR Insufficient legal basis for data processing
ETid-259 HUNGARY 2019-10-15 2,860 Unknown Company Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPRNon-compliance with general data processing principles
ETid-258HUNGARY 2019-08-08 1,715 Government Office Managing the Real Estate Register Art. 5 GDPR, Art. 14 GDPR Non-compliance with general data processing principles
ETid-257 HUNGARY 2019-08-02 4,290 Public area maintenance company Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-256HUNGARY 2019-07-17 8,575 Budapest Environs Regional Court Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-255 HUNGARY 2019-06-26 2,850 Financial Enterprise Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPRInsufficient legal basis for data processing
ETid-254HUNGARY 2019-06-26 2,850 Unknown Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR Insufficient legal basis for data processing
ETid-253 HUNGARY 2019-06-03 2,850 Claim management company Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-252HUNGARY 2019-05-31 2,000 Local bank Art. 12 (3), (4), (5) GDPR, Art. 15 GDPR, Art. 18 GDPR Insufficient fulfilment of data subjects rights
ETid-251 HUNGARY 2019-05-21 286 Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest Art. 33 GDPRInsufficient fulfilment of data breach notification obligations
ETid-250GREECE 2020-03-20 8,000 Speech and Special Education Centre - Mihou Dimitra Art. 15 GDPR, Art. 58 GDPR Insufficient fulfilment of data subjects rights
ETid-249 ITALY 2020-02-06 20,000 RTI - Reti Televisive Italiane s.p.a. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-248SPAIN 2020-03-19 6,000 Oliveros Ustrell, S.L. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-247 SPAIN 2020-03-16 6,000 Amalfi Servicios de Restauracion S.L. Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPRNon-compliance with general data processing principles
ETid-246SPAIN 2020-03-12 2,000 Homeowners Association Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR Non-compliance with general data processing principles
ETid-245 SPAIN 2020-03-06 3,200 Retailer Art. 13 GDPR, Art. 14 GDPRInsufficient fulfilment of information obligations
ETid-244SPAIN 2020-03-16 4,000 Private Person Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-243 SPAIN 2020-03-16 5,000 Centro De Estudio Dirigidos Delta, S.L. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-242GREECE 2020-02-21 5,000 Public Power Corporation S.A. Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-241 ROMANIA 2020-02-11 3,000 Vodafone Romania Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-240SPAIN 2020-03-18 30,000 Telefónica Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-239 CROATIA 2020-03-13 Unknown Bank (name not available at the moment) Art. 15 (1), (3) GDPRInsufficient fulfilment of data subjects rights
ETid-238GERMANY 2019-08-05 200 Private person (YouTube-Channel) Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-237 NORWAY 2020-02-28 Only intention to issue fine Coop Finnmark SA Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-236GERMANY 2019 2,000 Restaurant Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-235 NORWAY 2020-02-26 Only intention to issue fine Rælingen Municipality Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-234ICELAND 2020-03-10 9,000 Breiðholt Upper Secondary School Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-233 ICELAND 2020-03-10 20,600 National Center of Addiction Medicine ('SAA') Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-232SWEDEN 2020-03-11 5,000,000 Google LLC Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-231 DENMARK 2020-03-10 14,000 Gladsaxe Municipality Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-230DENMARK 2020-03-10 7,000 Hørsholm Municipality Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-229 SPAIN 2020-03-09 15,000 Gesthotel Activos Balagares Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-228SPAIN 2020-03-06 4,000 Private individual Art. 5 GDPR Non-compliance with general data processing principles
ETid-227 ITALY 2020-03-06 4,000 Liceo Scientifico Nobel di Torre del Greco Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-226ITALY 2020-03-06 4,000 Liceo Artistico Statale di Napoli Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-225 SPAIN 2020-03-04 60,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-224POLAND 2020-03-04 0 School in Gdansk (Danzig) (fine imposed against town of Gdansk) Art. 5 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-223 SPAIN 2020-03-03 24,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-222SPAIN 2020-03-03 40,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-221 SPAIN 2020-03-03 42,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-220SPAIN 2020-03-03 1,800 Solo Embrague Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-219 SPAIN 2020-02-28 3,600 AEMA Hispánica Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-218THE NETHERLANDS 2020-03-03 525,000 Royal Dutch Tennis Association ('KNLTB') Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-217 SPAIN 2020-02-25 6,000 Casa Gracio Operation Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-216SPAIN 2020-02-25 48,000 HM Hospitales Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-215 SPAIN 2020-02-28 48,000 Vodafone ONO, S.A.U. Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-214SPAIN 2020-02-27 120,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-213 ITALY 2020-01-23 30,000 Sapienza Università di Roma Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-212ITALY 2020-01-23 30,000 Azienda Ospedaliero Universitaria Integrata di Verona (Hospital) Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-211 SPAIN 2020-02-14 30,000 Xfera Moviles S.A. Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-210SPAIN 2020-02-14 42,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-209 SPAIN 2020-02-14 80,000 Iberdrola Clientes Art. 6 GDPRInsufficient legal basis for data processing
ETid-208SPAIN 2020-02-18 1,500 Mymoviles Europa 2000, S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-207 SPAIN 2020-02-14 3,000 Colegio Arenales Carabanchel (School) Art. 6 GDPRInsufficient legal basis for data processing
ETid-206SPAIN 2020-02-14 2,500 Grupo Valsor Y Losan, S.L. Art. 5 (1) f) GDPR Insufficient technical and organisational measures to ensure information security
ETid-205 GERMANY 2019 Unknown Hamburger Volksbank eG Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-204GERMANY 2019 20,000 Hamburger Verkehrsverbund GmbH (HVV GmbH) Art. 33 GDPR, Art. 34 GDPR Insufficient fulfilment of data breach notification obligations
ETid-203 GERMANY 2019 51,000 Facebook Germany GmbH Art. 37 GDPRInsufficient involvement of data protection officer
ETid-202ITALY 2020-01-15 10,000 Community of Francavilla Fontana Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-201 SPAIN 2020-02-04 1,500 Cafetería Nagasaki Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-200SPAIN 2020-02-03 800 Automoción Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-199 SPAIN 2020-02-03 5,000 Queseria Artesenal Ameco S.L. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-198SPAIN 2020-02-03 6,670 Banco Bilbao Vizcaya Argentaria S.L. Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR Insufficient legal basis for data processing
ETid-197 SPAIN 2020-02-03 75,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-196SPAIN 2020-02-03 20,000 Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR Insufficient legal basis for data processing
ETid-195 SPAIN 2020-02-03 50,000 Vodafone España, S.A.U. Art. 5 GDPRNon-compliance with general data processing principles
ETid-194SPAIN 2020-02-03 60,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-193 SPAIN 2020-02-03 75,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-192SPAIN 2020-02-03 60,000 Xfera Moviles S.A. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-191 SPAIN 2020-01-14 3,600 Zhang Bordeta 2006, S.L. (Store and Restaurant) Art. 5 GDPRNon-compliance with general data processing principles
ETid-190GERMANY 2019-10-24 100,000 Food company Art. 5 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-189 ITALY 2020-01-15 27,800,000 TIM (telecommunications operator) Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPRInsufficient legal basis for data processing
ETid-188GREECE 2019-12-19 150,000 Aegean Marine Petroleum Network Inc. Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-187 ITALY 2019-12-11 3,000,000 Eni Gas e Luce Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-186ITALY 2019-12-11 8,500,000 Eni Gas e Luce Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR Insufficient legal basis for data processing
ETid-185 ROMANIA 2019-12-13 5,000 Entirely Shipping & Trading S.R.L. Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPRNon-compliance with general data processing principles
ETid-184ROMANIA 2019-12-13 5,000 Entirely Shipping & Trading S.R.L. Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR Non-compliance with general data processing principles
ETid-183 GREECE 2020-01-13 15,000 Allseas Marine S.A. Art. 5 (1) a), (2) GDPRNon-compliance with general data processing principles
ETid-182CYPRUS 2020-01-13 1,000 eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD) Art. 6 GDPR Insufficient legal basis for data processing
ETid-181 CYPRUS 2019-10-25 2,000 LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-180CYPRUS 2019-10-25 10,000 LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Art. 6 GDPR, Art. 9 GDPR Insufficient legal basis for data processing
ETid-179 CYPRUS 2019-10-25 70,000 LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd Art. 6 GDPR, Art. 9 GDPRInsufficient legal basis for data processing
ETid-178CYPRUS 2020-01-13 9,000 Social Insurance Services of the Ministry of Labor, Welfare and Social Insurance Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-177 ROMANIA 2019-12-16 6,000 SC Enel Energie S.A. (Electricity Distributor) Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 21 GDPRInsufficient legal basis for data processing
ETid-176ROMANIA 2019-12-10 14,000 Hora Credit IFN SA Art. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR Insufficient technical and organisational measures to ensure information security
ETid-175 SPAIN 2020-01-07 10,000 Asociación de Médicos Demócratas Art. 6 GDPRInsufficient legal basis for data processing
ETid-174SPAIN 2020-01-07 75,000 EDP Comercializadora, S.A.U. Art. 6 GDPR Insufficient legal basis for data processing
ETid-173 SPAIN 2020-01-07 75,000 EDP España S.A.U. Art. 6 GDPRInsufficient legal basis for data processing
ETid-172SPAIN 2020-01-09 3,000 Vodafone España, S.A.U. Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-171 SPAIN 2020-01-07 44,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-170GERMANY 2019 294,000 Unknown Art. 5 GDPR Non-compliance with general data processing principles
ETid-169 BELGIUM 2019-12-17 15,000 Website providing legal information Art. 6 GDPR,
Art. 12 GDPR, Art. 13 GDPR
Insufficient fulfilment of information obligations
ETid-168BULGARIA 2019-10-08 5,112 The Ministry of Interior Affairs Art. 5 (1) GDPR, Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-167 BULGARIA 2019-10-07 511 B.D. Art. 31 GDPRInsufficient cooperation with supervisory authority
ETid-166BULGARIA 2019-10-28 511 Employer Art. 12 (3) GDPR, Art. 15 (1) GDPR Insufficient fulfilment of data subjects rights
ETid-165 BULGARIA 2019-09-03 1,121 Private enforcement agent Art. 12 (4) GDPR, Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-164BULGARIA 2019-09-03 11,760 Commercial representative of telecommunication service provider Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-163 BULGARIA 2019-09-03 5,113 Telecommunication service provide Art. 6 (1) GDPR, Art. 25 (1) GDPRInsufficient legal basis for data processing
ETid-162BULGARIA 2019-09-03 1,022 Telecommunication service provide Art. 6 (1) GDPR, Art. 25 (1) GDPR Insufficient legal basis for data processing
ETid-161 SPAIN 2019-12-10 5,000 Shop Macoyn, S.L. Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-160ROMANIA 2019-11-29 500 Homeowners Association Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-159 BELGIUM 2019-12-17 2,000 Nursing Care Organisation Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-158UNITED KINGDOM 2019-12-17 320,000 Doorstep Dispensaree Ltd. (Pharmacy) Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-157 HUNGARY 2019-12-11 1,430 Unknown Company Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPRNon-compliance with general data processing principles
ETid-156ROMANIA 2019-12-18 2,000 Telekom Romania Mobile Communications SA Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-155 GREECE 2019-10-18 20,000 Wind Hellas Telecommunications Art. 21 GDPRInsufficient fulfilment of data subjects rights
ETid-154THE NETHERLANDS 2019-10-31 50,000 Menzis (Health Insurance Company) Art. 5 GDPR Non-compliance with general data processing principles
ETid-153 SPAIN 2019-10-23 60,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-152SPAIN 2019-11-06 60,000 Vodafone España, S.A.U. Art. 6 GDPR Insufficient legal basis for data processing
ETid-151 SPAIN 2019-11-19 6,000 Sports Bar Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-150HUNGARY 2019-10-24 7,400 Military Hospital Art. 32 GDPR, Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-149 ROMANIA 2019-12-02 2,000 Nicola Medical Team 17 SRL Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-148ROMANIA 2019-11-26 3,000 Modern Barber Art. 58 GDPR Insufficient cooperation with supervisory authority
ETid-147 SPAIN 2019-12-10 1,600 Megastar SL Art. 5 (1) c) GDPR, Art. 13 GDPRNon-compliance with general data processing principles
ETid-146SPAIN 2019-12-03 5,000 Linea Directa Aseguradora Art. 6 GDPR Insufficient legal basis for data processing
ETid-145 ROMANIA 2019-12-16 2,000 Globus Score SRL Art. 58 GDPRInsufficient cooperation with supervisory authority
ETid-144SWEDEN 2019-12-16 35,000 Nusvar AB Art. 6 GDPR Insufficient legal basis for data processing
ETid-143 GERMANY 2019 800 Police Officer Art. 6 GDPRInsufficient legal basis for data processing
ETid-142SPAIN 2019-12-03 1,500 Cerrajeria Verin S.L. Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-141 SPAIN 2019-11-28 75,000 Curenergía Comercializador de último recurso Art. 6 GDPRInsufficient legal basis for data processing
ETid-140BULGARIA 2019-09-03 28,100 National Revenue Agency Art. 6 (1) GDPR, Art. 58 (2) e) GDPR Insufficient legal basis for data processing
ETid-139 HUNGARY 2019-10 15,100 Town of Kerepes Art. 6 (1) GDPRInsufficient legal basis for data processing
ETid-138SPAIN 2019 3,600 AMADOR RECREATIVOS, S.L Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-137 SPAIN 2019 9,000 Employer Art. 5 (1) c) GDPRNon-compliance with general data processing principles
ETid-136SPAIN 2019 20,000 Employer Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-135 SPAIN 2019 40,000 Vodafone España, S.A.U. Art. 6 GDPRInsufficient legal basis for data processing
ETid-134SPAIN 2019 30,000 Vodafone España, S.A.U. Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-133 SPAIN 2019 48,000 TELEFONICA MOVILES ESPAÑA, S.A.U. Art. 5 (1) a) GDPRNon-compliance with general data processing principles
ETid-132SPAIN 2019 48,000 VODAFONE ONO, S.A.U. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-131 SPAIN 2019 36,000 VODAFONE ONO, S.A.U. Art. 5 (1) f) GDPRNon-compliance with general data processing principles
ETid-130SPAIN 2019 21,000 Vodafone España, S.A.U. Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-129 GERMANY 2019-12-09 10,000 Rapidata GmbH Art. 37 GDPRInsufficient involvement of data protection officer
ETid-128GERMANY 2020-11-11 900,000 Telecoms provider (1&1 Telecom GmbH) Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-127 ROMANIA 2019-11-29 2,500 Royal President S.R.L. Art. 15 GDPR, Art. 6 GDPR, Art. 32 GDPRInsufficient fulfilment of data subjects rights
ETid-126ROMANIA 2019-11-28 0 ING Bank N.V. Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-125 ROMANIA 2019-12-04 20,000 S CNTAR TAROM SA (Airline) Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-124BELGIUM 2019-11-28 5,000 Municipal alderman Art. 6 GDPR Insufficient legal basis for data processing
ETid-123 BELGIUM 2019-11-28 5,000 Mayor Art. 6 GDPRInsufficient legal basis for data processing
ETid-122GERMANY 2019-12-03 105,000 Hospital Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-121 SPAIN Unknown 10,000 Ikea Ibérica Art. 6 GDPRInsufficient legal basis for data processing
ETid-120LATVIA 2019-11 150,000 Unknown Art. 6 GDPR Insufficient legal basis for data processing
ETid-119 SPAIN 2019-11-19 60,000 Xfera Moviles S.A. Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-118FRANCE 2019-11-21 500,000 Futura Internationale Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR, Art. 31 GDPR, Art. 44 GDPR Insufficient fulfilment of data subjects rights
ETid-117 SPAIN 2019-11-14 30,000 Telefónica SA Art. 5 GDPRNon-compliance with general data processing principles
ETid-116ROMANIA 2019-11-22 2,000 BNP Paribas Personal Finance S.A. Art. 12 GDPR, Art. 17 GDPR Insufficient fulfilment of data subjects rights
ETid-115 ROMANIA 2019-11-25 11,000 FAN Courier Express SRL Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-114SPAIN 2019-11-21 60,000 Viaqua Xestión Integral Augas de Galicia Art. 6 GDPR Insufficient legal basis for data processing
ETid-113 SPAIN 2019-11-19 60,000 Corporación radiotelevisión espanola Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-112CZECH REPUBLIC Unknown 980 Individual entrepreneur - no further details published Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-111 CZECH REPUBLIC Unknown 588 Alza.cz a.s. Art. 6 GDPR, Art. 7 GDPRInsufficient legal basis for data processing
ETid-110SPAIN 2019-11-13 3,000 General Confederation of Labour ('CGT') Art. 6 GDPR Insufficient legal basis for data processing
ETid-109 SLOVAKIA Unknown 50,000 Social Insurance Agency Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-108PORTUGAL 2019-03-19 2,000 Unknown Art. 13 GDPR Insufficient fulfilment of information obligations
ETid-107 THE NETHERLANDS 2019-10-31 900,000 UWV (Dutch employee insurance service provider) Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-106SPAIN 2019-10-31 6,000 Jocker Premium Invex Art. 6 GDPR Insufficient legal basis for data processing
ETid-105 SPAIN 2019-11-06 900 Cerrajero Online Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-104SPAIN Unknown 12,000 Madrileña Red de Gas Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-103 SPAIN 2019-11-07 900 TODOTECNICOS24H S.L. Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-102POLAND 2019-10-16 47,000 ClickQuickNow Art. 5 GDPR Non-compliance with general data processing principles
ETid-101 GERMANY 2019 80,000 Unknown Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-100SPAIN 2019-10-25 36,000 Vodafone España, S.A.U. Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-99 GERMANY 2019-10-30 Unknown Deutsche Wohnen SE Art. 5 GDPRNon-compliance with general data processing principles
ETid-98GERMANY 2021-02-23 0 Deutsche Wohnen SE Art. 5 GDPR, Art. 25 GDPR Non-compliance with general data processing principles
ETid-97 POLAND 2019-10-18 9,380 Major of Aleksandrów Kujawski Art. 28 GDPRInsufficient data processing agreement
ETid-96AUSTRIA 2019-10-29 0 Austrian Post Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-95 SLOVAKIA Unknown 40,000 Slovak Telekom Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-94SPAIN 2019-10-16 8,000 Iberdrola Clientes Art. 31 GDPR Insufficient cooperation with supervisory authority
ETid-93 SPAIN 2019-10-16 60,000 Xfera Moviles S.A. Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-92SLOVAKIA Unknown Unknown Unknown Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR Insufficient legal basis for data processing
ETid-91 SLOVAKIA Unknown Unknown Unknown Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-90SLOVAKIA Unknown Unknown Unknown Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-89 SLOVAKIA Unknown Unknown Unknown Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-88ROMANIA 2019-09-26 9,000 Inteligo Media SA Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR Insufficient legal basis for data processing
ETid-87 CYPRUS 2019 14,000 Doctor Art. 5 GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-86SPAIN 2019-10-01 30,000 Vueling Airlines Art. 5 GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-85 ROMANIA 2019-10-09 20,000 Vreau Credit SRL Art. 32 GDPR, Art. 33 GDPRInsufficient technical and organisational measures to ensure information security
ETid-84ROMANIA 2019-10-09 15,000 Raiffeisen Bank SA Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-83 GREECE 2019-10-07 200,000 Telecommunication Service Provider Art. 21 (3) GDPR, Art. 25 GDPRNon-compliance with general data processing principles
ETid-82GREECE 2019-10-07 200,000 Telecommunication Service Provider Art. 5 (1) c) GDPR, Art. 25 GDPR Non-compliance with general data processing principles
ETid-81 SPAIN Unknown 9,600 Restaurant (SANTI 3000, S.L.) Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-80BELGIUM 2019-09-17 10,000 Merchant Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-79 POLAND 2019-09-10 660,000 Morele.net Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-78GERMANY 2019-09-19 195,407 Delivery Hero Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR Insufficient fulfilment of data subjects rights
ETid-77 PORTUGAL 2019-03-25 2,000 Unknown Art. 13 GDPRInsufficient fulfilment of information obligations
ETid-76PORTUGAL 2019-02-05 20,000 Unknown Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-75 NORWAY 2019-04-29 120,000 Oslo Municipal Education Department Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-74HUNGARY 2019-06-25 15,150 Unknown Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-73 LATVIA 2019-08-26 7,000 Online Services Art. 17 GDPRInsufficient fulfilment of data subjects rights
ETid-72BULGARIA 2019-08-28 511,000 DSK Bank Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-71 BULGARIA 2019-08-28 2,600,000 National Revenue Agency Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-70SPAIN 2019-08-16 60,000 AVON COSMETICS Art. 6 GDPR Insufficient legal basis for data processing
ETid-69 AUSTRIA 2019-07 11,000 Private person (soccer coach) Art. 6 GDPRInsufficient legal basis for data processing
ETid-68AUSTRIA 2019-08 25,000 Company in the medical sector Art. 13 GDPR, Art. 35 GDPR, Art. 37 GDPR Insufficient fulfilment of information obligations
ETid-67 SWEDEN 2019-08-20 18,630 School in Skellefteå Art. 5 (1) c) GDPR, Art. 9 GDPR, Art. 35 GDPR, Art. 36 GDPRInsufficient legal basis for data processing
ETid-66ROMANIA 2019-10-17 2,500 UTTIS INDUSTRIES SRL Art. 12 GDPR, Art. 13 GDPR, Art. 5 (1) c) GDPR, Art. 6 GDPR Insufficient fulfilment of information obligations
ETid-65 GREECE 2019-07-30 150,000 PWC Business Solutions Art. 5 (1) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPRInsufficient legal basis for data processing
ETid-64FRANCE 2019-07-25 180,000 ACTIVE ASSURANCES (car insurer) Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-63 THE NETHERLANDS 2019-06-18 350,000 Haga Hospital Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-62ROMANIA 2019-07-05 3,000 LEGAL COMPANY & TAX HUB SRL Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-61 HUNGARY 2019-05-23 92,146 Organizer of SZIGET festival and VOLT festival Art. 6 GDPR, Art. 5 (1) b) GDPR, Art. 13 GDPRInsufficient legal basis for data processing
ETid-60UNITED KINGDOM 2020-10-30 20,450,000 Marriott International, Inc Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-59 ROMANIA 2019-07-02 15,000 WORLD TRADE CENTER BUCHAREST SA Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-58UNITED KINGDOM 2020-10-16 22,046,000 British Airways Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-57 ROMANIA 2019-06-27 130,000 UNICREDIT BANK SA Art. 25 (1) GDPR, Art. 5 (1) c) GDPRInsufficient technical and organisational measures to ensure information security
ETid-56SPAIN Unknown 60,000 ENDESA (energy supplyer) Art. 5 (1) f) GDPR Insufficient legal basis for data processing
ETid-55 BULGARIA 2019-03-26 5,100 A.P. EOOD Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-54BULGARIA 2019-04-08 510 Medical centers Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 9 (2) GDPR, Art. 6 (1) GDPR Insufficient legal basis for data processing
ETid-53 HUNGARY 2019-04-05 1,900 Unknown Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-52HUNGARY 2019-04-17 9,400 Unknown Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-51 FRANCE 2019-06-13 20,000 Employer UNIONTRAD COMPANY Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPRInsufficient legal basis for data processing
ETid-50GERMANY 2019-05-09 1,400 Police Officer Art. 6 GDPR Insufficient legal basis for data processing
ETid-49 SPAIN Unknown 27,000 Vodafone España, S.A.U. Art. 5 (1) d) GDPRInsufficient fulfilment of data subjects rights
ETid-48SPAIN Unknown 60,000 Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL) Art. 5 (1) f) GDPR Insufficient legal basis for data processing
ETid-47 SPAIN 2019-06-11 250,000 Professional Football League (LaLiga) Art. 5 (1) a) GDPR, Art. 7 (3) GDPRInsufficient fulfilment of information obligations
ETid-46SPAIN Unknown 5,000 Vodafone España, S.A.U. Art. 5 (1) d) GDPR Non-compliance with general data processing principles
ETid-45 PORTUGAL 2018-07-17 400,000 Public Hospital Art. 5 (1) f) GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-44POLAND 2019-04-25 12,950 Sports association Art. 6 GDPR Insufficient legal basis for data processing
ETid-43 POLAND 2019-03-26 220,000 Private company working with data from publicly available sources Art. 14 GDPRInsufficient fulfilment of information obligations
ETid-42NORWAY 2019-03 170,000 Bergen Municipality Art. 5 (1) f) GDPR, Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-41 MALTA 2019-02-18 5,000 Lands Authority Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-40LITHUANIA 2019-05-16 61,500 Payment service provider UAB MisterTango Art. 5 GDPR, Art. 32 GDPR, Art. 33 GDPR Insufficient fulfilment of data breach notification obligations
ETid-39 ITALY 2019-04-17 50,000 Italian political party Movimento 5 Stelle Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-38HUNGARY 2019-04-05 34,375 Hungarian political party Art. 33 (1) GDPR, Art. 33 (5) GDPR, Art. 34 (1) GDPR Insufficient fulfilment of data breach notification obligations
ETid-37 HUNGARY 2019-03-04 3,200 Unnamed financial institution Art. 5 (1) b) GDPR, Art. 5 (1) c) GDPR, Art. 13 (3) GDPR, Art. 17 (1) GDPR, Art. 6 (4) GDPRInsufficient fulfilment of data subjects rights
ETid-36HUNGARY 2019-02-28 3,200 Mayor's Office of the city of Kecdkemét Art. 5 (1) a) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-35 HUNGARY 2018-12-18 3,200 Unknown Art. 12 (4) GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 13 GDPRInsufficient fulfilment of data subjects rights
ETid-34HUNGARY 2019-02-20 1,560 Debt collector Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR Non-compliance with general data processing principles
ETid-33 HUNGARY 2019-02-08 1,560 Bank Art. 5 (1) d) GDPRNon-compliance with general data processing principles
ETid-32GERMANY 2019-03 50,000 N26 Art. 6 GDPR Insufficient legal basis for data processing
ETid-31 GERMANY 2018 500 Unknown UnknownUnknown
ETid-30GERMANY Unknown 118 Unknown Art. 6 GDPR Insufficient legal basis for data processing
ETid-29 GERMANY 2018 20,000 Unknown Art. 33 (1) GDPR, Art. 34 (1) GDPRInsufficient fulfilment of data breach notification obligations
ETid-28GERMANY 2019-02-05 2,500 Private person Art. 6 GDPR, Art. 5 GDPR Insufficient legal basis for data processing
ETid-27 GERMANY 2019-04-12 80,000 Company in the financial sector Art. 5 GDPR, Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-26GERMANY 2018-12-17 5,000 Kolibri Image
Regina und Dirk Maass GbR
Art. 28 (3) GDPR Insufficient data processing agreement
ETid-25 GERMANY 2018-11-21 20,000 Knuddels.de Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-24FRANCE 2019-05-28 400,000 SERGIC (Real Estate) Art. 5 (1) e) GDPR Insufficient technical and organisational measures to ensure information security
ETid-23 FRANCE 2019-01-21 50,000,000 Google LLC Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 5 GDPRInsufficient legal basis for data processing
ETid-22DENMARK 2021-02-12 13,450 IDdesign A / S Art. 5 (1) e) GDPR, Art. 5 (2) GDPR Non-compliance with general data processing principles
ETid-21 DENMARK 2019 160,000 Taxa 4x35 Art. 5 (1) e) GDPRNon-compliance with general data processing principles
ETid-20CZECH REPUBLIC 2019-05-06 194 Unknown Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-19 CZECH REPUBLIC Unknown 3,140 UniCredit Bank Czech Republic and Slovakia, a.s. Art. 6 GDPRInsufficient legal basis for data processing
ETid-18CZECH REPUBLIC 2019-03-21 10,000 Unknown Art. 5 (1) GDPR Non-compliance with general data processing principles
ETid-17 CZECH REPUBLIC 2019-02-26 776 Unknown Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-16CZECH REPUBLIC 2018-10-25 388 Unknown Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-15 CZECH REPUBLIC 2019-02-04 1,165 Credit brokerage Art. 32 GDPRInsufficient technical and organisational measures to ensure information security
ETid-14CZECH REPUBLIC 2019-02-28 582 Unknown Art. 32 GDPR Insufficient technical and organisational measures to ensure information security
ETid-13 CZECH REPUBLIC 2019-02-04 1,165 Car renting company Art. 5 (1) a) GDPRInsufficient fulfilment of information obligations
ETid-12CZECH REPUBLIC 2019-01-10 388 Employer Art. 6 GDPR Insufficient legal basis for data processing
ETid-11 CYPRUS 2019 10,000 Newspaper Art. 6 GDPRInsufficient legal basis for data processing
ETid-10CYPRUS 2019 5,000 State Hospital Art. 15 GDPR Insufficient fulfilment of data subjects rights
ETid-9 BULGARIA 2019-02-22 500 Employer Art. 15 GDPRInsufficient fulfilment of data subjects rights
ETid-8BULGARIA 2019-01-17 500 Bank Art. 6 GDPR, Art. 5 (1) a) GDPR Insufficient legal basis for data processing
ETid-7 BULGARIA 2019-02-26 27,100 Telecommunication service provider Art. 6 GDPR, Art. 5 (1) a) GDPRInsufficient legal basis for data processing
ETid-6BULGARIA 2018-12-04 500 Bank Art. 5 (1) b) GDPR, Art. 6 GDPR Insufficient legal basis for data processing
ETid-5 BELGIUM 2019-05-28 2,000 Mayor Art. 5 (1) b) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-4AUSTRIA 2018-12-20 2,200 Private person Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR Insufficient legal basis for data processing
ETid-3 AUSTRIA 2018-09-27 300 Private car owner Art. 5 (1) a) GDPR, Art. 6 GDPRInsufficient legal basis for data processing
ETid-2AUSTRIA 2018 1,800 Kebab restaurant Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR Insufficient legal basis for data processing
ETid-1 AUSTRIA 2018-12-09 4,800 Betting place Art. 13 GDPRInsufficient fulfilment of information obligations

Captain Compliance provides articles, guides, and other resources to help educate users about GDPR.

GDPR-K Compliance

We all know about General Data Protection Regulation (GDPR) and how it revolutionized data privacy laws globally, introducing stringent requirements to protect individual rights. What

Read More »