GDPR Fine Enforcement Tracker
Captain Compliance is here to protect your business and help automate compliance requirements for GDPR. This graph below is a list of all GDPR fines for companies operating in the EU that did not follow the rules and paid a financial penalty.
This chart has compiled the tracker identifier for the fine, the country of the fine within Europe, the date of the decision, the total Euro Amount of the fine, company fined, quoted article they were in violation of and the reason.
GDPR fines levied across the EU under the General Data Protection Regulation.
If you would like to supply additional information regarding fines and penalties for non-compliance please let us know.
| Country | Date of Decision | Fine [€] | Controller/Processor | Quoted Art. | Type | Direct URL |
|---|---|---|---|---|---|---|
| SLOVAKIA | 2024 | 1,500 | Unknown | Unknown | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2905 |
| SLOVAKIA | 2024 | 7,500 | Unknown | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2904 |
| SLOVAKIA | 2024 | 200 | Civic Association | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2903 |
| ITALY | 2025-09-11 | 6,000 | Municipality of Buccino | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e), (2), (3) b) GDPR, Art. 9 GDPR, Art. 13 (1), b) GDPR, Art. 37 (7) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2902 |
| ITALY | 2025-09-11 | 8,000 | Migliarino San Rossore Massaciuccoli Regional Park Authority | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 20 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2901 |
| ITALY | 2025-09-11 | 12,000 | Ministry of the Interior - Department of Firefighters, Public Rescue, and Civil Defense - Provincial Command of Florence | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2900 |
| UNITED KINGDOM | 2025-10-15 | 6,880,000 | CAPITA PENSION SOLUTIONS LIMITED | Art. 32 (1), (2) UK GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2899 |
| UNITED KINGDOM | 2025-10-15 | 9,180,000 | CAPITA PLC | Art. 5 (1) f) UK GDPR, Art. 32 (1), (2) UK GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2898 |
| POLAND | 2025-09-12 | 2,670 | Unknown | Art. 38 (6) GDPR | Lack of appointment of data protection officer | https://www.enforcementtracker.com/ETid-2897 |
| ROMANIA | 2025-10-13 | 5,000 | Vellea Home SRL | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2896 |
| ROMANIA | 2025-10-09 | 25,000 | EON ENERGIE ROMANIA S.A. | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2895 |
| SPAIN | 2025-09-25 | 840 | SERVACE S.L. | Art. 5 (1) f) GDPR, Art. 6 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2894 |
| GERMANY | 2025-09-30 | 195,000 | Company | Unknown | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2893 |
| GERMANY | 2025-09-30 | 492,000 | Company | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2892 |
| DENMARK | 2025-09-02 | 200,900 | ILVA A/S | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2891 |
| ROMANIA | 2025-09-25 | 20,000 | S.C. PRIMONET RO S.R.L. | Art. 32 (1) a), b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2890 |
| ITALY | 2025-09-11 | 12,000 | Casa di Cura Città di Roma | Art. 5 (1) a), b), c), e), f), (2) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2889 |
| ITALY | 2025-08-04 | 80,000 | Ospedaliero-Universitaria Careggi | Art. 5 (1) a), e), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2888 |
| SPAIN | 2025-09-23 | 600 | Property manager | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2887 |
| SPAIN | 2025-09-22 | 3,000 | DHL PARCEL IBERIA, S.L. | Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2886 |
| UNITED KINGDOM | 2025-08-04 | 230 | Police Officer | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2885 |
| BULGARIA | 2023-03-16 | 1,020 | Telecommunications Operator | Art. 5 (1) b), f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2884 |
| BULGARIA | 2023-01-17 | 1,020 | Telecommunications Operator | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2883 |
| BULGARIA | 2023-01-26 | 12,800 | Political Party | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2882 |
| GREECE | 2025-07-11 | 2,000 | PAVLOS BIKOS SOLE PROPRIETORSHIP DENTAL PRIVATE CAPITAL COMPANY | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2881 |
| GREECE | 2025-07-11 | 20,000 | NN Greek Single-Member Anonymous Life Insurance Company | Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2880 |
| GREECE | 2025-06-25 | 40,000 | KARAMBELAS KONSTANTINOS & CO. E.E. | Art. 29 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2879 |
| GREECE | 2025-06-25 | 550,000 | Vodafone – PANAFON A.E.E.T. | Art. 5 (1) d) GDPR, Art. 28 (1), (3) GDPR, | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2878 |
| FRANCE | 2025-09-18 | 100,000 | SAMARITAINE SAS | Art. 5 (1) a), c), e), (2) GDPR, Art. 33 (1), (5) GDPR, Art. 38 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2877 |
| ROMANIA | 2025-09-18 | 1,000 | Dr. Max SRL | Art. 12 (3), (4) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2876 |
| SPAIN | 2025-09-04 | 180,000 | Sociedad de Gestión de Activos Procedentes de la Reestructuración Bancaria S.A. | Art. 5 (1) f) GDPR, Art. 28 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2875 |
| SPAIN | 2025-04-15 | 500,000 | Chamber of Commerce, Industry, Services and Navigation of Spain | Art. 5 (1) a), b), f) GDPR, Art. 6 (1) GDPR, Art.14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2874 |
| FINLAND | 2025-09-08 | 1,800,000 | S-Pankki Oyj | Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2873 |
| ROMANIA | 2025-09-09 | 5,000 | Unita Turism Holding S.A. | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2872 |
| ITALY | 2025-07-10 | 10,000 | Nursery School “La Combricola Dei Birichini Di Betty” | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 37 (7) GDPR, Art. 38 (6) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2871 |
| ITALY | 2025-08-04 | 10,000 | Comune di Venezia | Art. 5 (1) a), b), c), e), f) GDPR, Art. 6 (1) e), (3) GDPR, Art. 25 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2870 |
| ITALY | 2025-08-04 | 2,000 | Linea Stampalibera Società Cooperativa r.I. | Art. 5 (1) a), c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2869 |
| BULGARIA | 2023-04-06 | 770 | Secretary of the Central Election Commission Konstantin Ninov | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2868 |
| SPAIN | 2025-09-01 | 1,200 | Company | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2867 |
| SPAIN | 2025-08-29 | 1,200 | GOHIPOTECA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2866 |
| SPAIN | 2025-08-29 | 2,400 | KVIKU SPAIN, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2865 |
| FRANCE | 2025-09-01 | 150,000,000 | INFINITE STYLES SERVICES CO. LIMITED | Art. 82 loi Informatique et Libertés | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2864 |
| FRANCE | 2025-09-01 | 125,000,000 | GOOGLE IRELAND LIMITED | Art. 82 loi Informatique et Libertés, Article L. 34-5 CPCE | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2863 |
| FRANCE | 2025-09-01 | 200,000,000 | GOOGLE LLC | Art. 82 loi Informatique et Libertés, Article L. 34-5 CPCE | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2862 |
| ITALY | 2025-07-10 | 4,000 | Istituto Comprensivo 2 C.D. “G. Modugno” S.M. “G. Galilei” di Monopoli | Art. 5 (1) a) GDPR, Art. 6 (1) c), e), (2), (3) GDPR, Art. 9 (1), (2) g), (4) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2861 |
| ITALY | 2025-07-10 | 8,000 | Università degli Studi di Cassino e del Lazio Meridionale | Art. 5 (1) a), e) GDPR, Art. 6 (1) c), e), (2), (3) b) GDPR, Art. 12 (3), (4) GDPR, Art. 17 GDPR, Art. 21 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2860 |
| BELGIUM | 2025-09-04 | 9,700 | Landlord | Art. 5 (1) a), c), (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2859 |
| ESTONIA | 2025-09-05 | 3,000,000 | Allium UPI | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2858 |
| ITALY | 2025-07-10 | 3,000 | Comune di Conversano | Art. 37 (1) GDPR | Lack of appointment of data protection officer | https://www.enforcementtracker.com/ETid-2857 |
| ITALY | 2025-07-23 | 10,000 | SATI S.p.A. | Art. 5 (1) b), c) GDPR, Art. 9 (2) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2856 |
| ITALY | 2025-07-23 | 10,000 | Order of Nursing Professions of Viterbo | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2855 |
| SPAIN | 2025-08-26 | 300 | Driving School | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2854 |
| SPAIN | 2025-08-25 | 5,400 | YUNEXPRESS SPAIN, S.L. | Art. 5 (1) d) GDPR, Art. 28 (3) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-2853 |
| SPAIN | 2025-08-25 | 1,800 | LEIVA BUS, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2852 |
| SPAIN | 2025-08-22 | 18,000 | GRUPO BONATEL SL | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2851 |
| SPAIN | 2025-08-22 | 6,000 | BANCO INVERSIS, S.A. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2850 |
| SPAIN | 2025-08-14 | 42,000 | WORLD 2 MEET, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2849 |
| SPAIN | 2025-08-12 | 66,000 | REAL SOCIEDAD DE FUTBOL S.A.D. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2848 |
| SPAIN | 2025-08-12 | 1,600 | REAL FEDERACIÓN ESPAÑOLA DE TENIS DE MESA | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2847 |
| SPAIN | 2025-08-12 | 4,800 | GACM SEGUROS GENERALES, COMPAÑIA DE SEGUROS Y REASEGUROS S.A.U. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2846 |
| SPAIN | 2025-07-18 | 1,000 | CLUB BALONCESTO TELDE | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2845 |
| SPAIN | 2025-07-18 | 1,100 | ADMINISTRACIONES BENIPON, S.L. | Art. 28 (2), (4) GDPR, Art. 33 (2) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2844 |
| SPAIN | 2025-07-17 | 1,200 | TRUEBA SPORT S.L. | Art. 5 (1) f) GDPR, Art. 13 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2843 |
| SPAIN | 2025-07-17 | 200,000 | ENDESA ENERGIA, S.A.U. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2842 |
| ROMANIA | 2025-09-01 | 10,000 | La Fântâna S.R.L. | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2841 |
| POLAND | 2025-08-26 | 4,323,250 | ING Bank Śląski | Art. 5 (1) a), b), c) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2840 |
| LITHUANIA | 2024 | 12,000 | Company | Art. 5 (1) d) GDPR, Art. 15 (1) GDPR, Art. 16 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2839 |
| SPAIN | 2025-04-15 | 260,000 | CAMERDATA, S.A. | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2838 |
| CYPRUS | 2025-03-10 | 10,000 | Housing Finance Corporation | Art. 5 (1) d), e) GDPR, Art. 24 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2837 |
| CZECH REPUBLIC | 2023-04-17 | 600 | Legal Person | Art. 12 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2836 |
| CZECH REPUBLIC | 2020-06-11 | 4,010 | Legal Person | Art. 17 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2835 |
| CZECH REPUBLIC | 2021-03-10 | 200 | Self Employed Person | Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (1), (2) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 22 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2834 |
| CZECH REPUBLIC | 2023-06-20 | 1,560 | Legal Person | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2833 |
| CZECH REPUBLIC | 2021-05-14 | 800 | Legal Person | Art. 12 (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2832 |
| CZECH REPUBLIC | 2023-08-01 | 3,570 | Legal Person | Art. 6 (1) GDPR, Art. 13 (1) f) GDPR, Art. 44 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2831 |
| CZECH REPUBLIC | 2020-07-14 | 400 | Legal Person | Art. 5 (1) c) GDPR, Art. 6 (1) a) GDPR, Art. 7 (1) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2830 |
| CZECH REPUBLIC | 2023-05-04 | 3,810 | Legal Person | Art. 6 GDPR, Art. 14 (1), (2), (3) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2829 |
| CZECH REPUBLIC | 2020-09-30 | 20,050 | Legal Person | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3) GDPR, Art. 14 GDPR, Art. 15 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2828 |
| CZECH REPUBLIC | 2023-09-26 | 1,040 | Self Employed Person | Art. 5 (1) a), Art. 13 (1) c), (2) b), d) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2827 |
| CZECH REPUBLIC | 2021-01-19 | 1,200 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2826 |
| CZECH REPUBLIC | 2022-11-09 | 400 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2825 |
| CZECH REPUBLIC | 2020-07-20 | 400 | Legal Person | Art. 12 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2824 |
| CZECH REPUBLIC | 2021-11-01 | 1,000 | Legal Person | Art. 12 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2823 |
| CZECH REPUBLIC | 2020-08-31 | 1,200 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2822 |
| CZECH REPUBLIC | 2020-12-01 | 800 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2821 |
| CZECH REPUBLIC | 2020-09-08 | 2,000 | Legal Person | Art. 6 (1) GDPR, Art. 17 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2820 |
| CZECH REPUBLIC | 2020-10-14 | 12,030 | Legal Person | Art. 6 (1) GDPR, Art. 12 (3), (5) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2819 |
| CZECH REPUBLIC | 2019-06-12 | 400 | Legal Person | Art. 17 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2818 |
| CZECH REPUBLIC | 2019-12-13 | 2,000 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2817 |
| CZECH REPUBLIC | 2019-10-08 | 400 | Legal Person | Art. 21 (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2816 |
| CZECH REPUBLIC | 2019-10-04 | 2,000 | Legal Person | Art. 5 (1) a) GDPR, Art. 12 (1) GDPR, Art. 30 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2815 |
| CZECH REPUBLIC | 2020-11-30 | 1,200 | Legal Person | Art. 17 (1) c) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2814 |
| CZECH REPUBLIC | 2020-09-17 | 3,200 | Legal Person | Art. 6 (1) GDPR, Art. 15 (1) GDPR, Art. 17 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2813 |
| CZECH REPUBLIC | 2020-08-03 | 2,000 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2812 |
| CZECH REPUBLIC | 2020-11-30 | 2,000 | Legal Person | Art. 17 (1) a) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2811 |
| CZECH REPUBLIC | 2020-12-18 | 200 | Legal Person | Art. 17 (1) c) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2810 |
| CZECH REPUBLIC | 2021-06-09 | 2,000 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2809 |
| CZECH REPUBLIC | 2021-11-19 | 800 | Legal Person | Art. 12 (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2808 |
| CZECH REPUBLIC | 2021-06-09 | 2,000 | Unknown | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2807 |
| CZECH REPUBLIC | 2021-06-09 | 2,000 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2806 |
| CZECH REPUBLIC | 2020-12-18 | 8,100 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2805 |
| CZECH REPUBLIC | 2020-12-18 | 8,800 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2804 |
| CZECH REPUBLIC | 2020-12-18 | 8,800 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2803 |
| CZECH REPUBLIC | 2021-06-09 | 2,000 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2802 |
| CZECH REPUBLIC | 2023-08-31 | 1,600 | Legal Person | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2801 |
| CZECH REPUBLIC | 2020-08-28 | 2,000 | Legal Person | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2800 |
| CZECH REPUBLIC | 2021-02-02 | 400 | Legal Person | Art. 17 (1) c) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2799 |
| CZECH REPUBLIC | 2021-02-01 | 80 | Legal Person | Art. 17 (1) c) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2798 |
| CZECH REPUBLIC | 2021-02-23 | 1,200 | Legal Person | Art. 17 (1) c) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2797 |
| CZECH REPUBLIC | 2020-11-19 | 4,800 | Legal Person | Art. 6 (1) GDPR, Art. 12 (3) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2796 |
| CZECH REPUBLIC | 2020-09-25 | 400 | Legal Person | Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2795 |
| CZECH REPUBLIC | 2020-09-25 | 400 | Legal Person | Art. 5 (1) a), e) GDPR, Art. 13 (1) GDPR, Art. 28 (3) GDPR, Art. 30 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2794 |
| CZECH REPUBLIC | 2020-12-18 | 26,710 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2793 |
| CZECH REPUBLIC | 2021-01-20 | 26,710 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2792 |
| CZECH REPUBLIC | 2020-12-18 | 11,430 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2791 |
| CZECH REPUBLIC | 2021-01-20 | 11,430 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2790 |
| CZECH REPUBLIC | 2020-12-18 | 11,430 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2789 |
| CZECH REPUBLIC | 2020-12-18 | 12,910 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2788 |
| CZECH REPUBLIC | 2020-12-18 | 11,830 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2787 |
| CZECH REPUBLIC | 2020-12-18 | 10,070 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2786 |
| CZECH REPUBLIC | 2020-12-18 | 9,420 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2785 |
| CZECH REPUBLIC | 2020-12-18 | 8,340 | Legal Person | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2784 |
| ROMANIA | 2025-08-18 | 3,000 | SC Elite Conta SRL | Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2783 |
| ROMANIA | 2025-08-12 | 3,000 | 'FLEXICREDIT' Mutual Aid House Association | Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2782 |
| GERMANY | 2025-03-07 | 3,500 | Police Officer | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2781 |
| IRELAND | 2024-11-22 | 40,000 | Maynooth University | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2780 |
| IRELAND | 2024-11-13 | 29,500 | Sligo County Council | Art. 5 (1) a), c), e), f) GDPR, Art. 13 (1), (3) GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 30 GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2779 |
| GREECE | 2025-07-04 | 3,000 | Zougla TZI-AP Anonymous Mass Media Company | Art. 5 (1) a) GDPR, Art. 31 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2778 |
| ROMANIA | 2025-08-05 | 1,000 | Order of Biochemists, Biologists and Chemists in the Romanian Health System | Art. 12 (3), (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2777 |
| ITALY | 2025-04-29 | 40,000 | Municipality of Bologna | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e), (2), (3) GDPR, Art. 9 (1), (2) g), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2776 |
| ITALY | 2025-04-29 | 1,200 | Municipality of San Francesco al Campo | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2775 |
| ITALY | 2025-04-29 | 20,000 | Cooperativa Sociale Quadrifoglio | Art. 28 (3) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2774 |
| AUSTRIA | 2024-10-16 | 5,000 | Company | Art. 38 GDPR | Lack of appointment of data protection officer | https://www.enforcementtracker.com/ETid-2773 |
| AUSTRIA | 2024-08-16 | 1,500,000 | Company | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2772 |
| AUSTRIA | 2024-06-06 | 100,000 | Covid 19 Test Lab | Art. 9 GDPR, Art. 5 (1) f) GDPR, Art. 28 (3) GDPR, Art. 32 GDPR, Art. 34 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2771 |
| AUSTRIA | 2024-01-02 | 15,200 | Media Company | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2770 |
| AUSTRIA | 2021-09-28 | 500,000 | Address Broker | Art. 12 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2769 |
| ITALY | 2025-07-10 | 50,000 | Magna PT S.p.A. | Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 88 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2768 |
| ITALY | 2025-07-10 | 80,000 | Poste Vita S.p.a. | Art. 5 (1) a), f) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2767 |
| UNITED KINGDOM | 2025-06-24 | 20,725 | Birthlink | Art. 5 (1) f), (2) GDPR, Art. 32 (1), (2) GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2766 |
| POLAND | 2025-08-04 | 7,700 | Non-Public Health Care Institution | Art. 5 (1) f), (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2765 |
| POLAND | 2025-07-28 | 4,400 | Entrepreneur | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2764 |
| POLAND | 2024-12-23 | 357,000 | Panek SA | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2763 |
| LUXEMBOURG | 2024-11-20 | 2,300 | Company | Art. 5 (1) a), e), (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 25 (2) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2762 |
| SPAIN | 2025-07-16 | 180,000 | TRIVE CREDIT SPAIN, S.L. | Art. 58 (2) c) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2761 |
| SPAIN | 2025-07-16 | 5,400 | SUNERIS, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2760 |
| SPAIN | 2025-07-11 | 32,000 | VALORA PREVENCIÓN, S.L.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2759 |
| POLAND | 2025-07-21 | 43,000 | 24/7 Communication Sp. z o.o. | Art. 5 (1) c) GDPR, Art. 25 (1) GDPR, Art. 38 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2758 |
| POLAND | 2025-07-21 | 3,955,000 | McDonald’s Polska Sp. z o.o. | Art. 5 (1) c) GDPR, Art. 25 (1) GDPR, Art. 28 (1) GDPR, Art. 38 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2757 |
| ROMANIA | 2025-07-23 | 5,000 | Agricola International SA | Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2756 |
| ROMANIA | 2025-07-16 | 4,000 | Georgescu Călin | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2755 |
| GREECE | 2025-06-24 | 10,000 | Shield of David - K.I.D.A.F. | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 24 GDPR, Art. 31 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2754 |
| ITALY | 2025-05-21 | 21,000 | Menarini Silicon Biosystems SpA | Art. 5 (1) a), e), (2) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2753 |
| ITALY | 2025-05-21 | 7,000 | Health Protection Agency of the Metropolitan City of Milan, Workplace Prevention and Safety Service, Milan North | Art. 5 (1) c), f) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2752 |
| ITALY | 2025-04-29 | 100,000 | Energia Verde S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 24 GDPR, Art. 28 GDPR, Art. 31 GDPR, Art. 58 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2751 |
| GREECE | 2025-06-24 | 7,000 | General Hospital of the University of Larissa | Art. 5 (2) GDPR, Art. 14 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2750 |
| SPAIN | 2025-07-04 | 6,000 | CURENERGÍA COMERCIALIZADOR DE ÚLTIMO RECURSO S.A.U. | Art. 5 (1) b), GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2749 |
| SPAIN | 2025-07-02 | 900 | ARCONADA 1932, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2748 |
| SPAIN | 2025-06-26 | 96,000 | SIDECU, S.A. | Art. 9 GDPR, Art. 13 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2747 |
| SPAIN | 2025-06-20 | 42,000 | IBERCAJA BANCO, S.A. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2746 |
| SPAIN | 2025-06-20 | 24,000 | COLEGIO VIRGEN DE EUROPA, S.L. | Art. 5 (1) f) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2745 |
| SPAIN | 2025-06-16 | 12,000 | ALBOR ENERGÍA S.L. | Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2744 |
| SPAIN | 2025-06-16 | 3,000 | SILVANERGIA 2022, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2743 |
| SPAIN | 2025-06-13 | 540 | CUBILLO GALLEGO, S.L. | Art. 58 (2) d) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2742 |
| SPAIN | 2025-06-13 | 18,000 | OCI CINE, S.L. | Art. 5 (1) d) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2741 |
| SPAIN | 2025-06-04 | 21,000 | ALVEA SOLUCIONES TECNOLÓGICAS, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2740 |
| SPAIN | 2025-05-30 | 42,000 | LVMH IBERIA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2739 |
| SPAIN | 2025-05-26 | 1,380,000 | REPSOL COMERCIALIZADORA DE ELECTRICIDAD Y GAS, S.L. | Art. 5 (1) d) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2738 |
| SPAIN | 2025-05-23 | 60,000 | AIRE NETWORKS DEL MEDITERRÃNEO, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2737 |
| SPAIN | 2025-05-21 | 200,000 | TELEFÓNICA MÓVILES ESPAÑA, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2736 |
| SPAIN | 2025-05-20 | 360 | RED ESPAÑOLA DE IDENTIFICACIÓN DE ANIMALES DE COMPAÑÍA | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2735 |
| SPAIN | 2025-05-19 | 200,000 | ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L. | Art. 6 (1) GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2734 |
| SPAIN | 2025-05-16 | 30,000 | ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2733 |
| SPAIN | 2025-05-13 | 100,000 | PLATAFORMA CABANILLAS SA. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2732 |
| AUSTRIA | 2025-06-03 | 16,000 | Car Park Management Company | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2731 |
| POLAND | 2025-06-30 | 15,600 | L. Zamenhof University Children's Clinical Hospital in Białystok | Art. 5 (2) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2730 |
| POLAND | 2025-06-23 | 3,500 | Municipal Social Welfare Center Aleksandrów | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2729 |
| GREECE | 2025-06-23 | 50,000 | Piraeus Bank S.A. | Art. 5 (1) a), d) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2728 |
| ROMANIA | 2025-06-26 | 3,000 | SC Tremend Software Consulting SRL | Art. 32 (1) b), d), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2727 |
| ROMANIA | 2025-06-26 | 3,000 | Selgros Cash & Carry SRL | Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2726 |
| ROMANIA | 2025-06-26 | 25,000 | Alliance for the Union of Romanians Party | Art. 5 (1) c), (2) GDPR, Art. 6 (1) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1) b), d), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2725 |
| ROMANIA | 2025-06-26 | 3,000 | SC Piramida Trade Invest SRL | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2724 |
| ROMANIA | 2025-06-19 | 1,000 | SC Diamir SRL | Art. 6 (1) GDPR, Art. 58 (1) a), e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2723 |
| ROMANIA | 2025-06-18 | 200 | Dincă Viorel George | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2722 |
| ROMANIA | 2025-05-30 | 5,000 | AG-BROKER ASIGURARE S.R.L. | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2721 |
| ROMANIA | 2025-05-22 | 1,000 | MP Dumitru Viorel Focșa | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2720 |
| ROMANIA | 2025-05-21 | 12,000 | Data Diggers Market Research SRL | Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 14 GDPR, Art. 15 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2719 |
| ROMANIA | 2025-05-19 | 5,000 | Maravet S.R.L. | Art. 32 (1) b), d), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2718 |
| ROMANIA | 2025-05-16 | 5,000 | ACCOUNTING & AUDIT CONSULTING SRL | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2717 |
| ROMANIA | 2025-05-14 | 2,000 | CVA TAX & FINANCE S.R.L. | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2716 |
| ROMANIA | 2025-05-13 | 2,000 | Romoffice Construct Holding Ag SRL | Art. 5 (1) a), (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2715 |
| ROMANIA | 2025-05-12 | 2,000 | CV PRO CONSULT S.R.L. | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2714 |
| ROMANIA | 2025-05-09 | 5,000 | ROUMASPORT SRL | Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2713 |
| ROMANIA | 2025-04-28 | 1,000 | Xiting ROM SRL | Art. 12 (3), (4) GDPR, Art. 15 (1), (2), (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2712 |
| ROMANIA | 2025-04-25 | 6,000 | SC Travel Planner SRL | Art. 12 (3), (4) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2711 |
| ROMANIA | 2025-04-24 | 10,000 | Dante International SA | Art. 12 (1) GDPR, Art. 17 GDPR, Art. 19 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2710 |
| ROMANIA | 2025-04-15 | 2,000 | United Business Solutions SRL | Art. 32 (1) b), d), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2709 |
| ROMANIA | 2025-04-14 | 1,000 | Office Nova Concept SRL | Art. 12 (1), (2), (3), (4) GDPR, Art. 15 (3) GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2708 |
| ROMANIA | 2025-04-11 | 2,000 | NEW GAMBLING SOLUTIONS S.R.L. | Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2707 |
| ROMANIA | 2025-04-10 | 15,000 | Tensa Art Design S.A. | Art. 6 (1) a) GDPR, Art. 12 (1), (2), (3), (4) GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2706 |
| ROMANIA | 2025-04-03 | 5,000 | Banca Transilvania S.A. | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2705 |
| ROMANIA | 2025-04-02 | 3,000 | BINBOX GLOBAL SERVICES S.R.L. | Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2704 |
| ROMANIA | 2025-03-25 | 25,000 | NTT DATA ROMANIA S.A. | Art. 32 (1) b), d), (2) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2703 |
| ROMANIA | 2025-03-21 | 1,000 | Bucharest Down Town Hotel SRL | Art. 12 (3) GDPR, Art. 13 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2702 |
| ROMANIA | 2025-03-20 | 2,000 | ONE UNITED PROPERTIES S.A | Art. 6 GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2701 |
| ROMANIA | 2025-06-23 | 4,000 | Vodafone Romania S.A. | Art. 25 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2700 |
| ROMANIA | 2025-03-12 | 5,000 | Automobilus International S.R.L. | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2699 |
| ROMANIA | 2025-03-11 | 1,000 | Noy Business Tranzactions SRL | Art. 12 (1), (2), (3), (4) GDPR, Art. 15 (3) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2698 |
| ROMANIA | 2025-03-06 | 2,000 | SHOPBAG GROUP ONLINE SRL | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2697 |
| ROMANIA | 2025-03-04 | 20,000 | WEBRASOFT SRL | Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2696 |
| ROMANIA | 2025-03-03 | 10,000 | BEKO ROMANIA SA | Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2695 |
| ROMANIA | 2025-02-27 | 1,000 | Velvet Medical SRL | Art. 12 (1), (2), (3), (4) GDPR, Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2694 |
| ROMANIA | 2025-02-17 | 2,000 | Meedea Construct Prest SRL | Art. 5 (1) a), b), f), (2) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2693 |
| ROMANIA | 2025-02-10 | 3,000 | PPC Energie Muntenia SA | Art. 5 (1) a), b) GDPR, Art. 6 GDPR, Art. 12 (3), (4) GDPR, Art. 15 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2692 |
| ROMANIA | 2025-02-06 | 3,000 | Omniasig Vienna Insurance Group S.A. | Art. 32 (1), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2691 |
| ROMANIA | 2025-02-05 | 5,000 | FARMEC SA | Art. 25 (1) GDPR, Art. 32 (1), b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2690 |
| ROMANIA | 2025-02-04 | 10,000 | V&M Contab & Management SRL | Art. 32 (1) b), (2), (4) GDPR, Art. 58 (1) a), e) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2689 |
| ROMANIA | 2025-02-03 | 15,000 | Unicredit Bank SA | Art. 25 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2688 |
| ROMANIA | 2025-01-31 | 15,000 | S.P.E.E.H. HIDROELECTRICA S.A | Art. 25 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2687 |
| ROMANIA | 2025-01-27 | 40,000 | Orange Romania SA | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (3), (4) GDPR, Art. 17 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2686 |
| ROMANIA | 2025-01-03 | 2,000 | Unirea Medical Center S.R.L. | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2685 |
| IRELAND | 2025-06-23 | 125,000 | City of Dublin Education and Training Board | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR, Art. 33 (1) GDPR, Art. 34 (1), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2684 |
| ITALY | 2025-06-04 | 45,000 | Noi Compriamo Auto.it S.r.l. | Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 12 (2) GDPR, Art. 24 GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2683 |
| ITALY | 2025-05-21 | 420,000 | Autostrade per l’Italia S.p.A. | Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 88 GDPR, | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2682 |
| SWEDEN | 2025-06-18 | 6,800 | Waxholms Ångfartygs AB | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2681 |
| SWEDEN | 2025-06-18 | 6,800 | AB Storstockholms Lokaltrafik | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2680 |
| ITALY | 2025-04-29 | 2,000 | Tirrenia Hospital S.r.l. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2679 |
| ITALY | 2025-04-29 | 40,000 | MA Immobiliare S.r.l.s. | Art. 5 (1) a), (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2678 |
| ITALY | 2025-03-27 | 18,000 | Multiple Companies | Art. 5 (1) a), b) GDPR, Art. 6 (1) a) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2677 |
| ITALY | 2025-04-29 | 2,000 | Versilmagra Immobiliare di Robertelli Davide & C. S.a.s. | Art. 5 (1) a), (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 (2) GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2676 |
| ITALY | 2025-04-10 | 8,000 | Undici S.r.l.s. | Art. 5 (1) a), (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2675 |
| ITALY | 2025-04-10 | 4,000 | Municipality of Ponte nelle Alpi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2674 |
| ITALY | 2025-04-10 | 5,000 | Patronage and Assistance for Citizens and Agriculture Board | Art. 5 (1) a), e) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2673 |
| ITALY | 2025-04-10 | 8,000 | Eastern Parma Apennine Mountain Community | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 88 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2672 |
| ITALY | 2025-04-10 | 15,000 | Immobiliare Valdalpone S.r.l. | Art. 5 (1) a), (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 (2) GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2671 |
| ITALY | 2025-03-27 | 4,000 | Istituto di Istruzione Superiore 'P. Galluppi' Tropea | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2670 |
| ITALY | 2025-03-27 | 3,000 | Municipality of Palma di Montechiaro | Art. 37 (1), (7) GDPR | Lack of appointment of data protection officer | https://www.enforcementtracker.com/ETid-2669 |
| ITALY | 2025-04-29 | 50,000 | Regione Lombardia | Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 35 GDPR, Art. 88 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2668 |
| SPAIN | 2025-04-24 | 1,500 | ULPIA TRAJANA ALAMEDA S.L. | Art. 5 (1) c) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2667 |
| ITALY | 2025-03-13 | 2,000 | Municipality of Roccaraso | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2666 |
| ITALY | 2025-03-13 | 40,000 | Interflora Italia S.p.A. | Art. 5 (1) a), b) GDPR, Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2665 |
| ITALY | 2025-03-13 | 20,000 | Encore Thermoengineering s.r.l. | Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 17 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2664 |
| ITALY | 2025-03-13 | 2,000 | l’Istituto Alberghiero Mediterraneo di Pulsano | Art. 5 (1) a) GDPR, Art. 6 (1) c), e), (2), (3) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2663 |
| ITALY | 2025-03-13 | 15,000 | G@S Telecomunicazioni di Losito Lucia | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2662 |
| ITALY | 2025-04-10 | 850,000 | Network of Agencies and Companies | Art. 5 (1), (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 31 GDPR, Art. 32 GDPR, Art. 58 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2661 |
| ITALY | 2025-04-10 | 3,000,000 | Acea Energia S.p.A. | Art. 5 (1) a), f) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2660 |
| ROMANIA | 2025-06-12 | 10,000 | Accounting Audit SRL | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2659 |
| NORWAY | 2025-06-10 | 22,000 | Kristiansand municipality | Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2658 |
| IRELAND | 2025-06-12 | 550,000 | Departement of Social Security | Art. 5 (1) a), e) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) a) GDPR, Art. 35 (VII) b), c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2657 |
| UNITED KINGDOM | 2025-06-05 | 2,700,000 | 23andMe, Inc. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2656 |
| SPAIN | 2025-03-14 | 3,200,000 | CENTROS COMERCIALES CARREFOUR, S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 34 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2655 |
| SPAIN | 2025-03-28 | 6,600 | GRUAS IGNACI, S.L. | Art. 5 (1) c) GDPR, Art. 13 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2654 |
| SPAIN | 2025-03-28 | 4,000 | CREMA GAMES, S.L. | Art. 15 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2653 |
| SPAIN | 2025-03-28 | 21,600 | SCHOOL FITNESS HOLIDAY & FRANCHISING, S.L. | Art. 5 (1) e) GDPR, Art. 7 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2652 |
| SPAIN | 2025-03-28 | 12,000 | ESTUDIO ALCAZAR DEL GENIL 2022, S.L. | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2651 |
| GREECE | 2025-04-09 | 5,000 | Gynaecologist | Art. 15 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2650 |
| ITALY | 2025-01-16 | 100,000 | Realmaps S.r.l. | Art. 5 (1) a), e), f), (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 (1), (2), (3) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 (2) GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 30 GDPR, Art. 32 (1) b), d) (2) GDPR, Art. 35 GDPR, Art. 37 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2649 |
| ITALY | 2025-04-29 | 30,000 | Ordine degli psicologi della Lombardia | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2648 |
| FINLAND | 2025-05-27 | 1,100,000 | Yliopiston Apteekin | Art. 5 (1) c), f) GDPR, Art. 32 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2647 |
| GERMANY | 2025 | 45,000,000 | Vodafone GmbH | Art. 28 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2646 |
| SPAIN | 2025-03-24 | 2,000 | INDEPENDENTS DE VALLROMANES | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2645 |
| SPAIN | 2025-03-20 | 500 | GALENICUM HEALTH, S.L.U. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2644 |
| SPAIN | 2025-03-20 | 4,800 | TECNOCRÃTICA CENTRO DE DATOS S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2643 |
| SPAIN | 2025-05-19 | 1,000 | Home Owner Association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2642 |
| SPAIN | 2025-05-09 | 120,000 | UNIÓN DE CRÉDITO PARA LA FINANCIACIÓN MOBILIARIA E INMOBILIARIA EFC | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2641 |
| SPAIN | 2025-05-09 | 6,600 | Owner of a Pharmacy Office | Art. 6 (1) GDPR, Art. 14 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2640 |
| SPAIN | 2025-05-08 | 6,600 | Owner of a Pharmacy Office | Art. 6 (1) GDPR, Art. 14 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2639 |
| GERMANY | 2024 | 41 fines totaling EUR 13,486 | Unknown | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2638 |
| GERMANY | 2024 | 10,000 | Company | Art. 6 (1) GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2637 |
| GERMANY | 2024 | 496,000 | Company | Art. 5 GDPR, Art. 6 GDPR, Art. 12 (3) GDPR, Art. 15 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2636 |
| GERMANY | 2024 | 16,000 | Freelancer | Art. 13 GDPR, Art. 31 GDPR, Art. 58 (2) d) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2635 |
| GERMANY | 2024 | 2,500 | Doctor´s Office | Art. 5 (1) f) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2634 |
| GERMANY | 2024 | 3,300 | Doctor´s Office | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2633 |
| GERMANY | 2024 | 3,700 | Doctor´s Office | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2632 |
| GERMANY | 2024 | Unknown | Multiple Police Officers | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2631 |
| FRANCE | 2025-05-15 | 80,000 | CALOGA | Art. 5 (1) e) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2630 |
| GERMANY | 2024 | 60,000 | Company | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2629 |
| SPAIN | 2025-04-03 | 600 | Owner of a Law Firm | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2628 |
| SPAIN | 2025-04-22 | 1,200 | FUNDACIÓ PRIVADA DE SERVEIS PER ALS USUARIS DEL HABITATGE SOCIAL DE CATALUNYA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2627 |
| SPAIN | 2025-04-22 | 12,000 | NOVATES ALIMENTACIÓN MADRID, S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2626 |
| SPAIN | 2025-04-22 | 1,200 | SERVICIOS DE INTEGRACIÓN DE ANDALUCÍA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2625 |
| SPAIN | 2025-05-22 | 1,200 | Attorney | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2624 |
| SPAIN | 2025-04-15 | 600 | Unknown | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2623 |
| SPAIN | 2025-04-14 | 6,000 | LÃSER METALPRINT 3D, S.L. | Art. 28 GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-2622 |
| SPAIN | 2025-04-14 | 3,000 | EDA TV CONSULTING, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2621 |
| SPAIN | 2025-04-09 | 600 | FEDERACION DE COLUMBICULTURA DE CASTILLA-LA MANCHA | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2620 |
| SPAIN | 2025-04-04 | 360 | SINDICAT CATAC-CTSC | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2619 |
| SPAIN | 2025-03-30 | 3,500 | MAD COOL FESTIVAL S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2618 |
| FRANCE | 2024-09-26 | 150,000 | TELEMAQUE | Art. 5 (1) e) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2617 |
| FRANCE | 2024-09-26 | 250,000 | COSMOSPACE | Art. 5 (1) c), e) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2616 |
| LUXEMBOURG | 2025-01-06 | 175,000 | Credit Institution | Art. 12 (3), (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2615 |
| BELGIUM | 2025-04-24 | 6,000 | Real Estate Agency | Art. 5 (1) a), c), f) GDPR, Art. 6 (1) GDPR, Art. 17 (1) GDPR, Art. 21 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2614 |
| BELGIUM | 2025-04-22 | 20,000 | Company | Art. 5 (1) a), (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 14 (1), (2) GDPR, Art. 15 (1) c), d), g), Art. 24 (1) GDPR, Art. 25 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2613 |
| ITALY | 2025-03-13 | 50,000 | Azienda regionale per lo sviluppo e per i servizi in agricoltura (ARSAC) | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 35 GDPR, Art. 88 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2612 |
| ITALY | 2025-04-10 | 5,000,000 | Luka Inc. | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2611 |
| FRANCE | 2025-05-15 | 900,000 | SOLOCAL MARKETING SERVICES | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2610 |
| CROATIA | 2025-03-24 | 10,000 | Oil and fat manufacturer | Art. 37 GDPR | Lack of appointment of data protection officer | https://www.enforcementtracker.com/ETid-2609 |
| CROATIA | 2025-03-24 | 12,000 | Casino | Art. 37 GDPR | Lack of appointment of data protection officer | https://www.enforcementtracker.com/ETid-2608 |
| CROATIA | 2025-03-24 | 3,000 | Hospital | Art. 13 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2607 |
| CROATIA | 2025-03-24 | 4,000 | Hospital | Art. 13 GDPR, Art. 14 (2) f) GDPR, Art. 25 (1) GDPR, Art. 28 (3) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2606 |
| CROATIA | 2025-03-24 | 20,000 | Hospital | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2605 |
| CROATIA | 2025-03-24 | 40,000 | Company | Art. 5 (1) a), e) GDPR, Art. 6 (1) f) GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 30 GDPR, Art. 38 (3), (6) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2604 |
| CROATIA | 2025-03-24 | 80,000 | Company | Art. 5 (1) b) GDPR , Art. 6 (1) GDPR, Art. 32 (2), (4) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2603 |
| ICELAND | 2025-02-17 | 34,300 | Primary Health Care in the Capital Area | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2602 |
| DENMARK | 2024-11-27 | Fine amount between 46,900 and 53,600 | Lyngby-Taarbæk Municipality | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2601 |
| DENMARK | 2024-11-12 | 6,700 | Uptime-IT ApS | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2600 |
| SWEDEN | 2024-12-11 | 18,400 | Granit Bostad Beritsholm AB | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2599 |
| SWEDEN | 2025-04-23 | 9,200 | Diskrimineringsombudsmannen | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2598 |
| SPAIN | 2024-10-04 | 5,000 | ROCA & ASOCIADOS ABOGADOS Y ECONOMISTAS, S.L.P. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2597 |
| LITHUANIA | 2024-10-18 | 9,000 | Vilnius District Municipality Administration | Art. 5 (1) f) GDPR, Art. 32 (1) b), c), d) GDPR, Art. 34 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2596 |
| LITHUANIA | 2025-01-21 | 9,000 | Employment Service under the Ministry of Social Security and Labor of the Republic of Lithuania | Art. 5 (1) f) GDPR, Art. 24 (1) GDPR, Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2595 |
| ESTONIA | 2025-01-10 | 0 | Asper Biogene OÜ | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2594 |
| ESTONIA | 2024-07-15 | 30,000 | Pere Sihtkapital SA | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2593 |
| CZECH REPUBLIC | 2023-08-02 | Multiple fines totaling EUR 178,000 | Multiple website operators | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2592 |
| POLAND | 2024-12-18 | 135,600 | Company | Art. 38 (3) GDPR, Art. 30 (1) GDPR, Art. 35 (1), (7) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2591 |
| POLAND | 2025-03-11 | 13,400 | Polskie Radio Szczecin | Art. 24 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2590 |
| POLAND | 2025-04-15 | 7,800 | Funeral Home | Art. 5 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2589 |
| POLAND | 2025-03-24 | 17,600 | Chief Commander of the Police | Art. 6 (1) GDPR, Art. 9 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2588 |
| POLAND | 2025-03-17 | 23,500 | Minister of Digital Affairs | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2587 |
| SPAIN | 2025-03-14 | 1,600,000 | ING BANK N.V., SUCURSAL EN ESPAÑA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2586 |
| SPAIN | 2025-02-14 | 200,000 | ORANGE BANK, S.A. SUCURSAL EN ESPAÑA | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2585 |
| IRELAND | 2025-05-02 | 530,000,000 | TikTok Technology Limited | Art. 13 (1) f) GDPR, Art. 46 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2584 |
| SPAIN | 2025-01-17 | 12,000 | CAJA RURAL DE ASTURIAS, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2583 |
| SPAIN | 2025-01-16 | 72,000 | CAJA RURAL CENTRAL, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2582 |
| SPAIN | 2025-01-17 | 8,000 | CAJA RURAL DE BAENA NTRA. SRA. DE GUADALUPE, S.C.C.A. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2581 |
| SPAIN | 2025-01-17 | 12,000 | CAJA RURAL GRANADA, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2580 |
| SPAIN | 2025-01-17 | 12,000 | CAJA RURAL DE ONDA, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2579 |
| SPAIN | 2025-01-17 | 8,000 | CAJA RURAL NTRA MADRE DEL SOL S.C.A.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2578 |
| SPAIN | 2025-01-17 | 10,000 | CAJA RURAL NTRA. SRA. DEL ROSARIO | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2577 |
| SPAIN | 2025-01-17 | 12,000 | CAJA RURAL DE ARAGÓN, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2576 |
| SPAIN | 2024-12-20 | 1,000,000 | LIGA NACIONAL DE FÚTBOL PROFESIONAL | Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2575 |
| SPAIN | 2025-02-25 | 600,000 | IBERMUTUA, MUTUA COLABORADORA CON LA SEGURIDAD SOCIAL NUM.274. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2574 |
| NORWAY | 2025-03-10 | 338,000 | Telenor ASA. | Art. 24 (1), (2) GDPR, Art. 37 (7) GDPR, Art. 38 (2), (3) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2573 |
| SPAIN | 2025-02-11 | 120,000 | BEEDIGITAL AI, S.A. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2572 |
| GERMANY | 2024 | 22,080 | Company | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2571 |
| GERMANY | 2024 | 120,000 | Company | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2570 |
| SPAIN | 2025-03-28 | 120,000 | SERVICIOS ESPECIALES, S.A. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2569 |
| SPAIN | 2025-02-05 | 500,000 | MARINA SALUD, S.A. | Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2568 |
| SPAIN | 2025-04-04 | 120,000 | BANCO BILBAO VIZCAYA ARGENTARIA, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2567 |
| UNITED KINGDOM | 2025-04-14 | 70,300 | DPP Law Ltd. | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2566 |
| SPAIN | 2025-02-14 | 200,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2565 |
| SPAIN | 2025-02-25 | 200,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2564 |
| POLAND | 2025-03-17 | 6,300,000 | Poczta Polska SA (Polish Post) | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2563 |
| SPAIN | 2024-12-12 | 3,500,000 | CAIXABANK, S.A. | Art. 5 (1) f) GDPR, Art. 25 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2562 |
| UNITED KINGDOM | 2025-03-26 | 3,500,000 | Advanced Computer Software Group Ltd | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2561 |
| FRANCE | 2024-04-04 | 525,000 | HUBSIDE.STORE | Art. 6 GDPR, Art. 14 GDPR, Art. L.34-5 CPCE | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2560 |
| GREECE | 2024-05-27 | 40,000 | Member of the European Parliament | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2559 |
| SPAIN | 2024-02-05 | 3,500,000 | I-DE REDES ELÉCTRICAS INTELIGENTES, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2558 |
| SPAIN | 2024-02-07 | 3,000,000 | IBERDROLA, S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2557 |
| GREECE | 2024-05-27 | 400,000 | Ministry of Interior (Greece) | Art. 5 (1) f) GDPR, 32 GDPR, 25 (1) GDPR, 33 (3), (4), (5) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2556 |
| UNITED KINGDOM | 2024-09-26 | 904,000 | Police Service of Northern Ireland | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2555 |
| SPAIN | 2025-01-17 | 76,000 | CAJA RURAL DE GIJÓN, S.C.A.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2554 |
| SPAIN | 2025-01-17 | 200,000 | CAJA RURAL DE SALAMANCA, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2553 |
| SPAIN | 2025-01-17 | 80,000 | CAJA RURAL DE ALBACETE, CIUDAD REAL Y CUENCA, S.C.T | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2552 |
| SPAIN | 2025-01-17 | 8,000 | CAJA RURAL NTRA. SRA. DEL ROSARIO | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2551 |
| SPAIN | 2025-01-16 | 400,000 | CAJA RURAL DE JAEN, BARCELONA Y MADRID, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2550 |
| SPAIN | 2024-12-23 | 2,000 | AUTOMOCIÓN 1972, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2549 |
| SPAIN | 2024-12-23 | 600 | ENERGY WINNER, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2548 |
| SPAIN | 2024-12-23 | 9,000 | CRIDOLMA BARCELONA S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2547 |
| ROMANIA | 2025-02-20 | 2,000 | Medstar S.R.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2546 |
| SPAIN | 2024-05-31 | 600,000 | GSMA Limited | Art. 6 (1), Art. 9 (2) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2545 |
| FINLAND | 2024-11-13 | 2,400,000 | Posti Jakelu Oy | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2544 |
| SPAIN | 2024-02-06 | 5,000,000 | ENERGYA VM GESTIÓN DE ENERGÍA, S.L. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2543 |
| FRANCE | 2024-09-12 | 800,000 | CEGEDIM SANTÉ | Art. 5 (1) a) GDPR, Art. 66 Loi n° 78-17 du 6 janvier 1978 | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2542 |
| SPAIN | 2025-02-05 | 1,200,000 | ORANGE ESPAGNE, S.A.U. | Art. 6 GDPR, Art. 25 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2541 |
| ITALY | 2024-06-20 | 1,000,000 | Fastweb S.p.A. | Art. 5 (1) a), c), e) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1), (3) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 130 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2540 |
| SPAIN | 2025-01-17 | 88,000 | CAJA RURAL DE EXTREMADURA S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2539 |
| SPAIN | 2025-01-17 | 12,000 | CAJA RURAL DE ARAGÓN, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2538 |
| SPAIN | 2025-01-17 | 16,000 | CAJA RURAL DEL SUR, S.C.C. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2537 |
| ITALY | 2024-06-06 | 1,000,000 | CA Autobank S.p.A. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2536 |
| ITALY | 2024-07-17 | 5,000,000 | Hera Comm S.p.A. | Art. 5 (1) a), b), d), e), f) GDPR, Art. 5 (2) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 24 GDPR, Art. 28 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2535 |
| SPAIN | 2024-12-16 | 70,000 | INTERURBANA DE AUTOBUSES, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2534 |
| SPAIN | 2024-12-23 | 15,000 | HSSERVICE LIZCON SOLUTIONS, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2533 |
| SPAIN | 2023-12-27 | 6,500,000 | THE PHONE HOUSE SPAIN, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2532 |
| ITALY | 2024-11-13 | 5,000,000 | Foodinho Srl | Art. 5 (1) a), c), d), e) GDPR, Art. 6 GDPR, Art. 9 (2) b) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 22 (3) GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 88 GDPR, Art. 2-septies Codice della privacy, Art. 114 Codice della privacy, Art. 47-quinquies Decreto legislativo 81/2015 | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2531 |
| SPAIN | 2024-11-22 | 220,000 | CARTONAJES BAÑERES, S.A. | Art. 15 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2530 |
| SPAIN | 2024-11-11 | 200,000 | Correo Inteligente Postal, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2529 |
| SPAIN | 2024-12-23 | 300,000 | LÍNEA DIRECTA ASEGURADORA, S.A. | Art. 6 (1) GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2528 |
| SPAIN | 2024-12-18 | 100,000 | ATRIUM LEX SFC | Art. 13 GDPR, Art. 32 (1) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2527 |
| ITALY | 2024-09-12 | 842,062 | Sky Italia S.r.l. | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 130 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2526 |
| ITALY | 2024-12-14 | 2,000 | Torre Annunziata municipality | Art. 37 (7) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2525 |
| ITALY | 2024-12-14 | 2,000 | Maddaloni municipality | Art. 37 (7) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2524 |
| SPAIN | 2024-11-13 | 2,500 | COYARE SLU | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2523 |
| ITALY | 2024-12-12 | 20,000 | Physician | Art. 5 GDPR, Art. 9 GDPR, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2522 |
| BELGIUM | 2024-12-17 | 200,000 | Hospital | Art. 5 (1) f) GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 (3) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2521 |
| SPAIN | 2024-10-17 | 1,000 | KUR KLINIKUM, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2520 |
| ITALY | 2024-11-27 | 892,783 | E.ON Energia spa | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 22 GDPR, Art. 24 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2519 |
| POLAND | 2024-01-17 | 273,000 | Centrum Medyczne Ujastek Sp. z o.o. | Art. 5 (1) a), f) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2518 |
| FRANCE | 2025-02-04 | 40,000 | Real estate company | Art. 5 (1) c) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2517 |
| ITALY | 2024-11-13 | 678,897 | Illumia Spa | Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GPDR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2516 |
| CYPRUS | 2024-09-04 | 3,000 | Senira Limited | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2515 |
| SPAIN | 2024-12-10 | 4,000,000 | GENERALI ESPAÑA, SOCIEDAD ANONIMA DE SEGUROS Y REASEGUROS | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2514 |
| SPAIN | 2024-11-13 | 500 | 4T OCIO Y CAFÉ 2009 | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2513 |
| SPAIN | 2024-10-31 | 900 | RIVENDELL TECHNOLOGY, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2512 |
| SPAIN | 2024-11-06 | 1,000 | MINAS DE VALDECASTILLO, S.A.. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2511 |
| SPAIN | 2024-11-22 | 220,000 | CARTONAJES BAÑERES, S.A | Art. 15 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2510 |
| THE NETHERLANDS | 2024-12-23 | 40,000 | Coolblue B.V | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2509 |
| SPAIN | 2024-09-26 | 1,300,000 | TELEFÓNICA DE ESPAÑA SAU | Art. 5 (1) f) GDPR, Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2508 |
| THE NETHERLANDS | 2024-11-26 | 4,750,000 | Netflix International B.V. | Art. 5 (1) a) GDPR, Art. 12 (1) GDPR, Art. 13 (1) c), e), f) GDPR, Art. 13 (2) GDPR, Art. 15 (1) a), c), d) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2507 |
| FINLAND | 2024-12-17 | 950,000 | Sambla Group Oy | Art. 5 (1) f) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2506 |
| ROMANIA | 2025-01-23 | 5,000 | Softehnica S.R.L. | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2505 |
| ROMANIA | 2025-01-17 | 2,000 | DELIVERY SOLUTIONS S.A. | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2504 |
| ROMANIA | 2025-01-20 | 15,000 | Vodafone Romania S.A. | Art. 32 (1) b) GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2503 |
| SPAIN | 2024-10-04 | 900 | Private individual | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2502 |
| SPAIN | 2024-10-31 | 4,000 | GESTIÓN DE VENTAS IBERIA S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2501 |
| SPAIN | 2024-10-31 | 12,000 | NEGOCIOS R&R 2020 S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2500 |
| SPAIN | 2024-12-03 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2499 |
| SPAIN | 2024-11-07 | 2,000 | KAFFA KOFFEE ORGANISATION, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2498 |
| ITALY | 2024-11-02 | 15,000,000 | OpenAI OpCo LLC | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2497 |
| CROATIA | 2024-09-13 | 45,000 | Hotel | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2496 |
| CROATIA | 2024-09-13 | 35,700 | Company | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2495 |
| CROATIA | 2024-09-13 | 190,000 | Hospital | Art. 5 (1) e) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) a), b) GDPR, Art. 32 (1) b), Art. 33 (1) GDPR, Art. 38 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2494 |
| POLAND | 2024-11-26 | 6,900 | Hospital | Art. 33 (1) GDPR, Art. 34 (1), (2) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2493 |
| POLAND | 2024-11-20 | 4,700 | Unknown | Art. 28 (3) c), f) GDPR, Art. 32 (1) , (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2492 |
| POLAND | 2024-11-20 | 358,000 | Unknown | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 28 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2491 |
| SPAIN | 2024-11-19 | 200,000 | VODAFONE ESPAÑA, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2490 |
| SPAIN | 2024-10-18 | 200,000 | VODAFONE ESPAÑA, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2489 |
| SPAIN | 2024-10-04 | 600 | VOLTIUM CONSULTORES 2020 | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2488 |
| GERMANY | 2024-11-12 | 900,000 | Debt collection service provider | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2487 |
| SPAIN | 2024-09-11 | 600 | KVIKU SPAIN, S.L | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2486 |
| POLAND | 2024-10-18 | 5,800 | Unknown | Art. 37 (1) a) GDPR, Art. 37 (7) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2485 |
| IRELAND | 2024-12-17 | 251,000,000 | Meta Platforms Ireland Limited | Art. 33 (3), (5) GDPR, Art. 25 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2484 |
| ITALY | 2024-07-17 | 80,000 | Selectra S.p.A. | Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 88 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2483 |
| NORWAY | 2024-10-21 | 20,800 | Grue municipality | Art. 24 GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2482 |
| SPAIN | 2024-09-05 | 3,000 | PLAY FUL KIDS, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2481 |
| SPAIN | 2024-08-06 | 2,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2480 |
| ROMANIA | 2024-11-04 | 1,000 | Blackcab Systems SRL | Art. 12 (3) GDPR, Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2479 |
| ROMANIA | 2024-10-30 | 15,000 | Untold SRL | Art. 12 (3), (4) GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2478 |
| ROMANIA | 2024-08-20 | 8,000 | Ana Hotels SRL | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2477 |
| ITALY | 2024-09-12 | 400 | Private individual | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2476 |
| ITALY | 2024-09-12 | 5,000 | Top Quality Corporation s.r.l.s. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2475 |
| ITALY | 2024-07-04 | 900,000 | Postel S.p.A | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2474 |
| SPAIN | 2024-10-22 | 180,000 | IBERCAJA BANCO, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2473 |
| ROMANIA | 2024-10-28 | 5,000 | Vodafone Romania S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2472 |
| ROMANIA | 2024-10-23 | 10,000 | Profi Rom Food SRL | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2471 |
| ROMANIA | 2024-10-16 | 3,000 | Your Consulting SRL | Art. 25 (1) GDPR, Art. 32 (1) a). b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2470 |
| IRELAND | 2024-10-24 | 310,000,000 | Art. 5 (1) a) GDPR, Art. 6 (1) a), e), f) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2469 | |
| POLAND | 2024-06-13 | 9,200 | Healthcare facility | Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2468 |
| POLAND | 2024-07-10 | 5,000 | Unknown | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2467 |
| POLAND | 2024-08-30 | 4,500 | Unknown | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2466 |
| SPAIN | 2024-08-06 | 1,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2465 |
| SPAIN | 2024-07-11 | 600 | ASSOCIACIO CANNABICA DEL MARESME ACANNAM | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2464 |
| ITALY | 2024-09-26 | 4,000 | CI & DI Food s.r.l. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2463 |
| SPAIN | 2024-07-05 | 10,000 | Clinic owner | Art. 6 (1) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2462 |
| IRELAND | 2024-09-27 | 91,000,000 | Meta Platforms Ireland Limited | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 33 (1), (5) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2461 |
| SPAIN | 2024-08-06 | 10,000 | LOCAL VERTICALS, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2460 |
| SPAIN | 2024-08-22 | 50,000 | SANTANDER CONSUMER FINANCE, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2459 |
| NORWAY | 2024-09-04 | 12,700 | University of Agder | Art. 32 GDPR, Art. 24 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2458 |
| POLAND | 2024-08-20 | 940,000 | mBank | Art. 34 (1), (2) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2457 |
| ROMANIA | 2024-09-17 | 3,000 | Constanța South Container Terminal SRL | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2456 |
| ROMANIA | 2024-09-16 | 3,000 | Vodafone România SA | Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2455 |
| ROMANIA | 2024-09-16 | 1,000 | SC Class IT Outsourcing SRL | Art. 12 (3) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2454 |
| GREECE | 2024-09-23 | 1,400 | Attorney | Art. 12 (3) GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2453 |
| ROMANIA | 2024-09-23 | 2,000 | PPC ENERGIE MUNTENIA S.A. | Art. 12 (3) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2452 |
| SPAIN | 2024-06-25 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2451 |
| SWEDEN | 2024-08-29 | 698,000 | Apohem AB | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2450 |
| SWEDEN | 2024-08-29 | 3,200,000 | Apoteket AB. | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2449 |
| THE NETHERLANDS | 2024-05-16 | 30,500,000 | Clearview AI Inc. | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 12 (1), (2) GDPR, Art. 14 (1), (2) GDPR, Art. 27 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2448 |
| THE NETHERLANDS | 2024-07-22 | 290,000,000 | Uber Technologies Inc., Uber B.V. | Art. 44 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2447 |
| POLAND | 2024-09-02 | 19,800 | National Prosecutor's Office | Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2446 |
| NORWAY | 2024-09-06 | 20,900 | Eidskog municipality | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2445 |
| GERMANY | 2024 | 32,000 | Company | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2444 |
| GERMANY | 2024 | 11,500 | Company | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2443 |
| GERMANY | 2024 | Unknown | Company | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2442 |
| GERMANY | 2024 | Unknown | Company | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2441 |
| GERMANY | 2024 | Unknown | Police employees | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2440 |
| GERMANY | 2024 | Unknown | Private individual | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2439 |
| GERMANY | 2024 | Unknown | Private individual | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2438 |
| GERMANY | 2024 | 6,000 | Online retailer | Unknown | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2437 |
| SPAIN | 2024-06-26 | 4,000 | ALTERNATIVA CORELLANA INDEPENDIENTE | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2436 |
| GERMANY | 2024 | 16,000 | Hotel | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2435 |
| SPAIN | 2024-07-04 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2434 |
| GERMANY | 2023 | 16,600 | Company | Art. 6 GDPR, Art. 12 GDPR, Art. 26 GDPR | Unknown | https://www.enforcementtracker.com/ETid-2433 |
| DENMARK | 2024-08-14 | 26,800 | Municipality of Vejen | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2432 |
| SPAIN | 2024-08-12 | 270,000 | UNIQLO EUROPE, LTD, SUCURSAL EN ESPAÑA | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2431 |
| FRANCE | 2024-01-31 | 20,000 | Website editor | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2430 |
| FRANCE | 2024-01-31 | 10,000 | Unknown | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2429 |
| POLAND | 2024-05-20 | 336,000 | Company | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2428 |
| ITALY | 2024-06-20 | 10,000 | TS Food Processing s.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2427 |
| SPAIN | 2023-03-16 | 145,000 | AFIANZA ASESORES S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2426 |
| FRANCE | 2024-05-25 | 15,000 | Association | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2425 |
| FRANCE | 2024-05-25 | 10,000 | Association | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2424 |
| FRANCE | 2024-01-31 | 5,000 | Dentist | Unknown | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2423 |
| FRANCE | 2024-04-25 | 16,000 | Association | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2422 |
| FRANCE | 2024-05-23 | 6,000 | Pubilc educational institution | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2421 |
| FRANCE | 2024-06-10 | 5,000 | Bakery | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2420 |
| ROMANIA | 2024-08-06 | 1,000 | BEST ELAN ONLINE SRL | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2419 |
| SPAIN | 2024-05-28 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2418 |
| SPAIN | 2024-06-07 | 2,000 | EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2417 |
| SPAIN | 2024-05-14 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2416 |
| FRANCE | 2024-01-24 | 20,000 | Pharmaceutical wholesaler | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2415 |
| FRANCE | 2024-01-22 | 500 | Attorney | Unknown | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2414 |
| FRANCE | 2024-01-15 | 5,000 | Attorney | Unknown | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2413 |
| FRANCE | 2024-01-09 | 1,500 | Website operator | Unknown | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2412 |
| ITALY | 2024-06-20 | 20,000 | Municipality of Nepi | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 2-ter Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2411 |
| FRANCE | 2024-07-22 | 6,900 | Municipality of Korou | Art. 31 GDPR, Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2410 |
| ITALY | 2024-04-24 | 30,000 | Rossi Carta S.r.l. | Art. 6 GDPR, Art. 7 GDPR, Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2409 |
| ITALY | 2024-05-23 | 8,400 | Azienda Sanitaria Locale TO4 | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2408 |
| SPAIN | 2024-05-28 | 70,000 | CAIXABANK S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2407 |
| SPAIN | 2024-04-15 | 400 | Private individual | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2406 |
| ITALY | 2024-05-23 | 4,500 | Azienda Socio-sanitaria Territoriale Rhodense | Art. 5 (1) d) GDPR, Art. 12 GDPR, Art. 16 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2405 |
| ITALY | 2024-06-20 | 4,000 | Medical association | Art. 12 (3) GDPR, Art. 13 (2) a) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2404 |
| SPAIN | 2024-07-18 | 600 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2403 |
| SPAIN | 2024-07-18 | 200,000 | Vodafone España, S.A.U. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2402 |
| SPAIN | 2024-07-17 | 600 | DIGIMAN ALICANTE S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2401 |
| GREECE | 2024-06-27 | 50,000 | METRO SA | Art. 15 GDPR, Art. 17 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2400 |
| THE NETHERLANDS | 2024-05-02 | 50,000 | A.S. Watson Health & Beauty Continental Europe B.V. | Art. 5 (1) a) GDPR, Ar.t 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2399 |
| LITHUANIA | 2024-07-02 | 2,385,276 | Vinted | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 12 (1), (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2398 |
| SPAIN | 2024-06-26 | 80,000 | AXA REAL ESTATE INVESTMENT MANAGERS IBERICA S.A. y SEUR GEOPOST, S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2397 |
| SPAIN | 2024-07-10 | 300 | WWPD CINVENTO INTERNATIONAL PATENT TRADING, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2396 |
| SPAIN | 2024-04-12 | 1,000 | DELSA ALQUILERES S.L. | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2395 |
| ITALY | 2024-06-06 | 500 | Comune di Ustica | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 9 (1), (2), (4) GDPR, Art. 37 (7) GDPR, Art. 2-ter (1), (3) Codice della privacy, Art. 2-septies (8) Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2394 |
| SPAIN | 2024-04-12 | 600 | Website operator | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2393 |
| SPAIN | 2024-05-22 | 3,000 | CUBILLO GALLEGO S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2392 |
| SPAIN | 2024-05-24 | 1,000 | VOX ESPAÑA | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2391 |
| ITALY | 2024-05-23 | 3,500 | Professional association | Art. 5 (1) a), d) GDPR Art. 6 GDPR, Art. 27 (7) GDPR, Art. 2-ter Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2390 |
| SPAIN | 2024-06-13 | 3,000 | DQG NORTE A.I.E | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2389 |
| SPAIN | 2024-06-17 | 3,000 | 20 AÑOS DE MÚSICA A.I.E. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2388 |
| SPAIN | 2024-06-05 | 800 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2387 |
| SPAIN | 2024-06-05 | 180 | Website operator | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2386 |
| SPAIN | 2024-04-26 | 10,000 | ASSOCIACIO OASIS CULTURAL | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2385 |
| SPAIN | 2024-06-25 | 150,000 | BANCO CETELEM, S.A. | Art. 6 GDPR, Art. 17 (1) d) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2384 |
| SPAIN | 2024-06-26 | 600 | Homeowners' association | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2383 |
| ITALY | 2024-04-11 | 20,000 | Istituto Nazionale di Previdenza Sociale | Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2382 |
| ITALY | 2024-06-06 | 6,419,631 | Eni Plenitude S.p.A. | Art. 5 (1) a), d), f) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 130 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2381 |
| ITALY | 2024-06-06 | 120,000 | Cappello Giovanni & Figli s.r.l. | Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 9 (2) b) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2380 |
| SPAIN | 2024-06-12 | 120,000 | BANCO BILBAO VIZCAYA ARGENTARIA, S.A. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2379 |
| SPAIN | 2024-06-10 | 160,000 | ALLIANZ COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2378 |
| SWEDEN | 2024-06-24 | 1,300,000 | Avanza Bank AB | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2377 |
| ROMANIA | 2024-06-25 | 1,000 | Rețele Electrice Dobrogea SA | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2376 |
| ROMANIA | 2024-06-25 | 3,000 | Rețele Electrice Muntenia SA. | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2375 |
| CYPRUS | 2024-02-08 | 2,000 | Brivio Limited | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2374 |
| CYPRUS | 2024-02-08 | 1,500 | Aylo Social LTD | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2373 |
| SPAIN | 2024-06-17 | 600 | Club Balonmano Gijón | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2372 |
| SPAIN | 2024-06-20 | 42,000 | CUI ZSQ FOOD, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2371 |
| ITALY | 2024-05-09 | 75,000 | Azienda ospedale università di Padova | Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2370 |
| POLAND | 2024-04-24 | 2,500 | Committee | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2369 |
| SPAIN | 2024-04-12 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2368 |
| SPAIN | 2024-06-10 | 100,000 | NATURGY IBERIA, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2367 |
| ITALY | 2024-04-24 | 30,000 | Gestore Dei Servizi Energetici - Gse S.p.A. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2366 |
| ITALY | 2024-04-24 | 10,000 | C.I.E.L. S.p.A. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2365 |
| ITALY | 2024-04-24 | 3,000 | I.N.P.A.S. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2364 |
| ITALY | 2024-04-24 | 5,000 | Dly S.r.l. | Art. 5 (1) a) GDPR, Art. 88 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2363 |
| ITALY | 2024-05-09 | 3,000 | Polisportiva Mimmo Ferrito s.r.l.. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2362 |
| ITALY | 2024-05-09 | 3,000 | Medical association | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2361 |
| SPAIN | 2024-06-05 | 6,000 | EUROBOX S.A. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2360 |
| ITALY | 2024-05-09 | 10,000 | Azzurro Club Hotels S.r.l. | Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 130 (2) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2359 |
| GERMANY | 2023 | Fine in four-digit amount | Private individual | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2358 |
| GERMANY | 2023 | Fine in four-digit amount | Physician | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2357 |
| GERMANY | 2023 | Unknown | Private individual | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2356 |
| GERMANY | 2023 | Unknown | Store detective | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2355 |
| GERMANY | 2023 | Unknown | Private individual | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2354 |
| GERMANY | 2023 | Unknown | Private individual | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2353 |
| SPAIN | 2024-04-19 | 1,000 | CONSULTORÍA PERITACIONES ALMERIENSES, S.L | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2352 |
| THE NETHERLANDS | 2024-06-04 | 6,000 | Ambitious People Group B.V. | Art. 12 (3) GDPR, Art. 17 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2351 |
| SPAIN | 2024-05-23 | 600 | President of a workers' council | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2350 |
| SPAIN | 2024-05-30 | 4,200 | PILLOW HOTELS, S.L. | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR, Art. 33 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2349 |
| ROMANIA | 2024-05-30 | 2,000 | Corint Logistic SRL. | Art. 5 (1) a), b) GDPR, Art. 17 GDPR, Art. 21 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2348 |
| FRANCE | 2024-06-05 | Unknown | Unknown | Unknown | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2347 |
| FRANCE | 2024-06-05 | Unknown | Unknown | Unknown | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2346 |
| FRANCE | 2024-06-05 | Unknown | Company | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2345 |
| FRANCE | 2024-06-05 | Unknown | Company | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2344 |
| SPAIN | 2024-05-07 | 1,200 | ARRENDAMIENTOS DEUDORES, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2343 |
| SPAIN | 2024-03-21 | 5,000 | HIPERBAZAR YONGFA 2018 SL | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2342 |
| ITALY | 2024-04-11 | 100,000 | Olimpia S.r.l. | Art. 5 (1) a), f) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2341 |
| ITALY | 2024-04-11 | 100,000 | Facile.Energy S.r.l. | Art. 5 (1) a), f) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2340 |
| SPAIN | 2024-05-22 | 96,000 | WATIUM S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2339 |
| SPAIN | 2024-05-07 | 360,000 | 4FINANCE SPAIN FINANCIAL SERVICES, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2338 |
| ITALY | 2024-04-11 | 1,000 | Store owner | Art. 5 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2337 |
| SPAIN | 2024-05-08 | 12,000 | DENTALCUADROS BCN S.L.P. | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2336 |
| ITALY | 2024-04-11 | 6,000 | Libero Consorzio comunale di Enna | Art. 37 (1), (7) GDPR, Art. 38 (2), (6) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2335 |
| ITALY | 2024-04-11 | 25,000 | Innova Camara | Art. 5 (1) e), f) GDPR, Ar.t 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2334 |
| POLAND | 2024-04-29 | 56,000 | Res-Gastro M. Gaweł Sp. k. | Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2333 |
| SPAIN | 2024-03-25 | 2,400 | Restaurant owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2332 |
| ITALY | 2024-03-07 | 20,000 | Centro Riparazioni Piacentino S.p.A. | Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2331 |
| ITALY | 2024-03-07 | 20,000 | Banca di Credito Cooperativo Appulo Lucana soc. cooperativa | Art. 12 (3), (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2330 |
| SPAIN | 2024-03-15 | 200,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2329 |
| SPAIN | 2024-04-30 | 1,200 | DELPASO CAR HIRE, S.L.U. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2328 |
| AUSTRIA | 2024-01-04 | 10,000 | Website operator | Art. 17 (1) GDPR, Art. 25 (1) GDPR, Art. 58 (2) c) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2327 |
| POLAND | 2024-04-30 | 210 | Association | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2326 |
| SPAIN | 2024-05-09 | 1,600 | Homeowners' association | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2325 |
| SPAIN | 2024-05-07 | 480 | Homeowners' association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2324 |
| SPAIN | 2024-02-23 | 90,000 | TELEFÓNICA DE ESPAÑA, S.A.U. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2323 |
| SPAIN | 2024-03-021 | 1,000 | CLÍNICA PARÍS, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2322 |
| SPAIN | 2024-01-08 | 2,000 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2321 |
| ITALY | 2024-03-07 | 2,000 | Bar | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2320 |
| SPAIN | 2024-02-19 | 400 | Private individual | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2319 |
| SPAIN | 2024-03-07 | 1,000 | DENTAL REY-GAR, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2318 |
| UNITED KINGDOM | 2024-04-30 | 8,700 | Central Young Men’s Christian Association | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2317 |
| ROMANIA | 2024-05-08 | 5,000 | CENTRUL MEDICAL UNIREA SRL | Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2316 |
| ROMANIA | 2024-05-09 | 1,000 | MEDICOVER SRL | Art. 32 (1) b) GDPR, Art. 32 (2), (3), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2315 |
| ROMANIA | 2024-05-09 | 2,000 | IRIDEX GROUP SALUBRIZARE SRL | Art. 32 (1) b) GDPR, Art. 32 (2), (3), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2314 |
| SPAIN | 2024-03-21 | 500 | JUNTA DE CONSERVACION SECTOR RESIDENCIAL ELORDIGAN SAT | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2313 |
| SPAIN | 2024-03-15 | 500 | CORPORACIÓN DUAL GRUPO LC, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2312 |
| GERMANY | 2023 | 5,000 | Company | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2311 |
| GERMANY | 2023 | 25,000 | Company | Art. 21 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2310 |
| GERMANY | 2023 | 3,600 | Physician | Art. 5 (1) f) GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2309 |
| ITALY | 2023-04-13 | 200,000 | Mas s.r.l.s. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 30 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2308 |
| ITALY | 2023-04-13 | 500,000 | Mas s.r.l. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 30 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2307 |
| ITALY | 2024-02-08 | 79,100,000 | Enel Energia SpA | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2306 |
| CROATIA | 2024-04-22 | 20,000 | Betting company | Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2305 |
| CROATIA | 2024-04-22 | 15,000 | Betting company | Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2304 |
| CROATIA | 2024-04-22 | Fine amount between EUR 500 and EUR 4,000 | Unknown | Art. 27 Croatin Law on the Implementation of the GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2303 |
| GERMANY | 2023 | Fine in three-digit amount | Fishing club | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2302 |
| GERMANY | 2023 | Fine in three-digit amount | Police officer | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2301 |
| GERMANY | 2023 | Fine in three-digit amount | Private individual | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2300 |
| GERMANY | 2023 | Fine in five-digit amount | Supermarket | Art. 6 (1) GDPR, Art. 9 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2299 |
| CZECH REPUBLIC | 2024-04-15 | 13,900,000 | Avast Software s.r.o. | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2298 |
| ROMANIA | 2024-04-23 | 2,000 | ALPHA BANK ROMANIA SA. | Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2297 |
| ROMANIA | 2024-04-22 | 2,000 | S.C. Tensa Art Design S.A.. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2296 |
| SPAIN | 2024-04-12 | 1,200,000 | CAIXABANK, S.A | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2295 |
| SPAIN | 2024-02-29 | 200,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2294 |
| SPAIN | 2024-03-01 | 200,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2293 |
| SPAIN | 2023-02-08 | 500 | Hiper Store S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2292 |
| SPAIN | 2023-10-26 | 7,000 | Ophthalmologic institute | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2291 |
| SPAIN | 2024-02-19 | 400 | Private individual | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2290 |
| ITALY | 2024-03-21 | 10,000 | Azienda sanitaria locale Roma 3 | Art. 33 (1), (2), (5) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2289 |
| SPAIN | 2022-11-07 | 60,000 | INFORMÁTICA MÉDICA, S.L. | Art. 28 GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-2288 |
| SPAIN | 2022-10-26 | 6,400 | AIO E-COMMERCE, S.L. | Art. 5 (1) c), f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2287 |
| SPAIN | 2024-04-05 | 112,000 | VODAFONE ESPAÑA, S.A.U. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2286 |
| SPAIN | 2024-04-12 | 1,800 | PRESTAMER, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2285 |
| GREECE | 2024-02-28 | 2,995,140 | Hellenic Post (ΕΛΛΗΝΙΚΑ ΤΑΧΥΔΡΟΜΕΙΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2284 |
| SPAIN | 2023-11-03 | 2,000 | SINDICATO LIBRE DE TRANSPORTES | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2283 |
| GERMANY | 2023 | Fine in four-digit amount | Daycare center | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2282 |
| GERMANY | 2023 | Fine in four-digit amount | Private individual | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2281 |
| GERMANY | 2023 | 75,000 | Company | Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2280 |
| SPAIN | 2023-11-02 | 48,000 | INSTITUT MARQUÉS OBSTETRICIA I GINECOLOGIA, S.L.P. | Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 34 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2279 |
| SPAIN | 2024-03-25 | 27,000 | 20 MINUTOS EDITORA, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2278 |
| BULGARIA | 2023-02-09 | 5,100 | Unknown | Art. 5 (1) a), b) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2277 |
| SPAIN | 2024-03-15 | 800 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2276 |
| SPAIN | 2022-06-22 | 1,600 | URQUÍA & BAS, CORREDURÍA DE SEGUROS S.L. | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2275 |
| SPAIN | 2024-02-06 | 160,000 | SANITAS, S.A. DE SEGUROS | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2274 |
| ITALY | 2024-02-22 | 2,000 | Camera di Commercio Industria Artigianato e Agricoltura | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2273 |
| SPAIN | 2024-02-13 | 100,000 | VODAFONE ESPAÑA, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2272 |
| SPAIN | 2024-02-13 | 4,000 | ASNEF-EQUIFAX, SERVICIOS DE INFORMACIÓN SOBRE SOLVENCIA Y CRÉDITO, S.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2271 |
| ITALY | 2023-07-18 | 45,000 | Municipality of Modica | Art. 5 (1) a), c), e) GDPR, Art. 5 (2) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 37 (1), (7) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2270 |
| SPAIN | 2024-01-23 | 7,500 | ROUNDED TECHNOLOGIES, S.L. | Art. 21 LSSI, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2269 |
| ITALY | 2024-02-08 | 18,000 | Azienda socio-sanitaria locale n. 1 di Sassari | Art. 5 GDPR, Art. 9 GPDR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2268 |
| SPAIN | 2024-02-12 | 365,000 | CTC EXTERNALIZACIÓN, S.L | Art. 13 GDPR, Art. 32 GDPR, Art. 35 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2267 |
| GREECE | 2024-04-02 | 175,000 | Greek Ministry of Immigration and Asylum | Art. 25 GDPR, Art. 31 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2266 |
| SPAIN | 2024-02-08 | 30,000 | CENTRO MÉDICO SALUS BALEARES, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2265 |
| ITALY | 2024-02-07 | 5,000 | Wi-Planet sas di Torri Carlo Alberto e c. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2264 |
| SPAIN | 2024-02-08 | 200,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2263 |
| SPAIN | 2024-02-13 | 40,000 | IBERIA LÍNEAS AÉREAS DE ESPAÑA, S.A. OPERADORA. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2262 |
| POLAND | 2024-03-12 | 18,000 | Toyota Bank Polska S.A. | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2261 |
| POLAND | 2024-03-12 | 326,000 | Santander Bank Polska S.A. | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2260 |
| ITALY | 2024-02-22 | 50,000 | Azienda Trasporto Passeggeri Emilia-Romagna S.p.A. | Art. 5 (1) a), e) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 21 (4) GDPR, Art. 130 (2), (3) Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2259 |
| POLAND | 2023-12-13 | 5,500 | Company | Unknown | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2258 |
| ICELAND | 2024-03-24 | 10,000 | Stjörnuna ehf | Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2257 |
| AUSTRIA | 2023 | 28,000 | Political party | Unknown | Unknown | https://www.enforcementtracker.com/ETid-2256 |
| ITALY | 2023-12-21 | 2,000 | Company | Art. 5 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2255 |
| POLAND | 2023-10-18 | 24,000 | Insurance company | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2254 |
| POLAND | 2023-12-19 | 2,300 | District Court Krakow | Art. 33 (1), (3) GDPR, Art. 34 (1), (2) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2253 |
| SPAIN | 2023-12-12 | 10,000 | VACACIONES EDREAMS, S.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2252 |
| SPAIN | 2023-12-23 | 3,500 | Private individual | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2251 |
| SPAIN | 2024-01-23 | 200,000 | ORANGE ESPAGNE S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2250 |
| SPAIN | 2023-01-19 | 56,000 | BANCO BILBAO VIZCAYA ARGENTARIA, S.A | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2249 |
| CYPRUS | 2023 | 8,000 | Bank of Cyprus Public Company Ltd. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2248 |
| CYPRUS | 2023-12-07 | 1,500 | Physician | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2247 |
| SPAIN | 2024-02-01 | 36,000 | HISPAPOST, S.A. | Art. 28 (3) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2246 |
| ITALY | 2024-02-08 | 300,000 | Medtronic Italia | Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2245 |
| ROMANIA | 2024-03-05 | 5,000 | EURO MINI STORAGE ROMANIA SRL | Art. 24 GDPR, Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2244 |
| FINLAND | 2024-03-06 | 856,000 | Verkkokauppa.com | Art. 5 (1) e) GDPR, Art. 25 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2243 |
| ITALY | 2024-02-08 | 800,000 | NTT Data Italia S.P.A | Art. 28 (2) GDPR, Art. 33 (2) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2242 |
| GERMANY | 2023 | Fine amount between EUR 100 and EUR 1,000 | Police officers | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2241 |
| GERMANY | 2023 | Unknown | Website operator | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2240 |
| GERMANY | 2023 | Unknown | Operator of a dating platform | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2239 |
| GERMANY | 2023 | Unknown | Real estate agency | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2238 |
| GERMANY | 2023 | Unknown | Clinic | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2237 |
| GERMANY | 2023 | Unknown | Company | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2236 |
| GERMANY | 2023 | Unknown | Company | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2235 |
| GERMANY | 2023 | Unknown | Company | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2234 |
| GERMANY | 2023 | 1,200 | Police officer | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2233 |
| GERMANY | 2023 | 2,000 | Private individual | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2232 |
| GERMANY | 2023 | Fine in four-digit amount | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2231 |
| GERMANY | 2023 | Fine in four-digit amount | Pizza delivery service | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2230 |
| GERMANY | 2023 | Unknown | Private individual | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2229 |
| ITALY | 2024-01-24 | 2,000 | Istituto Comprensivo Statale “F.S. Cabrini | Art. 5 (1) a) GDPR, Art. 6 (1) c), e) GDPR, Art. 2-ter (1), (3) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2228 |
| ITALY | 2024-02-08 | 2,800,000 | UniCredit S.p.a. | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2227 |
| SPAIN | 2024-01-24 | 1,200 | VUKMAL TRADE, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2226 |
| BELGIUM | 2024-01-16 | 174,640 | Black Tiger Belgium | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 15 GDPR Art. 24 GDPR, Art. 25 GDPR, Art. 30 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2225 |
| ITALY | 2024-01-31 | 2,000 | Provincia di Sassari | Art. 37 (7) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2224 |
| ITALY | 2024-01-31 | 2,000 | Provincia di Catanzaro | Art. 37 (7) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2223 |
| ITALY | 2024-01-31 | 2,000 | Libero Consorzio comunale di Caltanissetta | Art. 37 (7) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2222 |
| ITALY | 2024-01-31 | 5,000 | Municipality of Siracusa | Art. 37 (7) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2221 |
| SPAIN | 2023-10-25 | 6,100,000 | ENDESA ENERGÍA, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 34 GDPR, Art. 44 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2220 |
| SPAIN | 2023-10-31 | 300 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2219 |
| SPAIN | 2023-11-30 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2218 |
| SPAIN | 2023-10-23 | 50,000 | Oney Servicios Financieros E.F.C. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2217 |
| SPAIN | 2023-10-26 | 5,000,000 | CAIXABANK, S.A. | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2216 |
| SPAIN | 2023-12-17 | 600 | Private individual | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2215 |
| SPAIN | 2023-11-13 | 200,000 | CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2214 |
| POLAND | 2024-01-18 | 2,300 | Unknown | Art. 33 (1) GDPR, Art. 34 (1), (2) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2213 |
| ITALY | 2024-01-24 | 8,000 | Municipality of Salento | Art. 58 (2) c) GDPR, Art. 157 Codice della privacy | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2212 |
| ITALY | 2024-01-24 | 6,000 | Municipality | Art. 5 (1) a) GDPR, Art. 6 (1) c), e) GDPR, Art. 9 GDPR, Art. 37 (7) GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-septies (8) Codice della privacy, Art. 157 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2211 |
| ROMANIA | 2024-02-26 | 3,000 | VESTA CEU ROMÂNIA SRL. | Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2210 |
| ROMANIA | 2024-02-07 | 2,000 | Account Exchange SRL | Art. 5 (1) a), c) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2209 |
| ROMANIA | 2024-02-05 | 500 | Owners' association | Art. 5 (1) a), c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 (3), (4) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2208 |
| AUSTRIA | 2023-12-12 | 5,900 | Unknown | Art. 31 (1) GDPR, Art. 33 (1) GDPR, Art. 33 (3) a), d) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2207 |
| SPAIN | 2023-08-23 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2206 |
| SPAIN | 2024-01-11 | 1,000 | ATLAS ENTERTAINMENT, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2205 |
| SPAIN | 2023-11-20 | 200 | Private individual | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2204 |
| GREECE | 2024-01-29 | 5,000 | Municipality of Athens | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2203 |
| GREECE | 2024-01-29 | 25,000 | Ministry of Rural Development and Food | Art. 31 GDPR, Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-2202 |
| SPAIN | 2023-07-28 | 2,500,000 | Open Bank, S.A. | Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2201 |
| LITHUANIA | 2023-01-24 | 8,000 | Company | Art. 5 (1) a) GDPR, Art. 15 (1) a), b), c), d), g) GDPR, Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2200 |
| THE NETHERLANDS | 2023-12-11 | 10,000,000 | Uber Technologies Inc. Uber B.V. | Art. 12 (1), (2) GDPR, Art. 13 (1) f) GDPR, Art. 13 (2) a), b) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2199 |
| SPAIN | 2023-12-07 | 3,200 | SOLAR PROGRESS, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2198 |
| SPAIN | 2023-12-17 | 400 | TITAN STRONG, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2197 |
| ITALY | 2023-12-07 | 2,000 | Mushtaq Rubina Kebabish | Art. 5 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2196 |
| ROMANIA | 2024-01-30 | 2,000 | Sectorul 1 al Municipiului București | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2195 |
| POLAND | 2023-12-21 | 4,300 | Unknown | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2194 |
| POLAND | 2023-12-07 | 2,700 | Unknown | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2193 |
| FRANCE | 2024-01-23 | 32,000,000 | AMAZON FRANCE LOGISTIQUE | Art. 5 (1) c) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2192 |
| ITALY | 2023-12-07 | 40,000 | Azienda socio sanitaria territoriale nord Milano, C.F. | Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2191 |
| SPAIN | 2023-11-20 | 200 | Private individual | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2190 |
| SPAIN | 2023-11-17 | 4,000 | LEADDESK, S.L | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2189 |
| ITALY | 2023-12-07 | 1,000 | Sirio S.p.A. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2188 |
| ITALY | 2023-11-30 | 60,000 | Limit Call S.r.l.s. | Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 24 GDPR, Art. 130 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2187 |
| ROMANIA | 2024-01-15 | 3,000 | TECHNINK LEB SRL | Art. 32 (1) a), b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2186 |
| ROMANIA | 2024-01-12 | 17,000 | Alior Bank SA | Art. 5 (1) a), b) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2185 |
| SPAIN | 2023-12-01 | 30,000 | UNIPREX, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2184 |
| THE NETHERLANDS | 2024-01-15 | 150,000 | International Card Services B.V. | Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2183 |
| POLAND | 2022-12-30 | 6,300 | Company | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2182 |
| POLAND | 2023-04-20 | 5,400 | Disciplinary officer | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2181 |
| ITALY | 2023-11-30 | 3,000 | A R.L Spartan Gym | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2180 |
| ITALY | 2023-06-08 | 40,000 | RCS Mediagroup S.p.a. | Art. 5 (1) a), c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2179 |
| ITALY | 2023-11-16 | 50,000 | Comune di Castel Goffredo | Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 35 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2178 |
| ITALY | 2023-11-16 | 20,000 | Comune di Lonato del Garda | Art. 5 (1) a), b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2177 |
| ITALY | 2023-10-26 | 1,000 | Homeowner administrator | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2176 |
| GREECE | 2023-11-23 | 10,000 | Alpha Bank | Art. 12 (3) GDPR, Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2175 |
| ITALY | 2023-11-30 | 1,000 | Techno Security s.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2174 |
| SPAIN | 2023-11-21 | 8,000 | EASYJET AIRLINE COMPANY LIMITED | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2173 |
| SPAIN | 2023-11-21 | 180 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2172 |
| POLAND | 2023-12-20 | 23,000 | Polish Minister of Health | Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR, Art. 34 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2171 |
| UNITED KINGDOM | 2023-12-13 | 400,000 | UK Ministry of Defense | Unknown | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2170 |
| FRANCE | 2023-12-22 | Unknown | Unknown | Unknown | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2169 |
| FRANCE | 2023-12-22 | Unknown | Municipality | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2168 |
| FRANCE | 2023-12-22 | Unknown | Candidate for parliamentary elections | Art. 21 (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2167 |
| FRANCE | 2023-12-22 | Unknown | Company | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2166 |
| ITALY | 2023-11-16 | 18,000 | Cluster S.r.l. | Art. 5 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2165 |
| ITALY | 2023-11-16 | 40,000 | Amazon Italia Transport s.r.l. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2164 |
| SPAIN | 2023-11-03 | 600 | Homeowners' association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2163 |
| SPAIN | 2023-11-07 | 1,000 | Homeowners' association | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2162 |
| SPAIN | 2023-11-07 | 600 | Store owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2161 |
| ROMANIA | 2023-12-15 | 200 | Private individual | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2160 |
| ROMANIA | 2023-12-11 | 3,000 | Veranda Obor S.A. | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2159 |
| SPAIN | 2023-10-19 | 500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2158 |
| SPAIN | 2023-10-26 | 500 | UPMOBILE SOLUTIONS, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2157 |
| SPAIN | 2023-10-23 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2156 |
| FRANCE | 2023-12-12 | 5,000 | Kourou municipality | Art. 31 GDPR, Art. 37 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2155 |
| ITALY | 2023-11-16 | 100,000 | Autostrade per l’Italia S.p.A. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2154 |
| ICELAND | 2023-12-06 | 20,000 | City of Kópavogur | Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2153 |
| POLAND | 2023-08-30 | 13,000 | Unknown | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2152 |
| POLAND | 2023-11-16 | 3,200 | Unknown | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2151 |
| SPAIN | 2023-10-28 | 10,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2150 |
| ITALY | 2023-10-26 | 20,000 | Region of Lombardy | Art.5 GDPR, Art. 6 (1) c), e) GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2149 |
| ROMANIA | 2023-12-07 | 24,000 | Hora Credit IFN SA | Art. 12 (3) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2148 |
| GREECE | 2023-11-10 | 20,000 | Piraeus Leasing S.M.S.A. | Art. 5 (1) GDPR, Art. 15 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2147 |
| GREECE | 2023-11-07 | 5,000 | Municipality | Art. 6 (1) GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2146 |
| ITALY | 2023-10-12 | 40,000 | Azienda socio sanitaria territoriale di Lodi CF | Art. 5 (1) a), b), c), f) GDPR, Art. 9 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2145 |
| CYPRUS | 2023-11-22 | 45,000 | Open University of Cyprus | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2144 |
| SPAIN | 2023-10-11 | 500 | ALBEN AIRPORT FACILITIES S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2143 |
| ICELAND | 2023-12-06 | 18,600 | City of Hafnarfjörður | Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2142 |
| ICELAND | 2023-12-06 | 16,600 | Garðabær municipality | Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2141 |
| ICELAND | 2023-12-06 | 13,300 | City of Reykjavik | Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2140 |
| ICELAND | 2023-12-06 | 16,600 | Reykjanesbær municipality | Art. 5 (1) GDPR, Art. 24 (1) GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2139 |
| POLAND | 2023-10-08 | 24,000 | Link4 Towarzystwo Ubezpieczeń S. A. | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2138 |
| SWEDEN | 2023-11-28 | 26,500 | Östersund Municipality's Department for Children and Education | Art. 35 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2137 |
| NORWAY | 2023-11-27 | 1,700,000 | Norwegian Labor and Welfare Administration | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1) d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2136 |
| ROMANIA | 2023-06-20 | 40,000 | Dante International SA | Art. 12 (2) GDPR, Art. 17 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2135 |
| SPAIN | 2023-11-22 | 56,000 | VODAFONE ESPAÑA, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2134 |
| SPAIN | 2023-11-17 | 72,000 | Eurocollege Oxford English Institute S.L. | Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2133 |
| THE NETHERLANDS | 2023-11-02 | 30,000 | Voorschoten municipality | Art. 5 (1) a) GDPR, Art. 6 (1) e) GDPR, Art. 14 (1) c), d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2132 |
| SPAIN | 2023-11-27 | 50,000 | SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2131 |
| AUSTRIA | 2023-09-26 | 10,000 | Phyisician | Art. 5 (1) a), b), c) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2130 |
| SPAIN | 2023-11-20 | 10,000 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2129 |
| SPAIN | 2023-11-24 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2128 |
| SPAIN | 2023-11-24 | 10,000 | Pharmacy owner | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2127 |
| SPAIN | 2023-11-22 | 400 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2126 |
| SPAIN | 2023-11-20 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2125 |
| ROMANIA | 2023-11-20 | 1,500 | Libra Internet Bank SA | Art. 58 (2) GDRP | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2124 |
| SPAIN | 2023-11-16 | 20,000 | QUALITY-PROVIDER S.A. | Art. 6 (1) GDPR, Art. 58 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2123 |
| LUXEMBOURG | 2023-09-21 | 2,500 | Unknown | Art. 5 (1) b), c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2122 |
| SPAIN | 2023-11-16 | 20,000 | FORO ASTURIAS | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2121 |
| SPAIN | 2023-11-16 | 500 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2120 |
| SPAIN | 2023-11-16 | 10,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2119 |
| ITALY | 2023-08-31 | 25,000 | Robin Srl | Art. 5 (1) a) GDPR, Art. 137 (3) Codice della privacy, Art. 139 Codice della privacy, Art. 6 Regole deontologiche, Art. 7 Regole deontologiche, | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2118 |
| GREECE | 2023-09-25 | 50,000 | Athens Urban Transport Organization | Art. 5 (1) e) GDPR, Art. 25 (1) GDPR, Art. 35 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2117 |
| GREECE | 2023-10-11 | 1,000 | Unknown | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2116 |
| SPAIN | 2023-11-15 | 10,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2115 |
| ITALY | 2023-07-18 | 100,000 | Tiscali Italia SpA | Art. 5 (1) a), b), c), e) GDPR, Art. 5 (2) GDPR, Art. 12 (1) GDPR, Art. 13 (1) a) GDPR, Art. 24 GDPR, Art. 130 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2114 |
| ITALY | 2023-07-18 | 40,000 | Compara Facile S.r.l. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 (2) GDPR, Art. 24 (1), (2) GDPR, Art. 25 (1) GDPR, Art. 130 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2113 |
| ROMANIA | 2023-11-13 | 110,000 | Rompetrol Downstream SRL | Art. 32 (1) b), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2112 |
| ITALY | 2023-09-14 | 5,000 | Nimbus s.r.l. | Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2111 |
| ITALY | 2023-10-12 | 70,000 | Scionti Selezioni Superiori S.r.l. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 24 (1), (2) GDPR, Art. 25 GDPR, Art. 130 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2110 |
| ITALY | 2023-09-28 | 5,000 | Ministero dell'Ambiente e della Sicurezza Energetica | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-septies (8) Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2109 |
| ITALY | 2023-09-28 | 50,000 | Azienda Usl Toscana centro | Art. 5 (1) a), e), f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2108 |
| ITALY | 2023-09-28 | 60,000 | Salvator Mundi International Hospital s.r.l | Art. 5 (1) a), b) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2107 |
| SPAIN | 2023-11-02 | 30,000 | APOLLONIA TOPCO, S.L. | Art. 5 (1) c) GDPR, Art. 38 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2106 |
| ITALY | 2023-09-28 | 3,000 | Palombaro s.r.l. | Art. 5 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2105 |
| SPAIN | 2023-09-23 | 12,000 | CHATWITH.IO WORLDWIDE, S.L. | Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 22 (2) LSSI | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2104 |
| SWEDEN | 2023-11-07 | 43,000 | Indcap AB | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2103 |
| SPAIN | 2023-11-13 | 1,000 | TRACTAMENT D'AIGUES TEIA, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2102 |
| ROMANIA | 2023-11-03 | 3,000 | OTP BANK ROMANIA SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2101 |
| SPAIN | 2023-11-06 | 400 | Private individual | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2100 |
| SPAIN | 2023-11-06 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2099 |
| SPAIN | 2023-11-06 | 200,000 | DIGI SPAIN TELECOM, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2098 |
| SPAIN | 2023-11-07 | 70,000 | THE BEE LOGISTICS, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2097 |
| SPAIN | 2023-11-06 | 240 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2096 |
| ITALY | 2023-09-28 | 5,000 | Physician | Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2095 |
| SPAIN | 2023-11-03 | 600 | Hotel | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2094 |
| SPAIN | 2023-10-18 | 600 | FESTINA LOTUS S.A. | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2093 |
| SPAIN | 2023-10-18 | 2,000 | UNIQUE HOTEL APARTMENT S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2092 |
| SPAIN | 2023-10-20 | 800,000 | BANCO BILBAO VIZCAYA ARGENTARIA, S.A. | Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2091 |
| SPAIN | 2023-10-31 | 180 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2090 |
| ROMANIA | 2023-10-27 | 500 | Homeowners Association | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2089 |
| ROMANIA | 2023-10-25 | 1,000 | SC Spark Car Sharing SRL | Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2088 |
| ITALY | 2023-07-18 | 75,000 | Università Telematica E-Campus | Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 130 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2087 |
| ROMANIA | 2023-10-24 | 3,000 | Mensajero SRL | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2086 |
| ITALY | 2023-09-14 | 42,000 | Intesa Sanpaolo Spa | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2085 |
| ITALY | 2023-08-31 | 10,000 | Mednow Medical Center di Giugni Marco | Art. 5 (1) d), f) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2084 |
| ITALY | 2023-08-31 | 20,000 | Bar association | Art. 5 GDPR, Art. 2-octies Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2083 |
| POLAND | 2023-07-18 | 3,400 | Company | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2082 |
| ROMANIA | 2023-10-02 | 1,000 | Cez Vânzare S.A. | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2081 |
| ITALY | 2023-09-28 | 30,000 | Asl Napoli 3 Sud | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2080 |
| SPAIN | 2023-10-25 | 500 | BILBAO AD INFINITUM, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2079 |
| SPAIN | 2023-10-30 | 240 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2078 |
| ITALY | 2023-09-28 | 10,000,000 | Axpo Italia Spa | Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 24 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2077 |
| AUSTRIA | 2023-06-16 | 1,000 | Private individual | Art. 6 (1), (4) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2076 |
| ITALY | 2023-09-14 | 10,000 | San Severo municipality | Art. 5 (1) a) GDPR, Art. 6 (1) c), e) GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2075 |
| ROMANIA | 2023-10-20 | 1,000 | DANTE INTERNATIONAL SA | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2074 |
| ITALY | 2023-09-14 | 10,000 | Azienda Sanitaria dell'Alto Adige - Suedtiroler Sanitaetsbetrieb | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2073 |
| FRANCE | 2023-10-12 | 600,000 | GROUPE CANAL + | Art. 7 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. L. 34-5 CPCE | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2072 |
| ITALY | 2023-09-14 | 20,000 | Shardana Working Soc. Coop. a r.l. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2071 |
| SWEDEN | 2023-10-17 | 30,000 | H&M Hennes & Mauritz GBC AB | Art. 12 (3) GDPR, Art. 21 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2070 |
| SPAIN | 2023-10-15 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2069 |
| ITALY | 2023-09-14 | 90,000 | GFB One s.r.l. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 157 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2068 |
| SWEDEN | 2023-10-03 | 70,000 | Schockholm School borard | Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2067 |
| CYPRUS | 2023 | 8,000 | Cypriot Ministry of the Interior | Art. 5 (1) a), c), f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2066 |
| SPAIN | 2023-10-11 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2065 |
| SPAIN | 2023-10-11 | 5,300 | Private individual | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2064 |
| CROATIA | 2023-10-05 | 5,470,000 | Debt collection company | Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 (1) GDPR, Art. 32 (1) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2063 |
| CROATIA | 2023-09-14 | 30,000 | Betting company | Art. 6 (1) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2062 |
| CROATIA | 2023-09-14 | 20,000 | Betting company | Art. 6 (1) GDPR, Art. 7 GDPR, Art. 13 (1), (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2061 |
| CROATIA | 2023-09-26 | 15,000 | Hotel | Art. 6 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 32 (1) a), d) GDPR, Art. 32 (4) GDPR, Art. 38 (6) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2060 |
| CROATIA | 2023-09-13 | 25,000 | Zagreb Holding d.o.o. | Art. 13 (1) c) GDPR, Art. 13 (2) a), e) GDPR, Art. 25 (2) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2059 |
| SPAIN | 2023-10-09 | 500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2058 |
| SPAIN | 2023-10-09 | 4,000 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2057 |
| SPAIN | 2023-10-10 | 1,500 | NORDETIA CLINICS MÓSTOLES S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2056 |
| SPAIN | 2023-10-10 | 15,000 | ILUNION SEGURIDAD, S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2055 |
| ITALY | 2023-07-18 | 12,000 | Azienda Socio Sanitaria Territoriale Ovest Milanese | Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2054 |
| POLAND | 2023-07-12 | 2,500 | Company | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-2053 |
| FINLAND | 2023-09-04 | 1,600 | Company | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2052 |
| ITALY | 2023-07-18 | 400 | Private individual | Art. 5 (1) a) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2051 |
| CYPRUS | 2023 | 3,000 | Breikot Management Ltd | Art. 5 (1) c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2050 |
| SPAIN | 2023-10-05 | 500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2049 |
| SPAIN | 2023-09-25 | 17,000 | FEDERACIÓN DE BALONMANO DE CASTILLA LA MANCHA | Art. 9 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2048 |
| ITALY | 2023-08-31 | 10,000 | RCS Mediagroup Spa | Art. 5 (1) a), c) GDPR, Art. 2-quater (4) Codice della privacy, Art. 137 Codice della privacy, Art. 139 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2047 |
| ROMANIA | 2023-09-25 | 2,000 | UAT Comuna Albeni | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2046 |
| ROMANIA | 2023-09-26 | 25,000 | RESTART ENERGY ONE S.A. | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2045 |
| FRANCE | 2023-09-18 | 200,000 | SAF LOGISTICS | Art. 5 (1) c) GDPR, Art. 9 GDPR, Art. 10 GDPR, Art. 31 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2044 |
| SPAIN | 2023-09-27 | 420 | CHINA CENTER LLEIDA | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2043 |
| SPAIN | 2023-09-26 | 70,000 | DIGI SPAIN TELECOM, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2042 |
| SPAIN | 2023-09-26 | 30,000 | EUROPA PRESS DE CATALUNYA, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2041 |
| SPAIN | 2023-09-25 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2040 |
| HUNGARY | 2023-06-22 | 205,000 | Digi Telecommunications and Services Ltd. | Art. 5 (1) a) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2039 |
| SPAIN | 2023-08-30 | 140,000 | GENERAL LOGISTICS SYSTEMS SPAIN, S.A. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2038 |
| ITALY | 2023-07-18 | 1,000 | Prodav srl | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2037 |
| SPAIN | 2023-09-07 | 70,000 | SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2036 |
| SPAIN | 2023-09-21 | 4,000 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2035 |
| SPAIN | 2023-09-21 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2034 |
| ITALY | 2023-07-06 | 10,000 | AcegasApsAmga SpA | Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2033 |
| IRELAND | 2023-09-01 | 345,000,000 | TikTok Limited | Art. 5 (1) c), 5 (1) f) GDPR, Art. 12 (1) GDPR, Art. 13 (1) e) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2032 |
| FINLAND | 2023-09-11 | 23,000 | Suomen Yritysrekisteri | Art. 12 (1), (2), (6) GDPR, Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2031 |
| ROMANIA | 2023-09-18 | 1,000 | NN Asigurări de Viață S.A. | Art. 21 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-2030 |
| ICELAND | 2023-09-06 | 10,300 | University of Iceland | Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2029 |
| SPAIN | 2023-08-30 | 300 | Private individual | Art. 6 (1) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2028 |
| SPAIN | 2023-09-01 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2027 |
| SPAIN | 2023-09-05 | 80,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2026 |
| SPAIN | 2023-09-19 | 600 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2025 |
| SPAIN | 2023-09-19 | 1,500 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2024 |
| ITALY | 2023-06-22 | 1,000,000 | Autostrade per l'Italia spa | Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2023 |
| ITALY | 2023-06-08 | 300,000 | Rinascente S.p.A. | Art. 5 (1) a), b), c), e), f) GDPR, Art. 12 (1) GDPR, Art. 32 (1) b), d) GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2022 |
| SWEDEN | 2023-08-28 | 3,000,000 | Trygg-Hansa | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2021 |
| SPAIN | 2023-08-28 | 4,800 | WALL BOX CHARGERS S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2020 |
| SPAIN | 2023-08-29 | 1,500 | ALBEN AIRPORT FACILITIES S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2019 |
| SPAIN | 2023-08-30 | 180 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2018 |
| SPAIN | 2023-08-30 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2017 |
| SPAIN | 2023-08-30 | 1,500 | Private individual | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2016 |
| ITALY | 2023-07-18 | 5,000 | Ermeslink di Giovanni Di Stefano | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2015 |
| ITALY | 2023-07-18 | 10,000 | Cat s.r.l. | Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2014 |
| ROMANIA | 2023-08-21 | 70,000 | Uipath SRL | Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-2013 |
| SPAIN | 2023-08-28 | 500 | MULTIGAS ASESORES S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2012 |
| SPAIN | 2023-08-28 | 10,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2011 |
| SPAIN | 2023-08-25 | 1,500 | Homeowners' association | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2010 |
| SPAIN | 2023-08-23 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2009 |
| SPAIN | 2023-08-16 | 5,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2008 |
| SPAIN | 2023-08-18 | 20,000 | JOLY DIGITAL, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2007 |
| ITALY | 2023-07-06 | 5,000 | Ristorante Francesco srl | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2006 |
| SPAIN | 2023-08-11 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2005 |
| SPAIN | 2023-08-16 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-2004 |
| SPAIN | 2023-08-16 | 600 | MÁRMOLES Y GRANITOS MEJIAS, S. L. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2003 |
| SPAIN | 2023-08-11 | 500 | RING RING CLIN S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2002 |
| SPAIN | 2023-08-11 | 6,000 | ADENET SYSTEMS, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-2001 |
| ITALY | 2023-06-01 | 20,000 | Azienda Usl Toscana Sud Est. | Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR, Art. 25 (1), (2) GDPR, Art. 2-septies (8) Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-2000 |
| SPAIN | 2023-08-02 | 10,000 | GYMOOGIMNASIOS S.L. | Art. 5 (1) c) GDPR, Art. 7 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1999 |
| SPAIN | 2023-08-08 | 6,000 | ODRIA COSTAS INTERNACIONAL, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1998 |
| ITALY | 2023-06-01 | 10,000 | Camedi s.r.l. | Art. 5 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1997 |
| SPAIN | 2023-08-08 | 6,000 | ELECTRAWORKS - CEUTA, S.A. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1996 |
| GERMANY | 2023 | 215,000 | Humboldt Forum Service GmbH | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1995 |
| ITALY | 2023-06-01 | 20,000 | Ew Business Machines S.p.A. | Art. 5 (1) a), c) GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1994 |
| ITALY | 2023-06-01 | 15,000 | Thin Srl | Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1993 |
| SPAIN | 2023-07-27 | 1,200 | FONTANORTE, S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1992 |
| SPAIN | 2023-07-27 | 5,000 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1991 |
| ITALY | 2023-06-07 | 5,000 | Azienda Tutela della Salute della Sardegna | Art. 5 GDPR, Art. 9 GDPR, Art. 2-septies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1990 |
| SPAIN | 2023-07-27 | 5,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1989 |
| ROMANIA | 2023-08-03 | 2,000 | Med Life SA | Art. 12 (4) GDPR, Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1988 |
| SPAIN | 2023-07-31 | 70,000 | TELEFÓNICA MÓVILES ESPAÑA, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1987 |
| SPAIN | 2023-08-01 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1986 |
| SPAIN | 2023-08-01 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1985 |
| SPAIN | 2023-08-01 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1984 |
| SPAIN | 2023-08-01 | 20,000 | QUALITY-PROVIDER S.A. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1983 |
| POLAND | 2023-01-25 | 4,100 | Company | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1982 |
| POLAND | 2023-05-31 | 2,300 | Company | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1981 |
| POLAND | 2023-06-02 | 4,300 | Company | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1980 |
| ITALY | 2023-06-01 | 3,000 | Comune di Napoli | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1979 |
| POLAND | 2023-06-21 | 7,500 | Company | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1978 |
| ITALY | 2023-04-14 | 15,000 | Citynews S.p.A. | Art. 5 (1) a), c) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1977 |
| ITALY | 2023-05-17 | 10,000 | La Gazzetta di Parma S.r.l. | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1976 |
| GERMANY | 2022 | Unknown | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1975 |
| GERMANY | 2022 | Fine in three-digit amount | Data protection officer | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1974 |
| LITHUANIA | 2023-04-20 | 20,000 | Company | Art. 5 (1) e), f) GDPR, Art. 32 (1) b), d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1973 |
| SPAIN | 2023-07-26 | 600 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1972 |
| SPAIN | 2023-07-26 | 1,200 | SERVICIOS E INTERVENCIONES EN EDIFICACION DEL MEDITERRÁNEO, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1971 |
| SPAIN | 2023-07-25 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1970 |
| SPAIN | 2023-07-24 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1969 |
| ROMANIA | 2023-07-18 | 3,000 | ING Bank NV Amsterdam Sucursala București | Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1968 |
| SPAIN | 2023-07-12 | 10,000 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1967 |
| SPAIN | 2023-07-16 | 300 | Private individual | Art. 13 GDRP | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1966 |
| IRELAND | 2023-06-16 | 22,500 | Irish Departement of Health | Art. 5 (1) c) GDPR, Art. 6 (1), (4) GDPR, Art. 9 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1965 |
| SPAIN | 2023-07-17 | 10,000 | NANDIVALE, S.L | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1964 |
| SPAIN | 2023-07-21 | 720 | MADRID TOURISTIC CAPITAL, S.L. | Art. 13 GDRP | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1963 |
| SPAIN | 2023-07-18 | 70,000 | DIGI SPAIN TELECOM, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1962 |
| POLAND | 2023-05-31 | 10,600 | Company | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR, Art. 33 (1) GDPR, Art. 34 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1961 |
| SPAIN | 2023-07-20 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1960 |
| SPAIN | 2023-07-20 | 1,000 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1959 |
| SPAIN | 2023-07-12 | 48,000 | Birou Gas, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1958 |
| SPAIN | 2023-06-07 | 1,200 | CONCENTRA CENTRAL DE COMPRAS Y SERVICIOS S.L. | Art. 21 (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1957 |
| SPAIN | 2023-06-06 | 3,000 | Private individual | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1956 |
| SPAIN | 2023-05-29 | 300 | CBHNOS S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1955 |
| SPAIN | 2023-03-30 | 1,800 | LISMARTSA, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1954 |
| SPAIN | 2023-07-04 | 25,000 | CaixaBank, S.A. | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1953 |
| ICELAND | 2023-06-27 | 257,000 | Creditinfo Lánstraust hf. | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 8 laga nr. 90/2018, Art. 9 laga nr. 90/2018 | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1952 |
| ITALY | 2023-04-27 | 4,000 | Università degli studi di Cassino e del Lazio Meridionale | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-octies Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1951 |
| ITALY | 2023-05-17 | 10,000 | Santander Consumer Bank S.p.a. | Art. 12 (3), (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1950 |
| SPAIN | 2023-07-10 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1949 |
| ICELAND | 2023-06-27 | 51,000 | eCommerce 2020 ApS | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 8 laga nr. 90/2018, Art. 9 laga nr. 90/2018 | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1948 |
| SPAIN | 2023-05-29 | 180 | CARROZADOS TECAI, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1947 |
| ICELAND | 2023-06-27 | 24,000 | Almennri innheimtu ehf | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 8 laga nr. 90/2018, Art. 9 laga nr. 90/2018 | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1946 |
| SPAIN | 2023-07-05 | 1,200 | LISMARTSA, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1945 |
| SPAIN | 2023-07-07 | 5,000 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1944 |
| SPAIN | 2023-07-07 | 2,000 | KUGELCHEN PROPIERTIES, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1943 |
| SPAIN | 2023-07-07 | 15,000 | RCL CRUISES LTD | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1942 |
| SPAIN | 2023-07-03 | 56,000 | ODAFONE SERVICIOS, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1941 |
| ICELAND | 2023-07-03 | 81,000 | Heilsuveru | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1940 |
| SPAIN | 2023-07-04 | 500 | EXPLOTACIONES HOSTELERAS Y DE OCIO ALBACETEÑAS, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1939 |
| SWEDEN | 2023-06-30 | 25,000 | CDON AB | Art. 44 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1938 |
| SWEDEN | 2023-06-30 | 1,000,000 | Tele2 Sverige Aktiebolag | Art. 44 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1937 |
| SPAIN | 2023-06-30 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1936 |
| ITALY | 2023-05-17 | 60,000 | Website operator | Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 (1), (2) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 16 GDPR Art. 17 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1935 |
| SPAIN | 2023-06-29 | 1,000 | PUNTO ROJO LIBROS, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1934 |
| ICELAND | 2023-06-28 | 13,400 | Sjúkratyringur Íslands | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1933 |
| ITALY | 2023-05-17 | 10,000 | Grizzaffi Management Srl | Art. 5 (1) a) GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1932 |
| ITALY | 2023-04-27 | 240,000 | Benetton Group S.r.l. | Art. 5 (1) c), e) GDPR, Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1931 |
| ITALY | 2023-04-27 | 2,000 | Store owner | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1930 |
| POLAND | 2023-05-16 | 6,700 | Municipality | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1929 |
| SWEDEN | 2023-06-26 | 1,100,000 | Bonnier News AB | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1928 |
| ITALY | 2023-04-13 | 13,000 | Azienda socio sanitaria locale n. 3 di Nuoro | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1927 |
| ITALY | 2023-04-13 | 3,000 | Comune di Cogollo del Cengio | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1926 |
| ITALY | 2023-04-27 | 15,000 | Ufficio Scolastico Regionale per la Puglia, Ufficio VI - Ambito Territoriale di Lecce | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1925 |
| ITALY | 2023-03-23 | 40,000 | La Risorsa Umana.it s.r.l. | Art. 5 (1) a), c) GDPR, Art. 13 GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1924 |
| SPAIN | 2023-06-27 | 1,000 | TRC TRUCKS 2020, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1923 |
| GREECE | 2023-05-29 | 150,000 | NOVA TELECOMMUNICATIONS & MEDIA ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε., | Art. 12 (3), (4), (5) GDPR, Art. 15 (1) GDPR, Art. 21 (3) GDPR, Art. 25 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1922 |
| GREECE | 2023-06-12 | 210,000 | Piraeus Bank | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 15 (1) GDPR, Art. 25 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1921 |
| ITALY | 2023-05-17 | 10,000 | Azienda ULSS 6 Euganea | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1920 |
| ROMANIA | 2023-06-27 | 2,500 | Farmacia Ardealul SRL | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1919 |
| SPAIN | 2023-06-22 | 90,000 | Sociedad Vascongada de Publicaciones, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1918 |
| SPAIN | 2023-06-22 | 90,000 | Corporación de Medios de Extremadura | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1917 |
| SPAIN | 2023-06-23 | 180 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1916 |
| ITALY | 2023-04-27 | 239,000 | Ama S.p.a. | Art. 28 GDPR, Art. 29 GDPR, Art. 32 GDPR, Art. 2-quaderdecies Codice della Privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1915 |
| ITALY | 2023-04-27 | 176,000 | Roma Capitale | Art. 5 (1) a), b), c), d), f) GDPR, Art. 9 GDPR, Art. 28 GDPR, Art. 29 GDPR, Art. 32 GDPR, Art. 2-sexies Codice della privacy, Art. 2-septies Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1914 |
| ITALY | 2023-05-17 | 40,000 | Volkswagen Leasing GmbH | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1913 |
| FRANCE | 2023-06-15 | 40,000,000 | CRITEO | Art. 7 (1), (3) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 (1) GDPR, Art. 17 (1) GDPR, Art. 26 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1912 |
| MALTA | 2022 | 65,000 | Unknown | Art. 5 (1) f) GDPR, Art. 6 (1) GDPR, Art. 9 (1), (2) GDPR, Art. 32 (1) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1911 |
| MALTA | 2023 | 2,500 | Unknown | Art. 5 (1) a) GDPR, Art. 12 (1), (3) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 (1), (3) GDPR, Art. 24 (2) GDPR, Art. 38 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1910 |
| MALTA | 2023 | 5,000 | Unknown | Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1909 |
| POLAND | 2023-05-05 | 2,200 | Municipality | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1908 |
| GERMANY | 2022 | Unknown | Physician | Art.5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1907 |
| LATVIA | 2022 | Unknown | Company | Art.5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1906 |
| BELGIUM | 2023-06-16 | 30,000 | Belgian Order of Pharmacists | Art. 5 (1) a), b), c), d), e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1905 |
| ROMANIA | 2023-06-21 | 1,000 | Vodafone Romania SA | Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1904 |
| SPAIN | 2023-06-21 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1903 |
| LATVIA | 2022 | Unknown | Unknown | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1902 |
| LATVIA | 2022 | Unknown | Unknown | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1901 |
| SPAIN | 2023-06-20 | 50,000 | GRUPO TRANSAHER, SL. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1900 |
| SPAIN | 2023-06-20 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1899 |
| SPAIN | 2023-06-14 | 70,000 | Digi Spain Telecom, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1898 |
| SPAIN | 2023-06-14 | 70,000 | Digi Spain Telecom, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1897 |
| ITALY | 2023-04-27 | 400 | Private individual | Art. 5 (1) a) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1896 |
| ROMANIA | 2023-06-15 | 8,000 | Artima S.A. | Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1895 |
| ROMANIA | 2023-06-15 | 2,000 | BRD-Groupe Société Générale S.A. | Art. 5 (1) a), b), f) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1894 |
| ITALY | 2023-04-14 | 676,956 | Sorgenia S.p.a. | Art. 5 (2) GDPR, Art. 12 (3) GDPR, Art. 25 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1893 |
| ITALY | 2023-04-14 | 237,800 | Green Network S.p.A. | Art. 5 (2) GDPR, Art. 25 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1892 |
| FRANCE | 2023-06-08 | 150,000 | KG COM | Art. 5 (1) c), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 82 Loi informatique et libertés | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1891 |
| GERMANY | 2022 | Unknown | Credit agency | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1890 |
| GERMANY | 2022 | Unknown | Job center employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1889 |
| GERMANY | 2022 | Unknown | Job center employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1888 |
| GERMANY | 2022 | 500 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1887 |
| GERMANY | 2022 | 8,900 | Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1886 |
| GERMANY | 2022 | 50,000 | Company | Art. 15 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1885 |
| SPAIN | 2023-06-14 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1884 |
| SPAIN | 2023-06-14 | 400 | Unknown | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1883 |
| SPAIN | 2023-06-13 | 70,000 | DIGI SPAIN TELECOM, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1882 |
| SPAIN | 2023-06-13 | 70,000 | DIGI SPAIN TELECOM, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1881 |
| SPAIN | 2023-06-09 | 70,000 | DIGI SPAIN TELECOM, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1880 |
| SPAIN | 2023-06-08 | 180 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1879 |
| SPAIN | 2023-06-07 | 400 | LEADDESK, S.L | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1878 |
| SPAIN | 2023-06-16 | 2,000 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1877 |
| SWEDEN | 2023-06-12 | 4,900,000 | Spotify | Art. 12 (1) GDPR, Art. 15 (1), (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1876 |
| SPAIN | 2023-05-17 | 50,000 | FUSIONA SOLUCIONES ENERGÉTICAS, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1875 |
| SPAIN | 2023-05-23 | 70,000 | Digi Spain Telecom, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1874 |
| SPAIN | 2023-06-06 | 70,000 | Digi Spain Telecom, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1873 |
| SPAIN | 2023-06-07 | 84,000 | UNITED PARCEL SERVICE ESPAÑA LTD. Y CIA SRC | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1872 |
| ITALY | 2023-04-13 | 7,631,175 | TIM S.p.A. | Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GPDR, Art. 12 (2), (3) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 (1) GDPR, Art. 32 (1) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1871 |
| GERMANY | 2022 | Fine amount between EUR 200 and EUR 1000 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1870 |
| ITALY | 2023-03-02 | 50,000 | H&M Hennes & Mauritz s.r.l. EUR 50,000 | Art. 5 (1) a) GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1869 |
| GERMANY | 2022 | Unknown | Sports photography company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1868 |
| GERMANY | 2022 | Unknown | Restaurant operator | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1867 |
| GERMANY | 2022 | Unknown | Private individual | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1866 |
| SPAIN | 2023-05-31 | 500 | Website operator | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1865 |
| SPAIN | 2023-06-05 | 10,000 | ALPA 57 PRODUCCIONES | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1864 |
| SPAIN | 2023-06-07 | 20,000 | RCI BANQUE, S.A. SUCURSAL EN ESPAÑA | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1863 |
| SPAIN | 2023-06-01 | 42,000 | PELAYO, MUTUA DE SEGUROS Y REASEGUROS A PRIMA FIJA | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1862 |
| SPAIN | 2023-06-02 | 20,000 | QUALITY-PROVIDER S.A. | Art. 6 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1861 |
| SPAIN | 2023-06-06 | 56,000 | VODAFONE ONO, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1860 |
| CROATIA | 2023-05-18 | 380,000 | Sports betting operator | Art. 6 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1) a), d) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1859 |
| SPAIN | 2023-06-02 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1858 |
| ROMANIA | 2023-06-06 | 3,000 | S.C. Apollo Salon S.R.L. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1857 |
| GERMANY | 2023-05-31 | 300,000 | Deutsche Kreditbank | Art. 5 (1) a) GDPR, Art. 15 (1) h) GDPR, Art. 22 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1856 |
| SPAIN | 2023-05-17 | 900 | WILLOUGHBY COLLEGE, S.A | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1855 |
| SPAIN | 2023-05-24 | 3,000 | NORDETIA CLINICS IBERIA, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1854 |
| SPAIN | 2023-05-24 | 10,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1853 |
| SPAIN | 2023-05-25 | 480 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1852 |
| SPAIN | 2023-05-25 | 600 | Private individual | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1851 |
| ROMANIA | 2023-05-23 | 1,000 | Global Baby Brand SRL | Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1850 |
| ROMANIA | 2023-05-18 | 18,000 | AUTOMOBILE BAVARIA SRL | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR, Art. 25 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1849 |
| ROMANIA | 2023-05-16 | 5,000 | Compania Națională Poșta Română S.A. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1848 |
| ROMANIA | 2023-05-12 | 1,000 | NN Asigurări de Viață S.A. | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1847 |
| ROMANIA | 2023-05-12 | 1,500 | NN Pensii Societate de Administrare a unui Fond de Pensii Administrat Privat S.A. | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1846 |
| ROMANIA | 2023-05-11 | 11,000 | Libra Internet Bank SA | Art. 12 (2), (4) GDPR, Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1845 |
| IRELAND | 2023-05-12 | 1,200,000,000 | Meta Platforms Ireland Limited | Art. 46 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1844 |
| MALTA | 2020 | 4,000 | Unknown | Art. 13 GDPR, Art. 15 GDPR, Regulation 9 S.L 586.01 | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1843 |
| MALTA | 2020 | 20,000 | Unknown | Art. 13 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1842 |
| MALTA | 2020 | 2,500 | Unknown | Art. 5 (1) f) GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1841 |
| MALTA | 2020 | 2,000 | Unknown | Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1840 |
| FRANCE | 2023-05-10 | 5,200,000 | Clearview AI | Unknown | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1839 |
| MALTA | 2020 | 2,500 | Unknown | Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1838 |
| MALTA | 2020 | 2,500 | Unknown | Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1837 |
| MALTA | 2020 | 5,000 | Unknown | Art. 5 (1) f) GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1836 |
| MALTA | 2022 | 250,000 | Unknown | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1835 |
| MALTA | 2022 | 2,500 | Unknown | Art. 24 (2) GDPR, Art. 32 (1) (b) GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1834 |
| BULGARIA | 2022 | 5,000 | Trucking company | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1833 |
| BULGARIA | 2022-05-04 | 500,000 | Bulgarian Post EAD | Art. 32 (1) b), c), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1832 |
| BULGARIA | 2022 | 12,800 | Political party | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1831 |
| ITALY | 2023-03-02 | 1,000 | Razmataz Live s.r.l.. | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1830 |
| ITALY | 2023-03-23 | 10,000 | Informatica Alto Adige Spa | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1829 |
| ITALY | 2023-03-23 | 30,000 | Bolzano municipality | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1828 |
| SPAIN | 2023-05-09 | 5,000 | ESTUDIO INMOBILIARIO SAN ISIDRO, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1827 |
| SPAIN | 2023-05-09 | 180 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1826 |
| HUNGARY | 2022 | 2,700 | Credit institution | Art. 6 (1) GDPR, Art. 5 (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1825 |
| HUNGARY | 2023-02-06 | 80,500 | I&S Limited Kft | Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR, Art. 13 (1), (2) GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1824 |
| HUNGARY | 2022 | 1,400 | Dentist | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1823 |
| HUNGARY | 2022-04-22 | 8,000 | Political party | Art. 5 (2) GDPR, Art. 32 (1) a), b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1822 |
| ITALY | 2023-03-09 | 2,000 | Consorzio Concessioni Reti Gas S.c.a.r.l. | Art. 5 (1) a),c) GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1821 |
| SPAIN | 2023-04-28 | 2,000 | ASSOCIACIO DE CAÇADORS D'ALZIRA | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1820 |
| CYPRUS | 2023-05-02 | 9,000 | NAGA Markets Europe Ltd | Art. 5 (1) f) GDPR, Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1819 |
| CYPRUS | 2023-02-03 | 3,250 | Epic Ltd. | Art. 6 (1) GDPR, Art. 24 (1), (2) GDPR, Art. 32 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1818 |
| CYPRUS | 2023-01-16 | 7,000 | Πολίτης newspaper | Art. 5 (1) c) GDPR, Art. 6 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1817 |
| CROATIA | 2023-05-04 | 2,265,000 | Debt collection agency | Art. 6 (1) GDPR, Art. 13 (1) GDPR, Art. 28 (3) GDPR, Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1816 |
| HUNGARY | 2022-09-12 | 80,700 | Coin dealer | Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 7 (2) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1815 |
| HUNGARY | 2022 | 1,300 | Website operator | Art. 5 (1) a) GDPR, Art. 12 (2), (3) GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1814 |
| HUNGARY | 2022 | 1,600 | Physician | Art. 5 (1) a) GDPR, Art. 12 (2) GDPR, Art. 13 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1813 |
| HUNGARY | 2022 | 80,700 | Beauty salon | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1812 |
| HUNGARY | 2022-12-21 | 8,000 | Hotel | Art. 5 (1) e) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 31 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1811 |
| SPAIN | 2023-05-05 | 2,000 | Homeowners' association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1810 |
| SPAIN | 2023-05-05 | 1,200 | FUNDACIÓ PRIVADA UNIVERSITARIA EADA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1809 |
| POLAND | 2023-02-08 | 7,200 | Company | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1808 |
| ITALY | 2023-03-02 | 5,000 | Private individual | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 130 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1807 |
| SPAIN | 2023-05-03 | 200,000 | GSMA LTD. | Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1806 |
| ITALY | 2023-03-09 | 3,000 | Aesse S.r.l.s. | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 130 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1805 |
| HUNGARY | 2023-04-12 | 253,000 | Aldi | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1804 |
| SPAIN | 2023-05-03 | 5,000 | BANQUETES SANTA ANA, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1803 |
| SPAIN | 2023-02-22 | 30,000 | DISPLAY CONNECTORS, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1802 |
| SPAIN | 2022-11-03 | 75,000 | Burwebs S.L. | Art. 5 (1) a), b), e) GDPR, Art. 12 (2) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 30 (1) GDPR, Art. 22 (2) LSSI | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1801 |
| ITALY | 2023-02-23 | 300,000 | Ediscom S.p.a. | Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 14 GDPR, Art. 25 GDPR, Art. 130 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1800 |
| SPAIN | 2023-04-28 | 5,000 | INFINITY ECOM S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1799 |
| SPAIN | 2023-04-28 | 12,000 | ALBERO FORTE COMPOSITE, S.L. | Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1798 |
| GERMANY | 2022 | Fine in five-digit amount | Aid organization | Art. 28 (3) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1797 |
| GERMANY | 2022 | Fine in five-digit amount | Operator of a swimming pool | Art. 6 (1) c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1796 |
| GERMANY | 2022 | Fine in five-digit amount | Restaurant operator | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1795 |
| GERMANY | 2022 | Fine in five-digit amount | Bank | Art. 28 (3) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1794 |
| SPAIN | 2023-04-25 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1793 |
| SPAIN | 2023-04-26 | 1,000 | Website operator | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1792 |
| SPAIN | 2023-04-24 | 70,000 | Telefónica Móviles España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1791 |
| SPAIN | 2023-04-25 | 70,000 | DIGI SPAIN TELECOM, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1790 |
| SPAIN | 2023-04-21 | 25,000 | SECURITAS DIREC ESPAÑA, S.A. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1789 |
| AUSTRIA | 2022-08-23 | 25,000 | Operator of a public toilet | Art. 5 (1) a), b), c) GDPR, Art. 6 (1) f) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1788 |
| SWEDEN | 2023-04-26 | 17,600 | Skåne region | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1787 |
| ITALY | 2023-03-02 | 50,000 | Azienda sanitaria locale di Bari | Art. 5 (1) a), c), f) GDPR, Art. 9 GDPR, Art. 25 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1786 |
| SPAIN | 2023-04-20 | 25,000 | KFC RESTAURANTS SPAIN, S.L. | Art. 13 GDPR, Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-1785 |
| ROMANIA | 2023-04-24 | 1,000 | Tensa Art Design SA | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1784 |
| GERMANY | 2022 | 800 | Police officer | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1783 |
| GERMANY | 2022 | 300 | Police officer | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1782 |
| GERMANY | 2022 | 7,380 | Police officer | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1781 |
| GERMANY | 2022 | 1,800 | Covid-19 test center | Art. 5 (1) a), f) GDPR, Art. 6 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1780 |
| GERMANY | 2022 | 16,400 | Covid-19 test center | Art. 6 (1) GDPR, Art. 33 (1), (5) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1779 |
| ITALY | 2023-03-09 | 10,000 | Banca Cambiano 1884 S.p.A. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1778 |
| ROMANIA | 2023-04-19 | 3,000 | Partidul Uniunea Salvați România | Art. 5 (1) a), b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1777 |
| THE NETHERLANDS | 2023-01-19 | 150,000 | Dutch Social Insurance Institution (SVB) | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1776 |
| SPAIN | 2023-03-10 | 40,000 | VODAFONE ONO, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1775 |
| SPAIN | 2023-02-28 | 800 | GUUDJOB WORLDWIDE S.L. | Art. 12 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1774 |
| SPAIN | 2023-04-13 | 112,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1773 |
| SPAIN | 2023-04-13 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1772 |
| GREECE | 2022-12-19 | 7,000 | ΜΑΡΙΑ ΠΕΔΙΩΤΗ ΚΑΙ ΣΙΑ Ο.Ε. | Art. 12 GDPR, Art. 15 GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1771 |
| ITALY | 2023-03-09 | 1,600 | Deca s.r.l. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1770 |
| HUNGARY | 2023-04-04 | 13,300 | Company | Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1769 |
| SPAIN | 2023-03-16 | 100,000 | ORANGE ESPAGNE S.A.U. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1768 |
| GREECE | 2023-02-20 | 40,000 | Vodafone | Art. 15 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1767 |
| GREECE | 2023-02-02 | 30,000 | Piraeus Bank | Art. 5 (1) a), f) GDPR, Art. 33 GDPR, Art. 34 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1766 |
| GREECE | 2023-02-02 | 10,000 | Vodafone | Art. 5 (1) a), b) GDPR, Art. 6 (1), (4) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1765 |
| SPAIN | 2023-04-04 | 10,000 | Real Federación Española de Tenis de Mesa | Art. 9 (2) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1764 |
| ITALY | 2022-12-01 | 2,000 | Store owner | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1763 |
| ITALY | 2022-12-15 | 120,000 | Eurosanità S.P.A. | Art. 5 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1762 |
| ITALY | 2023-01-26 | 5,000 | Misterbianco municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1761 |
| CZECH REPUBLIC | 2022 | 3,400 | Company | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1760 |
| POLAND | 2023-03-01 | 11,100 | Housing cooperative | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1759 |
| SPAIN | 2023-02-28 | 3,000 | CITIZENGO FOUNDATION | Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1758 |
| SPAIN | 2023-02-28 | 600 | ECOMM MOVADGENCY S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1757 |
| SPAIN | 2023-02-28 | 1,800 | WUNSCHURLAUB S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1756 |
| ITALY | 2023-01-11 | 5,000 | Azienda Ospedale-Università Padova | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1755 |
| ITALY | 2023-01-26 | 7,000 | Azienda Ospedaliera Bianchi Melacrino Morelli | Art. 5 GDPR, Art 9 GDPR, Art. 32 GDPR, Art. 75 Codice della privacy | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1754 |
| HUNGARY | 2022-09-26 | 26,700 | TV2 Média Csoport Zrt. | Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1753 |
| SPAIN | 2023-03-17 | 10,000 | NGENIERÍA Y TELECOM JAÉN, S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1752 |
| SPAIN | 2023-04-04 | 84,000 | BANCO BILBAO VIZCAYA ARGENTARIA, S.A. | Art. 6 (1) GDPR, Art. 15 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1751 |
| GERMANY | 2022 | 1,400 | Covid-19 test center | Art. 6 (1) c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1750 |
| ROMANIA | 2023-04-07 | 3,000 | REGENCY COMPANY SRL | Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1749 |
| SPAIN | 2023-03-24 | 360 | ALI MARKET | Art. 13 GDPR, Art. 30 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1748 |
| LUXEMBOURG | 2021-10-27 | 18,700 | Company | Art. 37 (7) GDPR, Art. 38 (1), (3) GDPR, Art. 39 (1) b) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-1747 |
| SPAIN | 2023-03-23 | 180 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1746 |
| GERMANY | 2022 | 2,700 | Covid-19 test center | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1745 |
| GERMANY | 2022 | 1,000 | Covid-19 test center | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1744 |
| GERMANY | 2022 | 1,000 | Physician | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1743 |
| GERMANY | 2022 | Unknown | Logistics company | Art. 32 (1) GDPR, Art. 33 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1742 |
| GERMANY | 2022 | Fine in three-digit amount | Private individual | Art. 5 GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1741 |
| ITALY | 2023-03-23 | 4,000 | Azienda socio-sanitaria locale n. 1 di Sassari | Art. 5 GDPR, Art. 9 GPDR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1740 |
| ITALY | 2023-03-09 | 3,000 | Store owner | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1739 |
| SPAIN | 2023-03-24 | 1,000 | INMARAN ASESORES S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1738 |
| SPAIN | 2023-04-03 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1737 |
| SPAIN | 2023-04-03 | 50,000 | 20 MINUTOS EDITORA, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1736 |
| SPAIN | 2023-04-05 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1735 |
| SPAIN | 2023-04-04 | 18,000 | ENFOKA SISTEMAS GLOBALES, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1734 |
| SPAIN | 2023-04-03 | 50,000 | ATRESMEDIA CORPORACIÓN DE MEDIOS DE COMUNICACIÓN, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1733 |
| POLAND | 2023-02-07 | 321 | Housing association | Art. 5 (1) a) GDPR, Art. 28 (1), (3), (9) GDPR, Art. 33 (1) GDPR, Art. 34 (1), (2) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1732 |
| ROMANIA | 2023-04-04 | 3,000 | Tensa Art Design SRL | Art. 21 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1731 |
| UNITED KINGDOM | 2023-04-04 | 14,500,000 | TikTok | Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1730 |
| GERMANY | 2022 | Unknown | Supermarket | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1729 |
| GERMANY | 2022 | Unknown | Medical care center | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1728 |
| GERMANY | 2022 | Fine in three-digit amount | Company | Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1727 |
| GERMANY | 2022 | Unknown | Company | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1726 |
| GERMANY | 2022 | Fine in five-digit amount | Company | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1725 |
| GERMANY | 2022 | Fine in five-digit amount | Company | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1724 |
| GERMANY | 2022 | Fine in five-digit amount | Company | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1723 |
| GERMANY | 2022 | Unknown | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1722 |
| GERMANY | 2022 | Unknown | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1721 |
| GERMANY | 2022 | Unknown | Physician | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1720 |
| GERMANY | 2022 | Unknown | Physician | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1719 |
| GERMANY | 2022 | Unknown | Company | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1718 |
| GERMANY | 2022 | Unknown | Physician | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1717 |
| SPAIN | 2023-03-21 | 50,000 | UNIDAD EDITORIAL INFORMACION GENERAL S.L.U. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1716 |
| SPAIN | 2023-03-21 | 40,000 | TITANIA COMPAÑÍA EDITORIAL, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1715 |
| SPAIN | 2023-03-21 | 40,000 | EDITORIAL DE PRENSA CANARIA, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1714 |
| SPAIN | 2023-03-21 | 50,000 | EL DIARIO DE PRENSA DIGITAL SL. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1713 |
| SPAIN | 2023-03-21 | 50,000 | DISPLAY CONNECTORS, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1712 |
| SPAIN | 2023-03-21 | 50,000 | CONECTA5 TELECINCO, S.A.U. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1711 |
| SPAIN | 2023-03-21 | 50,000 | DIARIO ABC, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1710 |
| SPAIN | 2023-03-21 | 50,000 | LA VANGUARDIA EDICIONES, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1709 |
| SPAIN | 2023-03-21 | 50,000 | SOCIEDAD ESPAÑOLA DE RADIODIFUSIÓN, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1708 |
| LUXEMBOURG | 2022-12-13 | 1,400 | Company | Art. 12 (1) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1707 |
| LUXEMBOURG | 2022-12-13 | 700 | Company | Art. 12 (1) GDPR, Art. 13 (1) f) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1706 |
| LUXEMBOURG | 2022-12-13 | 2,100 | Company | Art. 12 (1) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1705 |
| LUXEMBOURG | 2022-12-13 | 2,500 | Company | Art. 12 (1) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1704 |
| LUXEMBOURG | 2022-12-13 | 1,000 | Company | Art. 12 (1) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1703 |
| SPAIN | 2023-03-21 | 70,000 | CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1702 |
| SPAIN | 2023-03-23 | 70,000 | Orange Espagne S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1701 |
| ROMANIA | 2023-03-27 | 450 | Private individual | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1700 |
| ROMANIA | 2023-03-23 | 5,000 | Tehnoplus Industry SRL | Art. 5 (1) a), c), e) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1699 |
| FRANCE | 2023-03-16 | 125,000 | CITYSCOOT | Art. 5 (1) c) GDPR, Art. 28 (3) GDPR, Art. 82 Loi informatique et libertés | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1698 |
| NORWAY | 2023-03-08 | 220,000 | Argon Medical Devices | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1697 |
| IRELAND | 2023-02-27 | 750,000 | Bank of Ireland 365 | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1696 |
| SPAIN | 2023-03-15 | 136,000 | Vodafone España, S.A.U. | Art. 6 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1695 |
| ITALY | 2023-01-11 | 6,000 | Ufficio Scolastico Regionale per la Lombardia, Ufficio IV - Ambito Territoriale di Brescia | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1694 |
| ITALY | 2023-01-26 | 5,000 | Azienda ULSS n.5 Polesana | Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GPDR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1693 |
| SPAIN | 2023-03-14 | 240 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1692 |
| SPAIN | 2023-02-27 | 4,000 | Attorney | Art. 5 (1) f) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1691 |
| SPAIN | 2023-03-15 | 480 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1690 |
| SPAIN | 2023-03-16 | 5,000 | Private individual | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1689 |
| POLAND | 2023-01-19 | 6,400 | Szczecin-Centrum District Court | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1688 |
| ROMANIA | 2023-03-16 | 3,000 | Med Life S.A. | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1687 |
| ROMANIA | 2023-03-16 | 1,000 | Centrul Medical dr. Furtună Dan | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1686 |
| ROMANIA | 2023-03-14 | 3,000 | Tinmar Energy SA | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1685 |
| ROMANIA | 2023-03-15 | 4,000 | Partidul Uniunea Salvați România | Art. 32 (1) a) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1684 |
| ROMANIA | 2023-03-15 | 10,000 | Alianța pentru Unirea Românilor | Art. 5 (1) c) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1683 |
| ROMANIA | 2023-03-13 | 2,000 | Modaone SRL | Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1682 |
| ROMANIA | 2023-03-06 | 3,000 | Integral Collection SRL | Art. 32 (1) b), c) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1681 |
| ROMANIA | 2023-03-06 | 2,250 | Finopro IFN SA | Art. 32 (1) b), c) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1680 |
| CROATIA | Unknown | 20,000 | Telecommunications company | Art. 6 (1) GDPR, Art. 5 (1) d) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1679 |
| FINLAND | 2023-02-17 | 440,000 | Suomen Asiakastieto Oy | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1678 |
| IRELAND | 2022-12-30 | 15,000 | A&G Couriers Limited T/A Fastway Couriers (Ireland) | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1677 |
| SPAIN | 2023-02-28 | 800 | EUROPYMES SERVICIOS INTEGRALES S.L. | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1676 |
| SPAIN | 2023-02-28 | 15,000 | GRUPO NORCONSULTING, S.L. | Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1675 |
| SPAIN | 2023-02-21 | 300 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1674 |
| SPAIN | 2023-02-21 | 10,000 | HERON CITY VALENCIA MANAGEMENT S.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1673 |
| SPAIN | 2023-02-21 | 1,500 | Private individual | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1672 |
| ITALY | 2022-12-15 | 4,900,000 | Edison Energia S.p.A. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1), (2), (3) GDPR, Art. 21 (2) GDPR, Art. 24 (1), (2) GDPR, Art. 25 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1671 |
| ITALY | 2022-12-15 | 30,000 | Verizon Connect Italy S.p.A. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1670 |
| ITALY | 2022-10-06 | 100,000 | Veneto region | Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1669 |
| ITALY | 2022-04-28 | 150,000 | Tarento municipality | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 28 GDPR, Art. 35 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1668 |
| ITALY | 2022-04-28 | 200,000 | Amiu S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 37 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1667 |
| IRELAND | 2023-01-23 | 460,000 | Centric Health Ltd. | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1666 |
| SPAIN | 2023-02-21 | 300 | PLANET COSTA DORADA SOCIEDAD LIMITADA | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1665 |
| SPAIN | 2023-02-21 | 1,200 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1664 |
| SPAIN | 2023-02-21 | 180 | SUPER 24H LOS ROSALES, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1663 |
| SPAIN | 2023-02-21 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1662 |
| SPAIN | 2023-02-21 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1661 |
| SPAIN | 2023-02-21 | 300 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1660 |
| SPAIN | 2023-02-21 | 300 | COMANDANCIA DE LLEIDA | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1659 |
| SPAIN | 2023-02-21 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1658 |
| LUXEMBOURG | 2022-07-22 | 10,000 | Company | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1657 |
| NORWAY | 2023-02-06 | 900,000 | Sats ASA | Art. 5 (1) a), e) GDPR, Art. 6 (1) GDPR, Art. 12 (1), (3) GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1656 |
| BELGIUM | 2022-08-23 | 2,500 | Company | Art. 5 (1) d) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1655 |
| ITALY | 2022-11-24 | 4,000 | Società Lombarda Sport s.r.l. | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1654 |
| ITALY | 2022-10-20 | 1,400,000 | Douglas Italia S.p.a. | Art. 5 (1) b), e) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 (2) a) GDPR, Art. 24 GDPR, Art. 25 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1653 |
| GERMANY | 2022 | Unknown | Debt collection company | Art. 6 (1) GDPR, Art. 14 (1), (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1652 |
| GERMANY | 2022 | 500 | Restaurant | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1651 |
| GERMANY | 2022 | 20,000 | Company | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1650 |
| GERMANY | 2022 | 6,500 | Pharmacy | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1649 |
| ITALY | 2022-04-07 | 10,000 | Tecnomed Trento s.r.l. | Art. 5 (1) a), c) GDPR, Art. 13 GDPR, Art. 29 GDPR, Art. 32 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1648 |
| LUXEMBOURG | 2022-12-13 | 1,500 | Manager of a real estate co-ownership | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 (3), (4) GDPR, Art. 15 (1) b), c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1647 |
| ITALY | 2022-08-05 | 1,000 | Mister Brick S.a.s. | Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 24 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1646 |
| HUNGARY | 2022-11-15 | 5,200 | News service | Art. 6 (1) GDPR, Art. 7 (2), 4) GDPR, Art. 12 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1645 |
| ITALY | 2022-04-07 | 15,000 | Rebirth s.r.l. | Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 114 Codice della privacy, Art. 157 Codice della privacy | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1644 |
| ITALY | 2022-04-28 | 1,500 | Direzione Didattica Statale 1° Circolo-Eboli | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1643 |
| ROMANIA | 2023-02-08 | 5,000 | Medijobs Platform SRL | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1642 |
| ITALY | 2022-04-28 | 3,000 | Comune di Monte Sant'Angelo | Art. 5 (1) a) GDPR, Art. 6 (1) e) GDPR, Art. 17 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1641 |
| ITALY | 2022-11-24 | 3,000 | Ordine dei Medici Chirurghi e degli Odontoiatri della Provincia di Cagliari | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1640 |
| ITALY | 2022-10-20 | 12,000 | Comune di Salento | Art. 5 (1) a), b), e) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 30 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1639 |
| ITALY | 2022-05-26 | 2,000 | Store owner | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1638 |
| ITALY | 2022-11-24 | 1,000 | Private individual | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1637 |
| ITALY | 2022-12-15 | 6,000 | Comune di Bracciano | Art.5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1636 |
| ITALY | 2022-12-15 | 8,000 | Comune di Vicchio | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 (2), (4) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1635 |
| ITALY | 2022-12-15 | 5,000 | Comune di Borgia | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 (2), (4) GDPR, Art. 37 (7) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1634 |
| ITALY | 2023-01-11 | 2,500 | Azienda Sanitaria Locale di Brindisi | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1633 |
| POLAND | 2022-11-30 | 9,600 | PIONIER (law firm) | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1632 |
| ITALY | 2022-11-10 | 15,000 | Poliambulatorio Radiologico 'il Sorriso' S.r.l. | Art. 5 GDPR, Art. 13 GDPR, Art. 37 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1631 |
| ITALY | 2022-10-20 | 10,000 | Italian Archery Federation (FITARCO) | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-octies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1630 |
| ITALY | 2022-10-20 | 900 | Istituto di Istruzione Superiore G. Renda di Polistena, Reggio Calabria | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1629 |
| SPAIN | 2023-02-03 | 600 | HOTEL VILLA SORO, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1628 |
| SPAIN | 2023-02-03 | 500 | MIRACLE IBIZA S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1627 |
| ITALY | 2022-12-15 | 3,000 | Scuola Statale Secondaria di I^ grado 'Bianco-Pascol' | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1626 |
| CYPRUS | 2022 | 7,500 | DW Dynamic Works LIMITED | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1625 |
| CYPRUS | 2022 | 5,000 | Cypriot Ministry of Defense | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1624 |
| CYPRUS | 2022 | 5,000 | Cyprus Electricity Authority | Art. 5 (1) f) GDPR, Art. 24 (1) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1623 |
| CYPRUS | 2022 | 17,000 | Bank of Cyprus Public Company Ltd. | Art. 5 (1) f) GDPR, Art. 24 (1) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1622 |
| CYPRUS | 2022 | 3,750 | PRINTAFORM Ltd. | Art. 28 (3) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1621 |
| CYPRUS | 2022 | 3,500 | Universal Life Insurance Public Co Ltd. | Art. 24 (1) GDPR, Art. 28 (1) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-1620 |
| CYPRUS | 2022 | 5,000 | DW Dynamic Works LIMITED | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1619 |
| CYPRUS | 2022 | 6,000 | Hermes Airport Ltd. | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1618 |
| GERMANY | 2023 | 9,000 | Magdeburg University Hospital | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1617 |
| ITALY | 2022-11-10 | 6,000 | Conservatorio di Musica S. Cecilia di Roma | Art. 5 GDPR, Art. 6 GDPR, Art. 38 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1616 |
| ITALY | 2022-11-10 | 5,000 | Cisterna di Latina municipality | Art. 5 GDPR, Art. 12 GDPR, Art. 37 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1615 |
| ITALY | 2022-10-20 | 9,000 | Azienda Ospedaliero-Universitaria Careggi di Firenze | Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GPDR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1614 |
| ITALY | 2022-10-20 | 5,000 | Fondazione Teatro Regio di Torino | Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1613 |
| ITALY | 2022-10-06 | 10,000 | Poste Italiane S.p.a. | Art. 12 (3), (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1612 |
| ITALY | 2022-10-06 | 3,000 | Associazione Rescue Drones Network ODV | Art. 12 GDPR, Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1611 |
| ITALY | 2022-11-24 | 1,000 | STS Di Prisinzano s.r.l | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1610 |
| SPAIN | 2023-01-02 | 24,000 | FACTOR ENERGÍA, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1609 |
| ITALY | 2022-12-15 | 55,000 | Azienda Universitaria Giuliano Isontina | Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 35 GDPR, Art. 2-sexies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1608 |
| ITALY | 2022-12-15 | 55,000 | Azienda Universitaria Friuli Centrale | Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 35 GDPR, Art. 2-sexies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1607 |
| ITALY | 2022-12-15 | 55,000 | Azienda Universitaria Friuli Occidentale | Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 35 GDPR, Art. 2-sexies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1606 |
| ROMANIA | 2023-02-01 | 1,000 | Tensa Art Design SA | Art. 21 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1605 |
| SPAIN | 2023-01-31 | 600 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1604 |
| SPAIN | 2023-01-31 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1603 |
| SPAIN | 2023-01-31 | 180 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1602 |
| ROMANIA | 2023-01-31 | 1,000 | Dentist | Art. 6 (1) a) GDPR, Art. 9 (2) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1601 |
| ROMANIA | 2023-01-31 | 1,000 | Dent Estet Clinic SA | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1600 |
| ITALY | 2021-09-21 | 2,000 | Istituto Comprensivo - IC Cosenza III “V. Negroni” | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1599 |
| SPAIN | 2023-01-25 | 3,000 | CASAL DE L'ESPLUGA DE FRANCOLÍ | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1598 |
| SPAIN | 2023-01-25 | 180 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1597 |
| SPAIN | 2023-01-27 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1596 |
| CROATIA | 2022-12-08 | 2,654 | Retailer | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1595 |
| CROATIA | 2022-12-08 | 2,654 | Jewelry manufacturer | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1594 |
| CROATIA | 2022-12-07 | 1,991 | Fish market | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1593 |
| CROATIA | 2022-12-07 | 2,654 | Retailer | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1592 |
| CROATIA | 2022-12-06 | 1,991 | Retailer | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1591 |
| CROATIA | 2022-12-06 | 3,185 | Retailer | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1590 |
| CROATIA | 2022-12-05 | 3,583 | Retailer | Art. 27 (1) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1589 |
| CROATIA | 2022-12-05 | 1,991 | Betting place | Art. 27 (1), (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1588 |
| CROATIA | 2022-11-25 | 1,991 | Betting place | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1587 |
| CROATIA | 2022-11-25 | 1,991 | Company in the hospitality industry | Art. 27 (2) Croatian Act on the Implementation of the GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1586 |
| SPAIN | 2022-12-28 | 2,000 | Homeowners Association | Art. 6 (1) GDPR, Art. 15 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1585 |
| SPAIN | 2022-12-28 | 100,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1584 |
| FINLAND | 2022-12-27 | 122,000 | Company | Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1583 |
| SPAIN | 2023-01-18 | 2,000 | Private investigator | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1582 |
| SPAIN | 2023-01-20 | 360 | TECNO MOTOR LA MUELA, S.L.L | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1581 |
| SPAIN | 2023-01-20 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1580 |
| SWEDEN | 2023-01-17 | 17,900 | Dalarna Region | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1579 |
| IRELAND | 2023-01-19 | 5,500,000 | WhatsApp Ireland Ltd. | Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1578 |
| ROMANIA | 2023-01-18 | 1,000 | Dante Internațional SA | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1577 |
| SPAIN | 2023-01-16 | 40,000 | Thomas International Systems, S.A. | Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1576 |
| ITALY | 2022-12-01 | 20,000 | Amazon Italia Logistica s.r.l. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1575 |
| ITALY | 2022-12-01 | 6,000 | A.R.N.A.S. Civico | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1574 |
| ITALY | 2022-12-01 | 3,000 | Store owner (Woolen) | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1573 |
| SPAIN | 2023-01-16 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1572 |
| SPAIN | 2023-01-16 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1571 |
| POLAND | Unknown | 960 | Unknown | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1570 |
| POLAND | 2022-08-30 | 6,800 | TIMSHEL Sp. z o.o. | Art. 58 (1) e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1569 |
| POLAND | 2022-03-23 | 490 | Unknown | Art. 31 GDPR, Art. 58 (1) e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1568 |
| POLAND | 2022-08-31 | 1,450 | Unknown | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1567 |
| GREECE | 2023-01-13 | 50,000 | Intellexa SA | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1566 |
| FINLAND | 2022-12-13 | 750,000 | Alektum Oy | Art. 12 (3) GDPR, Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1565 |
| IRELAND | 2022-12-22 | 100,000 | VIEC Limited | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1564 |
| LITHUANIA | 2023-01-09 | 6,000 | Praktiškas UAB | Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 30 (1), (3) GDPR, Art. 35 (1), (3) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1563 |
| ITALY | 2022-12-01 | 6,000 | Store owner (Joy Unique Collection) | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1562 |
| SPAIN | 2022-12-29 | 24,000 | SUMINISTRADOR IBÉRICO DE ENERGÍA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1561 |
| SPAIN | 2022-12-28 | 300 | Store owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1560 |
| SPAIN | 2022-12-28 | 600 | Homeowners Association | Art. 6 (1) e) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1559 |
| SPAIN | 2023-01-09 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1558 |
| SPAIN | 2023-01-10 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1557 |
| SPAIN | 2023-01-10 | 120 | Homeowners Association | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1556 |
| SPAIN | 2023-01-12 | 3,000 | SERVICIOS INTEGRALES DEL HOGAR TENERIFE, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1555 |
| SPAIN | 2023-01-13 | 1,000 | EDITORIAL RIBADEO S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1554 |
| ITALY | 2022-11-10 | 10,000 | I-Model s.r.l. | Art. 6 (1) GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1553 |
| ROMANIA | 2023-01-12 | 2,000 | BRISTOL LOGISTICS SA | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1552 |
| SPAIN | 2022-12-29 | 3,000 | ADENET SYSTEMS, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1551 |
| SPAIN | 2022-12-28 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1550 |
| SPAIN | 2023-01-03 | 3,000 | Transport Workers' Union of Aragon | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1549 |
| SPAIN | 2022-12-28 | 400 | MAE WEST SYSTEMS, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1548 |
| SPAIN | 2022-12-28 | 300 | Homeowners Association | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1547 |
| ROMANIA | 2023-01-04 | 3,000 | Apă Canal Ilfov SA | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1546 |
| ROMANIA | 2023-01-03 | 500 | Homeowners Association | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1545 |
| ITALY | 2022-11-10 | 5,000 | Cisterna di Latina Municipality | Art. 5 GDPR, Art. 12 GDPR, Art. 37 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1544 |
| IRELAND | 2023-01-04 | 390,000,000 | Meta Platforms Ireland Limited | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1543 |
| ITALY | 2022-11-10 | 20,000 | Sportitalia | Art. 5 (1) a) GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 30 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1542 |
| ITALY | 2022-11-24 | 1,000,000 | Areti spa | Art. 5 (1) d), e) GDPR, Art. 5 (2) GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 24 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1541 |
| ROMANIA | 2022-12-27 | 3,000 | Kaufland Romania SCS | Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1540 |
| ROMANIA | 2022-12-22 | 10,000 | SUDREZIDENȚIAL Broker S.R.L. | Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1539 |
| ITALY | 2022-11-10 | 4,000 | Villafranca di Verona municipality | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1538 |
| ITALY | 2022-12-01 | 100,000 | Lazio Region | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 113 Codice della privacy, Art. 114 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1537 |
| SPAIN | 2022-12-20 | 3,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1536 |
| SPAIN | 2022-12-20 | 2,000 | Property owner administrative board | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1535 |
| SPAIN | 2022-12-20 | 1,000 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1534 |
| SPAIN | 2022-12-15 | 30,000 | ORANGE ESPAGNE, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1533 |
| SPAIN | 2022-12-15 | 16,000 | HOSPITAL RECOLETAS PONFERRADA, S.L. | Art. 6 (1) GDPR, Art. 15 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1532 |
| ROMANIA | 2022-12-15 | 5,000 | Societatea Energetică Electrica S.A. | Art. 28 (3) a) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-1531 |
| SPAIN | 2022-12-13 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1530 |
| SPAIN | 2022-12-13 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1529 |
| ITALY | 2022-10-20 | 7,000 | I.S.P.R.O. | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1528 |
| FRANCE | 2022-12-08 | 300,000 | FREE SAS | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1527 |
| FINLAND | 2022-12-09 | 230,000 | Viking Line Oy Abp | Art. 5 (1) a), d) GDPR, Art. 12 (3) GDPR, Art. 13 GDPR, Art. 15 (1) GDPR, Art. 25 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1526 |
| SPAIN | 2022-12-13 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1525 |
| PORTUGAL | 2022-11-02 | 4,300,000 | Portuguese National Statistical Institute | Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 28 (1), (6), (7) GDPR, Art. 35 (1), (2), (3) b) GDPR, Art. 44 GDPR, Art. 46 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1524 |
| SPAIN | 2022-12-09 | 120 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1523 |
| SPAIN | 2022-12-09 | 8,000 | Notary | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1522 |
| SPAIN | 2022-12-09 | 480 | Private individual | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1521 |
| ROMANIA | 2022-12-09 | 2,000 | Casa Rusu S.R.L. | Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1520 |
| IRELAND | 2022-01-26 | 5,000 | Slane Credit Union Ltd. | Art. 5 (1) f) GDPR, Art. 24 GDPR, Art. 28 (1), (3) GDPR, Art. 30 (1) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1519 |
| SPAIN | 2022-11-25 | 5,000 | Association for the prevention and study of crimes, abuses and negligence in information technology and advanced communications (APEDANICA) | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1518 |
| SPAIN | 2022-11-25 | 1,800 | ALPA 57 PRODUCCIONES, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1517 |
| SPAIN | 2022-12-02 | 3,600 | Federation of Sports for People with Intellectual Disabilities of Castilla la Mancha-FECAM | Art. 9 (2) a) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1516 |
| SPAIN | 2022-12-02 | 3,500 | CASA 7 PERSONAL SHOPPER, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1515 |
| ITALY | 2022-11-10 | 40,000 | Azienda Usl Valle d'Aosta | Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1514 |
| ITALY | 2022-09-15 | 40,000 | FCA Italy S.p.A. | Art. 12 (1), (2), (3), (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1513 |
| ITALY | 2022-10-06 | 10,000 | Codess Sociale, Soc. Coop. sociale. | Art. 12 (3), (4) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1512 |
| ITALY | 2022-10-06 | 2,000,000 | Alpha Exploration | Art. 5 (1) a), e), f) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 27 (4) GDPR, Art. 28 GDPR, Art. 32 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1511 |
| SPAIN | 2022-12-03 | 300 | Homeowners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1510 |
| SPAIN | 2022-12-03 | 600 | LORENT 2013, S.L | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1509 |
| SPAIN | 2022-12-03 | 3,000 | INDECEMI, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1508 |
| SPAIN | 2022-11-29 | 3,000 | Company | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1507 |
| FRANCE | 2022-11-24 | 600,000 | ÉLECTRICITÉ DE FRANCE | Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. L. 34-5 CPCE | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1506 |
| ITALY | 2022-11-10 | 500,000 | Vodafone Italia S.p.A. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 130 (1), (2), (3) Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1505 |
| SPAIN | 2022-11-29 | 500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1504 |
| ROMANIA | 2022-11-25 | 3,000 | OTP LEASING ROMANIA IFN SA | Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1503 |
| IRELAND | 2022-11-25 | 265,000,000 | Meta Platforms Ireland Limited | Art. 25 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1502 |
| ROMANIA | 2022-11-24 | 1,000 | Medicover S.R.L. | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1501 |
| ROMANIA | 2022-11-21 | 20,000 | ING Bank NV Amsterdam Sucursala București | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1500 |
| SPAIN | 2022-11-21 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1499 |
| PORTUGAL | 2022-11-02 | 180,000 | Setúbal municipality | Art. 5 (1) e), f) GDPR, Art. 13 (1), (2) GDPR, Art. 37 (1), (7) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1498 |
| ROMANIA | 2022-11-18 | 300 | Homeowners Association Bld. Pipera 1-2E | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1497 |
| FRANCE | 2022-11-10 | 800,000 | DISCORD INC. | Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 25 (2) GDPR, Art. 32 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1496 |
| ROMANIA | 2022-11-16 | 28,000 | Raiffeisen Bank SA | Art. 25 (1) GDPR, Art. 32 (1), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1495 |
| POLAND | 2022-11-02 | 1,700 | Mayor | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1494 |
| HUNGARY | 2022-08-11 | 197,000 | AMPLIFON Hungary Trade and Service Provider LLC | Art. 5 (1) b) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1493 |
| SPAIN | 2022-11-15 | 80,000 | BANKINTER, S.A. | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1492 |
| SPAIN | 2022-11-11 | 3,600 | XASTRE DO PETO, S.L. | Art. 6 (1) GDPR, Art. 13 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1491 |
| SPAIN | 2022-11-11 | 48,000 | Banco Bilbao Vizcaya Argentaria S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1490 |
| SPAIN | 2022-11-10 | 900 | Homeowners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1489 |
| SPAIN | 2022-11-10 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1488 |
| SPAIN | 2022-11-03 | 70,000 | UNITED PARCEL SERVICE ESPAÑA LTD Y COMPAÑIA SRC | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1487 |
| SPAIN | 2022-10-31 | 525,000 | TECHPUMP SOLUTIONS S.L. | Art. 5 (1) a), b), e) GDPR, Art. 6 (1) GDPR, Art. 8 GDPR, Art. 12 (1), (2) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 30 (1) GDPR, Art. 22 (2) LSSI | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1486 |
| SPAIN | 2022-11-02 | 2,000 | Rapido Finance, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1485 |
| SPAIN | 2022-11-02 | 5,000 | CÍTRICOS TANTA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1484 |
| ITALY | 2022-08-05 | 1,000 | Colosseo S.r.l. | Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 24 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1483 |
| ROMANIA | 2022-11-09 | 1,000 | SC Das Sense Society SRL | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1482 |
| ROMANIA | 2022-11-08 | 5,000 | SC Prestige Media PHG SRL | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1481 |
| SPAIN | 2022-10-31 | 56,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1480 |
| ROMANIA | 2022-11-07 | 2,000 | Romanian Post | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1479 |
| SPAIN | 2022-11-02 | 25,000 | CAIXABANK S.A. | Art. 16 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1478 |
| SPAIN | 2022-10-31 | 70,000 | BANCO BILBAO VIZCAYA ARGENTARIA, S.A. | Art. 5 (1) b) GDPR, Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1477 |
| SPAIN | 2022-10-31 | 2,000 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1476 |
| SPAIN | 2022-09-01 | 10,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1475 |
| SPAIN | 2022-09-23 | 1,200 | URBANO DIVERTIA, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1474 |
| ITALY | 2022-06-16 | 20,000 | Deutsche Bank S.p.A. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1473 |
| SPAIN | 2022-10-25 | 9,000 | EL RACO DEL PIS INVERSIONES S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1472 |
| SPAIN | 2022-10-26 | 10,000 | ACKERMANN & SCHWARTZ ATTORNEYS AT LAW SLP | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1471 |
| SPAIN | 2022-10-17 | 35,000 | OES GLOBAL ENERGY S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1470 |
| ITALY | 2022-09-15 | 3,000 | Thiene municipality | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1469 |
| SPAIN | 2022-10-24 | 8,000 | ADSL HOUSE, S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1468 |
| SPAIN | 2022-10-24 | 400 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1467 |
| SPAIN | 2022-10-24 | 240 | Company | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1466 |
| ITALY | 2022-07-21 | 20,000 | Acqua Novara.VCO S.p.a. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1465 |
| ITALY | 2022-07-21 | 5,000 | Ginosa municipality | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1464 |
| ITALY | 2022-07-21 | 10,000 | Clio S.r.l. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 30 (2) GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1463 |
| ITALY | 2022-10-06 | 15,000 | Servizio Idrico Integrato S.c.p.a. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1462 |
| UNITED KINGDOM | 2022-10-19 | 5,033,000 | Interserve Group Limited | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1461 |
| ITALY | 2022-09-15 | 10,000 | Bper Banca S.p.A. | Art. 12 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1460 |
| SPAIN | 2022-10-20 | 1,000 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1459 |
| GREECE | 2022-10-03 | 20,000 | NATIONAL BANK OF GREECE S.A. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1458 |
| GREECE | 2022-10-03 | 20,000 | PIRAEUS BANK S.A. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1457 |
| GREECE | 2022-10-03 | 20,000 | EUROBANK ERGASIAS S.A. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1456 |
| GREECE | 2022-10-03 | 20,000 | ALFA BANK S.A. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1455 |
| GREECE | 2022-09-09 | 15,000 | School | Art. 5 (1) a), b) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 30 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1454 |
| GREECE | 2022-09-22 | 3,000 | Gas station | Art. 12 GDPR, Art. 14 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1453 |
| ITALY | 2022-09-15 | 2,000 | Immobiliare Riscostruzione Meloria s.r.l. | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1452 |
| SPAIN | 2022-10-17 | 6,000 | Company | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1451 |
| ROMANIA | 2022-10-18 | 150 | Private individual | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1450 |
| ROMANIA | 2022-10-18 | 2,000 | SC Materiale Constructii Online SRL | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1449 |
| FRANCE | 2022-10-17 | 20,000,000 | Clearview Al Inc. | Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1448 |
| SPAIN | 2022-10-17 | 500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1447 |
| SPAIN | 2022-10-19 | 5,000 | RESTEXPERIENCE, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1446 |
| ITALY | 2022-07-07 | 20,000 | Intesa Sanpaolo Vita S.p.a. | Art. 5 (1) a), f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1445 |
| SPAIN | 2022-10-17 | 180 | INMUR JOYEROS, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1444 |
| HUNGARY | 2022-07-08 | 1,500 | Physician | Art. 5 (1) GDPR, Art. 12 (2) GDPR, Art. 13 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1443 |
| ITALY | 2022-08-05 | 20,000 | Cosmopol Security S.p.A. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1442 |
| SPAIN | 2022-10-14 | 12,000 | SEAN SERIOS S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1441 |
| HUNGARY | 2022-10-05 | 72,500 | Bank | Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1440 |
| GREECE | 2022-08-08 | 5,000 | IDIKA SA | Art. 5 (1) e) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1439 |
| BELGIUM | 2022-08-19 | 20,000 | Medical laboratory | Art. 5 (1) f) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 32 GDPR, Art. 35 (1), (3) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1438 |
| GREECE | 2022-09-06 | 5,000 | EDYTE SA | Art. 29 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1437 |
| ROMANIA | 2022-09-21 | 5,000 | Curtea Veche Publishing SRL | Art. 32 (1) b), c) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1436 |
| ITALY | 2022-09-01 | 4,000 | Liceo Statale 'Edoardo Amaldi” | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1435 |
| ROMANIA | 2022-10-03 | 150 | Website operator | Art. 5 (1) a), f) GDPR, Art. 6 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1434 |
| SPAIN | 2022-10-04 | 600 | Homeowners Association | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1433 |
| SPAIN | 2022-10-09 | 64,000 | EVERIS SPAIN S.L | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1432 |
| SPAIN | 2022-10-09 | 6,000 | UNION DE OFICIALES DE LA GUARDIA CIVIL PROFESIONAL | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1431 |
| SPAIN | 2022-10-09 | 800 | Company | Art. 6 (1) e) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1430 |
| SPAIN | 2022-10-09 | 900 | Private individual | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1429 |
| ICELAND | 2022-05-03 | 10,600 | HEI – Medical Travel | Art. 15 (1), (3) GDPR, Art. 9 (1) Act 90/2018, Art. 17 (2) Act 90/2018 | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1428 |
| ESTONIA | 2020-08-17 | 56 | Health care worker | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1427 |
| SPAIN | 2022-10-09 | 24,000 | CAJA DE SEGUROS REUNIDOS, COMPAÑÍA DE SEGUROS Y REASEGUROS, S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1426 |
| SPAIN | 2022-10-09 | 4,000 | PUNTO BADAL-BCN S.L. | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1425 |
| ITALY | 2022-07-07 | 45,000 | Senseonics Inc. | Art. 5 (1) a), b), f) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 27 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1424 |
| ITALY | 2022-09-15 | 100,000 | Lazio Region | Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 24 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1423 |
| UNITED KINGDOM | 2022-10-04 | 1,547,000 | Easylife Ltd. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 (1) c) GDPR, Regulation 21 PECR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1422 |
| SPAIN | 2022-10-04 | 6,000 | Club Náutico el Estacio | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1421 |
| DENMARK | 2021-08-17 | 20,100 | Danish Immigration Agency | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1420 |
| AUSTRIA | 2021 | 600 | Private individual | Art. 5 (1) a) GDPR, Art. 9 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1419 |
| AUSTRIA | 2021 | Unknown | Private individual | Art. 5 (1) a), c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1418 |
| SPAIN | 2022-09-28 | 31,200 | BAYARD REVISTAS, S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1417 |
| ITALY | 2022-07-21 | 3,000 | Azienda Socio Sanitaria Territoriale Rhodense | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1416 |
| ITALY | 2022-07-21 | 10,000 | Stay over s.r.l. | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 114 Codice della privacy | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1415 |
| ITALY | 2022-07-21 | 2,000 | Global Service s.r.l. | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1414 |
| ITALY | 2022-07-28 | 2,000 | Auto Hi-Fi System S.n.c | Art. 5 (1) a), c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1413 |
| DENMARK | 2022-09-12 | 6,700 | Hørsholm municipality | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1412 |
| SPAIN | 2022-09-28 | 720 | CLUB NATACIO LLEIDA | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1411 |
| SPAIN | 2022-09-28 | 180 | Y OTRO MAS C.B. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1410 |
| ROMANIA | 2022-09-22 | 2,000 | Bitfactor SRL | Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1409 |
| GERMANY | 2022-09-21 | 5,000 | Surveyor | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1408 |
| HUNGARY | 2022-09-25 | 1,200 | Health insurance provider | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 12 (3), (4) GDPR, Art. 31 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1407 |
| HUNGARY | 2022-08-08 | 735 | Company | Art. 5 (1) b), c) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1406 |
| POLAND | 2022-09-07 | 530 | Sułkowice Cultural Center | Art. 28 (1), (3), (9) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-1405 |
| SPAIN | 2022-09-23 | 3,000 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1404 |
| ROMANIA | 2022-09-19 | 2,000 | Banca Comercială Română SA | Art. 25 (1) GDPR, Art. 32 (1) b), d), e) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1403 |
| SPAIN | 2022-09-20 | 1,800 | Union Sindical Obrera | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1402 |
| SPAIN | 2022-09-16 | 2,000 | Agent of the real estate agency BARCELONA DREAM HOUSE AGENCY | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1401 |
| SPAIN | 2022-09-16 | 3,000 | MARIELI GABRIELA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1400 |
| GERMANY | 2022-09-21 | 50,000 | Property development company | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1399 |
| GERMANY | 2022-09-20 | 525,000 | Company | Art. 38 (6) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-1398 |
| SPAIN | 2022-07-15 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1397 |
| SPAIN | 2022-09-04 | 1,500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1396 |
| SPAIN | 2022-08-28 | 5,600 | SOLIVESA MASTER FRANCHISE S.L. | Art. 28 GDPR, Art. 48 (1) b) LGT | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1395 |
| SPAIN | 2022-08-28 | 48,000 | NATURGY ENERGY GROUP, S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1394 |
| ROMANIA | 2022-09-08 | 8,000 | Realmedia Network SA | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1393 |
| SPAIN | 2022-09-16 | 10,000 | SOPHIE ET VOILA, S.L | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1392 |
| SPAIN | 2022-09-16 | 480 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1391 |
| ITALY | 2022-06-16 | 2,000 | Federazione Italiana Nuoto | Art. 12 (3), (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1390 |
| ITALY | 2022-06-30 | 5,000 | Federazione Italiana Sommelier, Albergatori e Ristoratori | Art. 5 (1) a), f) GDPR, Art. 6 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1389 |
| SPAIN | 2022-09-04 | 360 | Store owner | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1388 |
| SPAIN | 2022-09-06 | 20,000 | MUXERS CONCEPT, S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1387 |
| SPAIN | 2022-09-09 | 180 | EURO DONER KEBAB | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1386 |
| ROMANIA | 2022-09-09 | 2,000 | SC Raiffeisen Bank SA | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1385 |
| SPAIN | 2022-09-09 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1384 |
| SPAIN | 2022-09-13 | 2,000 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1383 |
| FRANCE | 2022-09-13 | 250,000 | GIE INFOGREFFE | Art. 5 (1) e) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1382 |
| SPAIN | 2022-09-13 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1381 |
| NORWAY | 2022-08-25 | 20,000 | Recover AS | Art. 6 (1) e) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1380 |
| SPAIN | 2022-09-01 | 240 | MH VILASECA S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1379 |
| SPAIN | 2022-08-30 | 1,700 | Bazar Pekin | Art. 13 GDPR, Art. 30 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1378 |
| ROMANIA | 2022-08-29 | 1,000 | Alpha Bank Romania SA | Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1377 |
| SPAIN | 2022-08-28 | 1,200 | DIGITECNIA SOLUTIONS, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1376 |
| SPAIN | 2022-08-30 | 3,000 | COLEGIO VILLAEUROPA, S.C.L | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1375 |
| SPAIN | 2022-08-25 | 480 | SERVICIOS PROFESIONALES LA PARADA S.L. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1374 |
| IRELAND | 2022-09-05 | 405,000,000 | Meta Platforms, Inc. | Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 24 GDPR, Art. 25 (1), (2) GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1373 |
| SPAIN | 2022-08-30 | 2,000 | Sindicato Intersectorial Trabajadores/as Provincia de Alicante | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1372 |
| ROMANIA | 2022-07-07 | 4,000 | E Software Concept SRL | Art. 32 (1) b), (2) GDPR, Art. 58 (1) a), e) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1371 |
| ROMANIA | 2022-08-22 | 10,000 | Enel Energie Muntenia S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1370 |
| ITALY | 2022-06-16 | 70,000 | Unicredit S.p.A. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1369 |
| ITALY | 2022-06-09 | 10,000 | Cribis Credit Management s.r.l. | Art. 5 (1) a), c) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1368 |
| SPAIN | 2022-07-07 | 1,800 | FINCAS ARENYS SL | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1367 |
| SPAIN | 2022-07-12 | 800 | SMART ELECTRIC SOLUTIONS, S.L. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1366 |
| SPAIN | 2022-08-22 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1365 |
| SPAIN | 2022-08-22 | 900 | UNONO NET 3.0, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1364 |
| GREECE | 2022-07-19 | 20,000 | DO VALUE GREECE LOANS & CREDITS CLAIM MANAGEMENT S.A. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 12 (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1363 |
| GREECE | 2022-08-03 | 30,000 | Private Polyclinic and Diagnostic Centre of Pyle Axiou | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1362 |
| FRANCE | 2022-08-19 | 600,000 | ACCOR SA | Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 32 GDPR, L. 34-5 CPCE | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1361 |
| SLOVAKIA | 2021 | 40,000 | Unknown | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 28 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1360 |
| SLOVAKIA | 2021 | 100 | Unknown | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1359 |
| SLOVAKIA | 2021 | 500 | Unknown | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1358 |
| SPAIN | 2022-07-12 | 1,600 | JOYPAZAR, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1357 |
| SPAIN | 2022-07-12 | 6,000 | FREE SUN ENERGY S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1356 |
| SPAIN | 2022-07-15 | 3,600 | ECOZONO Y CULTURA, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1355 |
| ITALY | 2021-04-29 | 2,000 | Santa Ninfa municipality | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) Art. 6 (2) GDPR, Art. 6 (3) b) GDPR GDPR, Art. 2-ter (1), (3) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1354 |
| ITALY | 2021-09-16 | 1,000 | Farpa s.r.l. | Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 88 GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1353 |
| ISLE OF MAN | 2022-07-13 | 202,000 | Manx Care Ltd | Art. 5 (1) c), f) GDPR, Art. 5 (2) GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 34 GDPR, Art. 58 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1352 |
| SPAIN | 2022-08-16 | 5,000 | RODALI GESTIÓN INMOBILIARIA, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1351 |
| GERMANY | 2021 | Unknown | Political organization | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1350 |
| GERMANY | 2021 | Unknown | Restaurant | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1349 |
| GERMANY | 2021 | Unknown | Bank employee | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1348 |
| GERMANY | 2021 | Unknown | Unknown | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1347 |
| GERMANY | 2021 | Unknown | Physician | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1346 |
| GERMANY | 2021 | Unknown | Physician | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1345 |
| GERMANY | 2021 | Unknown | Gym owner | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1344 |
| GERMANY | 2021 | Unknown | Private individual | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1343 |
| GERMANY | 2021 | Unknown | Private individual | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1342 |
| SPAIN | 2022-08-12 | 180 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1341 |
| GERMANY | 2021 | Unknown | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1340 |
| GERMANY | 2021 | Fine amount between EUR 100 and EUR 1,000 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1339 |
| GERMANY | 2021 | Unknown | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1338 |
| GERMANY | 2021 | Unknown | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1337 |
| GERMANY | 2021 | Unknown | Company | Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1336 |
| GERMANY | 2021 | 16,000 | Electronics store | Art. 5 (1) c) GDPR, Art. 17 GDPR, Art. 35 (3) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1335 |
| SPAIN | 2022-08-05 | 9,000 | Prodesspa Decoratius i Pintures , S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1334 |
| SPAIN | 2022-08-03 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1333 |
| SPAIN | 2022-08-08 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1332 |
| ROMANIA | 2022-08-09 | 1,000 | Wabag Water Services SRL | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1331 |
| DENMARK | 2022-08-11 | 6,700 | Lolland municipiality | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1330 |
| SPAIN | 2022-08-08 | 600 | Restaurant owner | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1329 |
| ROMANIA | 2022-08-09 | 7,000 | CDI Transport Intern și Internațional SRL | Art. 12 (1) GDPR, Art. 58 (1) a), e) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1328 |
| ITALY | 2021-05-13 | 20,000 | Synlab Med srl | Art. 5 (1) a), c) GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1327 |
| ITALY | 2022-08-01 | 26,000 | Policoro municipality | Art. 5 (1) a), e) GDPR, Art. 5 (2) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 38 (6) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1326 |
| SPAIN | 2022-08-01 | 9,600 | LAST LAP, S.L. | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1325 |
| SPAIN | 2022-07-29 | 3,000 | ESTUDIOS EUROPEOS DE POSTGRADO Y EMPRESA, S.L. | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1324 |
| SPAIN | 2022-08-04 | 2,000 | JAÉN SENTIDO Y COMÚN | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1323 |
| ROMANIA | 2022-08-04 | 2,000 | Sephora Cosmetics România SA | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1322 |
| NORWAY | 2022-08-02 | 30,200 | Krokatjønnvegen 15 AS | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1321 |
| SPAIN | 2022-08-02 | 42,000 | Banco Bilbao Vizcaya Argentaria S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1320 |
| SPAIN | 2022-08-01 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1319 |
| FRANCE | 2022-07-07 | 175,000 | UBEEQO INTERNATIONAL | Art. 5 (1) c), e) GDPR, Art. 12 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1318 |
| POLAND | 2022-07-06 | 2,120 | University Hospital of the Medical University of Warsaw | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1317 |
| ITALY | 2021-09-29 | 11,000 | Territorial Administration of the Government of Genoa | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) Art. 6 (2) GDPR, Art. 6 (3) b) GDPR GDPR, Art. 2-ter (1), (3) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1316 |
| SPAIN | 2022-07-26 | 800 | EFS MANTENIMIENTO Y SERVICIOS TÉCNICOS, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1315 |
| SPAIN | 2022-07-26 | 2,500 | Homeowners Association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1314 |
| GERMANY | 2022-07-28 | 900,000 | Hannoversche Volksbank | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1313 |
| SPAIN | 2022-07-26 | 15,000 | TELEFÓNICA MÓVILES ESPAÑA, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1312 |
| SPAIN | 2022-07-27 | 300 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1311 |
| LUXEMBOURG | 2022-06-30 | 1,000 | Company | Art. 5 (1) a) GDPR, Art. 12 (1), (7) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1310 |
| LUXEMBOURG | 2022-06-30 | 1,000 | Company | Art. 5 (1) a) GDPR, Art. 12 (1), (7) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1309 |
| SPAIN | 2022-07-22 | 500 | CINCON S.C. | Art. 13 (2) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1308 |
| LUXEMBOURG | 2022-06-30 | 1,400 | Company | Art. 5 (1) e) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1307 |
| LUXEMBOURG | 2022-06-22 | 3,000 | Company | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1306 |
| GERMANY | 2022-07-26 | 1,100,000 | Volkswagen | Art. 13 GDPR, Art. 28 GDPR, Art. 30 GDPR, Art. 35 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1305 |
| SPAIN | 2022-07-22 | 40,000 | ESVETEL, S.L. | Art. 28 GDPR, Art. 48 (1) b) LGT | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1304 |
| GERMANY | 2021 | 10,100 | Car trading group | Unknown | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1303 |
| GERMANY | 2021 | 12,500 | Energy supplier | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1302 |
| GERMANY | 2021 | 12,500 | Energy supplier | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1301 |
| GERMANY | 2021 | 5,000 | Private individual | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1300 |
| ITALY | 2022-05-22 | 12,000 | Comune di Napoli Corpo di Polizia Municipale | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 88 GDPR, Art. 113 Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1299 |
| ITALY | 2022-05-26 | 50,000 | Azienda sanitaria universitaria Friuli Occidentale | Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1298 |
| ITALY | 2022-05-26 | 70,000 | Azienda sanitaria universitaria Friuli Centrale | Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1297 |
| ITALY | 2022-05-12 | 2,000 | Singh Market | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1296 |
| ITALY | 2022-05-26 | 4,000 | Università Agraria di Nettuno | Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1295 |
| ITALY | 2022-05-26 | 16,000 | Region of Tuscany | Art. 5 (1) c) GDPR, Art. 6 (1) c) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 2-ter (1), (3) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1294 |
| CROATIA | 2022-07-21 | 285,000 | Telecommunications company | Art. 25 (1) GDPR, Art. 32 (1) b) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1293 |
| CROATIA | 2022-07-21 | 4,000 | Car dealership | Art. 27 (1) Zakona o provedbi Opće uredbe o zaštiti podataka | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1292 |
| ITALY | 2021-03-25 | 6,000 | Convitto Nazionale Statale 'Giordano Bruno' di Maddaloni (boarding school) | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 2-ter (1), (3) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1291 |
| ITALY | 2022-05-12 | 6,000 | Villabate municipality | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 37 (1) a) GDPR, Art. 37 (7) GDPR, Art. 38 (6) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1290 |
| ITALY | 2022-05-26 | 10,000 | Afragola municipality | Art. 5 (1) a), c) GDPR, Art. 12 (3), (4) GDPR, Art. 2-ter Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1289 |
| SPAIN | 2022-07-18 | 56,000 | BANKINTER, S.A. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1288 |
| SPAIN | 2022-07-19 | 4,000 | Bookstore employee | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1287 |
| SPAIN | 2022-07-19 | 2,000 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1286 |
| SPAIN | 2022-07-19 | 5,000 | Bar owner | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1285 |
| SPAIN | 2022-07-19 | 600 | Private individual | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1284 |
| SPAIN | 2022-07-13 | 132,000 | DKV Seguros y Reaseguros, S.A.E. | Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1283 |
| GERMANY | 2021 | Fine in six-digit amount | Company | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1282 |
| GERMANY | 2021 | Unknown | Police department | § 32 Absatz 1 BbgDSG | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1281 |
| GERMANY | 2021 | Unknown | Police department | § 32 Absatz 1 BbgDSG | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1280 |
| GERMANY | 2021 | Unknown | Police department | § 32 Absatz 1 BbgDSG | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1279 |
| ITALY | 2021-01-27 | 10,000 | City of Rome (Roma capitale) | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) Art. 6 (2) GDPR, Art. 6 (3) b) GDPR GDPR, Art. 2-ter (1), (3) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1278 |
| GERMANY | 2021 | Fine in four-digit amount | Physician | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1277 |
| GERMANY | 2021 | Fine in three-digit amount | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1276 |
| GERMANY | 2021 | Fine in three-digit amount | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1275 |
| ITALY | 2022-05-22 | 7,000 | Azienda Socio Sanitaria Territoriale Dei Sette Laghi | Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1274 |
| CYPRUS | 2022 | 5,000 | Cyprus Judo Federation | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1273 |
| SPAIN | 2022-07-01 | 300 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1272 |
| ITALY | 2022-05-26 | 2,000 | Turkish City | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1271 |
| DENMARK | 2022-07-14 | 67,200 | SIRIUS (law firm) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1270 |
| POLAND | 2022-07-06 | 12,450 | Głównego Geodetę Kraju | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1269 |
| GREECE | 2022-07-13 | 20,000,000 | Clearview Al Inc. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1268 |
| CYPRUS | 2022 | 1,500 | Physician | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1267 |
| CYPRUS | 2022-02-04 | 10,000 | Εκδοτικού Οίκου Δίας | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1266 |
| CYPRUS | 2022 | 2,000 | Oroklini Municipal Council | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1265 |
| ITALY | 2022-05-12 | 20,000 | Bazar di Hu Xiaoyan | Art. 5 GDPR, Art. 13 GDPR, Art. 114 Codice della privacy | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1264 |
| FRANCE | 2022-06-23 | 1,000,000 | TotalEnergies Electricité et Gaz France | Art. 14 GDPR, Art. 15 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1263 |
| SPAIN | 2022-07-06 | 3,000 | ASOCIACIÓN DE AFICIONADOS Y PEQUEÑOS ACCIONISTAS UNIDAD HERCULANA | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1262 |
| SPAIN | 2022-07-05 | 600 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1261 |
| SPAIN | 2022-07-06 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1260 |
| NORWAY | 2022-03-04 | 195,000 | Norwegian Parliament | Art. 5 (1) f) GDPR, Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1259 |
| ITALY | 2022-05-26 | 100,000 | Intesa Sanpaolo S.p.A | Art. 5 (1) a), f) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1258 |
| ITALY | 2022-05-26 | 46,000 | Azienda Sanitaria Locale Roma | Art. 5 (1) c) GDPR, Art. 6 (1) c), d) GDPR, Art. 6 (2), (3) GDPR, Art. 9 (1), (2), (4) GDPR, Art. 2-ter (1), (2) Codice della privacy, Art. 2-septies (8) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1257 |
| GREECE | 2022-06-20 | 2,000 | WIND Ελλάς Τηλεπικοινωνίες ΑΕΒΕ | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1256 |
| GREECE | 2022-06-24 | 2,000 | Parliamentary election candidate | Art. 12 GDPR, Art. 11 Law 3471/2006 | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1255 |
| FINLAND | 2022-05-09 | 85,000 | Otavamedia Oy | Art. 5 (1) c) GDPR, Art. 12 (1), (2), (3), (4), (6) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1254 |
| SPAIN | 2022-05-24 | 42,000 | Alquiler Seguro SA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1253 |
| SPAIN | 2022-07-01 | 500 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1252 |
| GREECE | 2022-06-29 | 3,000 | Pediatric psychologist | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1251 |
| UNITED KINGDOM | 2022-06-09 | 91,000 | Tavistock & Portman NHS Foundation Trust | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1250 |
| SPAIN | 2022-06-28 | 3,000 | FLY FUT, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1249 |
| ROMANIA | 2022-06-30 | 2,000 | Continental Automotive Romania SRL | Art. 24 GDPR, Art. 32 (1) d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1248 |
| SPAIN | 2022-06-23 | 30,000 | RADIO TELEVISION MADRID, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1247 |
| SPAIN | 2022-06-23 | 30,000 | CORPORACIÓN DE RADIO Y TELEVISIÓN ESPAÑOLA S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1246 |
| SPAIN | 2022-06-28 | 1,000 | Company | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1245 |
| HUNGARY | 2022-02-08 | 634,000 | Budapest Bank Zrt. | Art. 5 (1) a), b) GDPR, Art. 6 (1), (4) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 (1), (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1), (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1244 |
| POLAND | 2022-05-31 | 2,100 | Stołeczny Ośrodek dla Osób Nietrzeźwych | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1243 |
| ITALY | 2022-05-22 | 3,000 | Zito Auto di Gianfranco Zito | Art. 5 (1) a), c) GDPR, Art. 114 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1242 |
| DENMARK | 2022-06-22 | 134,000 | Gyldendal A/S | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1241 |
| SPAIN | 2022-06-24 | 180 | Store owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1240 |
| ROMANIA | 2022-06-20 | 7,000 | Asociația de Proprietari Aviației Park | Art. 5 (1) a), c), e) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1239 |
| ROMANIA | 2022-06-20 | 1,000 | SC Interactions Marketing SRL | Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1238 |
| SPAIN | 2022-06-17 | 1,000 | Company | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1237 |
| SPAIN | 2022-06-16 | 1,000 | SCOTCH CORNER BAR | Art. 5 (1) c) GDPR, Art. 58 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1236 |
| ITALY | 2022-04-28 | 70,000 | Ospedale San Raffaele s.r.l. | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1235 |
| NORWAY | 2022-05-16 | 14,500 | Arbeidstilsynet | Art. 6 (1) e) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1234 |
| BELGIUM | 2022-06-16 | 0 | SA Rossel & Cie | Art. 6 (1) a) GDPR, Art. 7 (1) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1233 |
| ITALY | 2022-04-28 | 20,000 | Nos s.r.l.s. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1232 |
| SPAIN | 2022-06-09 | 10,000 | Private individual | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1231 |
| ROMANIA | 2022-06-15 | 3,000 | S.C. Wine Point S.R.L. | Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1230 |
| GERMANY | 2021 | Fine in four-digit amount | Real estate agent | Art. 6 GDPR, Art. 12 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1229 |
| ITALY | 2022-04-28 | 40,000 | Il Sole 24 Ore S.p.a. | Art. 5 GDPR, Art. 9 GDPR, Art. 12 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1228 |
| ITALY | 2022-04-28 | 2,000 | Ekss s.r.l. | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1227 |
| SPAIN | 2022-06-09 | 600 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1226 |
| GERMANY | 2021 | Fine in four-digit amount | Company | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1225 |
| GERMANY | 2021 | Fine in three-digit amount | Physician | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1224 |
| ITALY | 2022-04-28 | 2,000 | Comune di Partanna | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1223 |
| GERMANY | 2021 | Unknown | Clinic | Unknown | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-1222 |
| GERMANY | 2021 | Unknown | Attorney | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1221 |
| GERMANY | 2021 | Unknown | Beverage retailer | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1220 |
| GERMANY | 2021 | Unknown | Medical clinic | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1219 |
| GERMANY | 2021 | Unknown | Job center employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1218 |
| GERMANY | 2021 | Unknown | Job center employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1217 |
| GERMANY | 2021 | Unknown | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1216 |
| GERMANY | 2021 | Unknown | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1215 |
| GERMANY | 2021 | Unknown | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1214 |
| GERMANY | 2021 | Unknown | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1213 |
| GERMANY | 2021 | Unknown | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1212 |
| GERMANY | 2021 | Unknown | Unknown | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1211 |
| GERMANY | 2021 | Unknown | Unknown | Unknown | Unknown | https://www.enforcementtracker.com/ETid-1210 |
| GERMANY | 2021 | 170 | Restaurant | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1209 |
| GERMANY | 2021 | 400 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1208 |
| GERMANY | 2021 | 600 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1207 |
| GERMANY | 2021 | 500 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1206 |
| GERMANY | 2021 | 1,800 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1205 |
| ITALY | 2022-04-28 | 2,500 | 'Isabella Gonzaga' high school | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexties Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1204 |
| POLAND | 2022-06-06 | 3,500 | Esselmann Technika Pojazdowa Sp. z o.o. Sp. k. | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1203 |
| SPAIN | 2022-06-03 | 3,000 | LODEJU, S.L. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1202 |
| ROMANIA | 2022-06-08 | 1,500 | Wens Experience SRL | Art. 28 (2) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-1201 |
| SPAIN | 2022-06-03 | 360 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1200 |
| SPAIN | 2022-06-03 | 1,000 | Store owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1199 |
| ROMANIA | 2022-06-03 | 2,000 | Kaufland Romania SCS | Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1198 |
| ITALY | 2022-04-28 | 50,000 | Istituto Nazionale Assicurazione Infortuni sul Lavoro | Art. 5 (1) a), f) GDPR, Art. 6 (1) e) GDPR, Art. 9 (2) g) GDPR, Art. 32 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1197 |
| ITALY | 2022-04-28 | 10,000 | Italian Ministry of Defense | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-sexies Codice della privacy, Art. 2-octies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1196 |
| SPAIN | 2022-06-01 | 300 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1195 |
| SPAIN | 2022-05-31 | 1,600 | CORON ISLAND SLU | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1194 |
| ITALY | 2022-04-28 | 1,000 | Educationest s.r.l. | Art. 5 (1) a), e) GDPR, Art. 6 (1) b), c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1193 |
| ITALY | 2022-04-07 | 10,000 | E-Mac Professional s.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1192 |
| BELGIUM | 2022-05-25 | 50,000 | Roularta Media Group | Art. 5 (1) e) GDPR, Art. 5 (2) GDPR, Art. 6 (1) a) GDPR, Art. 7 (1), (3) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 24 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1191 |
| UNITED KINGDOM | 2022-05-18 | 9,000,000 | Clearview Al Inc. | Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 22 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1190 |
| FINLAND | 2022-04-29 | 8,300 | Telemarketing company | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1189 |
| UNITED KINGDOM | 2022-03-10 | 115,000 | Tuckers Solicitors LLP | Art. 5 (1) a) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1188 |
| ITALY | 2022-04-07 | 10,000 | Findomestic Banca spa | Art. 5 (1) a), c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1187 |
| ITALY | 2022-04-07 | 20,000 | Made in Italy s.r.l.s. | Art. 6 GDPR, Art. 7 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 130 (3) Codice della privacy, Art. 157 Codice della privacy, Art. 166 (2) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1186 |
| ITALY | 2022-04-07 | 50,000 | Palumbo Superyacht Ancona s.r.l. | Art. 5 (1) a), e) GDPR, Art. 13 GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 157 Codice della privacy, Art. 166 (2) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1185 |
| SPAIN | 2022-05-20 | 2,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1184 |
| SPAIN | 2022-05-20 | 1,500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1183 |
| SPAIN | 2022-05-20 | 2,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1182 |
| NORWAY | 2022-03-15 | 9,700 | Company | Art. 6 (1) GDPR, Art. 13 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1181 |
| ROMANIA | 2022-05-24 | 5,000 | MED LIFE S.A. | Art. 32 (1) b), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1180 |
| SPAIN | 2022-05-17 | 42,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1179 |
| SPAIN | 2022-05-18 | 600 | SCF ZHU, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1178 |
| ITALY | 2022-03-10 | 10,000 | Alfa Shipyard s.r.l. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1177 |
| SPAIN | 2022-05-18 | 10,000,000 | Google LLC | Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1176 |
| SPAIN | 2022-05-17 | 4,000 | INSEKT FOOD S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1175 |
| SPAIN | 2022-05-17 | 18,000 | RAMONA FILMS, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1174 |
| SPAIN | 2022-05-17 | 8,000 | TIGERS MARKET, S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1173 |
| SPAIN | 2022-05-17 | 1,500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1172 |
| ROMANIA | 2022-05-17 | 1,500 | MAYR MELNHOF PACKAGING ROMANIA S.R.L. | Art. 5 (1) b), c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1171 |
| ROMANIA | 2022-05-18 | 5,000 | Kredyt Inkaso Investments RO S.A | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 33 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1170 |
| HUNGARY | 2022-03-29 | 1,300 | Workshop | Art. 5 (1) b), c) GDPR, Art. 6 (1) f) GDPR, Art. 13 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1169 |
| SPAIN | 2022-05-13 | 170,000 | Mercadona S.A. | Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1168 |
| LUXEMBOURG | 2022-02-02 | 1,000 | Café owner | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1167 |
| SPAIN | 2022-05-11 | 6,000 | Homeowners Association | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1166 |
| SPAIN | 2022-05-12 | 2,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1165 |
| SPAIN | 2022-05-12 | 500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1164 |
| ROMANIA | 2022-05-12 | 1,000 | LORIS FUEL SHOP SRL | Art. 29 GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1163 |
| SPAIN | 2022-05-11 | 600 | Bar owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1162 |
| DENMARK | 2022-05-12 | 13,400 | Civilstyrelsen | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1161 |
| ITALY | 2022-04-07 | 40,000 | ISWEB S.p.A. | Art. 28 GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-1160 |
| ITALY | 2022-04-07 | 40,000 | Azienda ospedaliera di Perugia | Art. 5 (1) a), f) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 25 GDPR, Art. 30 GDPR, Art. 32 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1159 |
| ITALY | 2022-04-26 | 1,000 | ASST di Lodi | Art. 5 (1) f) GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1158 |
| SPAIN | 2022-04-28 | 40,000 | Working Capital Management España, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1157 |
| SPAIN | 2022-05-10 | 300 | Store owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1156 |
| SPAIN | 2022-05-09 | 1,200 | CONTIMAG INVEST, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1155 |
| ICELAND | 2022-05-03 | 36,000 | City of Reykjavík | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1154 |
| SPAIN | 2022-04-28 | 15,000 | MEDEROS MOVITEN, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1153 |
| SPAIN | 2022-05-03 | 5,000 | MISTORE CANARIAS, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1152 |
| BELGIUM | 2022-05-04 | 10,000 | Nationale Maatschappij der Belgische Spoorwegen | Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (2) GDPR, Art. 21 (2), (3), (4) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1151 |
| ITALY | 2022-03-24 | 10,000 | Brav s.r.l. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1150 |
| NORWAY | 2022-02-02 | 30,000 | Lillestrøm Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1149 |
| ROMANIA | 2022-05-04 | 4,000 | Concordia Capital IFN S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1148 |
| SPAIN | 2022-04-28 | 1,500 | CAFFE VECCHIO, S.L. | Art. 5 (1) f) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1147 |
| CYPRUS | 2021-09-17 | 10,000 | Mediterranean Hospital of Cyprus | Art. 31 GDPR, Art. 58 (1) a) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1146 |
| ROMANIA | 2022-05-03 | 4,000 | Megareduceri TV S.R.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1145 |
| SPAIN | 2022-04-29 | 16,000 | LABORATORIOS GONZÁLEZ, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1144 |
| SPAIN | 2022-04-29 | 4,200 | CLÍNICA DENTAL SAN FRANCISCO, S.L. | Art. 17 GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1143 |
| SPAIN | 2022-04-22 | 5,600 | Physician | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1142 |
| SPAIN | 2022-04-27 | 1,500 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1141 |
| SPAIN | 2022-04-23 | 1,200 | MOVALIA TRASLADOS, S.L.U. | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1140 |
| SPAIN | 2022-04-19 | 600 | DOOR2DOOR SPAIN, S.L. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1139 |
| HUNGARY | 2022-03-02 | 13,500 | Company | Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (2) GDPR, Art. 17 (1) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1138 |
| GREECE | 2022-04-04 | 5,000 | Mayor | Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1137 |
| FRANCE | 2022-04-15 | 1,500,000 | DEDALUS BIOLOGIE | Art. 28 GDPR, Art. 29 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1136 |
| SPAIN | 2022-04-18 | 1,800 | Website operator | Art. 6 (1) GDPR, Art. 13 GDPR, Art. 22 (2) LSSI | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1135 |
| SPAIN | 2022-04-18 | 9,000 | JIMBO NETWORKS, S.L. | Art. 6 (1) GDPR, Art. 13 GDPR, Art. 22 (2) LSSI | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1134 |
| ITALY | 2022-03-10 | 8,000 | Agenzia Regionale per la Tutela dell'Ambiente dell'Abruzzo | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 10 GDPR, Art. 2-ter Codice della privacy, Art. 2-octies Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1133 |
| GREECE | 2022-04-04 | 10,000 | Piraeus Bank | Art. 5 (1) f) GDPR, Art. 33 GDPR, Art. 34 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1132 |
| ITALY | 2022-03-10 | 6,000 | Azienda sanitaria provinciale di Caltanissetta | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 37 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1131 |
| SPAIN | 2022-04-13 | 8,000 | RAMONA FILMS, S.L. | Art. 13 GDPR, Art. 22 (2) LSSI | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1130 |
| SPAIN | 2022-04-11 | 150,000 | BASER COMERCIALIZADORA DE REFERENCIA, S.A. | Art. 6 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1129 |
| SPAIN | 2022-04-18 | 1,800 | FLORAQUEEN FLOWERING THE WORLD S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1128 |
| ITALY | 2022-03-10 | 10,000 | Azienda USL Toscana Centro | Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 32 GDPR, | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1127 |
| ROMANIA | 2022-04-18 | 1,000 | IKEA România S.R.L. | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1126 |
| SPAIN | 2022-04-12 | 500 | Homeowners Association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1125 |
| THE NETHERLANDS | 2022-04-07 | 3,700,000 | Dutch Tax and Customs Administration | Art. 5 (1) a), b), d), e) GDPR, Art. 6 (1) GDPR, Art. 32 (1) GDPR, Art. 35 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1124 |
| ITALY | 2022-02-10 | 1,500 | Studio Colli Aniene Verderocca S.r.l. | Art. 12 (3) GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1123 |
| ITALY | 2022-02-10 | 5,000 | Arte del vivere S.r.l. | Art. 12 GDPR, Art. 17 GDPR, Art. 157 Codice della privacy | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1122 |
| BELGIUM | 2022-04-01 | 7,500 | Company | Art. 5 (1) a) GDPR, Art. 6 (1) f) GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 21 GDPR, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1121 |
| ROMANIA | 2022-04-07 | 500 | Property owners' association | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1120 |
| THE NETHERLANDS | 2022-02-24 | 565,000 | Dutch Foreign Ministry | Art. 13 (1) e) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1119 |
| BELGIUM | 2022-04-04 | 20,000 | Ambuce Rescue Team | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1118 |
| BELGIUM | 2022-04-04 | 100,000 | Brussels Airport Charleroi | Art. 5 (1) a), b) GDPR, Art. 6 (1) c) GDPR, Art. 6 (3) GDPR, Art. 9 (2) i) GDPR, Art. 12 (1) GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) e) GDPR, Art. 35 (1), (7) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1117 |
| BELGIUM | 2022-04-04 | 200,000 | Brussels Airport Zaventem | Art. 5 (1) c) GDPR, Art. 6 (1) e) GDPR, Art. 9 (2) g) GDPR, Art. 12 GDPR, Art. 13 (1) c) GDPR, Art. 13 (2) e) GDPR, Art. 35 (1), (3), (7) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1116 |
| IRELAND | 2022-04-05 | 463,000 | Bank of Ireland | Art. 32 GDPR, Art. 33 GDPR, Art. 34 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1115 |
| DENMARK | 2022-04-05 | 1,300,000 | Danske Bank | Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1114 |
| GREECE | 2022-03-09 | 2,000 | Foreign language school | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 13 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1113 |
| SWEDEN | 2022-03-28 | 720,000 | Klarna Bank AB | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 12 (1) GDPR, Art. 13 (2) f) GDPR, Art. 14 (2) g) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1112 |
| ROMANIA | 2022-03-28 | 2,000 | Condor SA | Art. 32 (1), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1111 |
| ROMANIA | 2022-03-25 | 2,000 | Kaufland Romania SCS | Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1110 |
| CYPRUS | 2022-03-21 | 5,000 | English School staff union (ESSA) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1109 |
| CYPRUS | 2022-03-22 | 4,000 | English School Cyprus | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1108 |
| GREECE | 2022-03-09 | 2,000 | Employer | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 13 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1107 |
| DENMARK | 2022-03-25 | 6,700 | Danish National Genome Center | Art. 36 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1106 |
| POLAND | 2022-01-19 | 53,000 | PIKA Sp. z o.o. | Art. 28 (3) c), f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1105 |
| POLAND | 2022-01-19 | 1,000,000 | Fortum Marketing and Sales Polska S.A. | Art. 5 (1) f) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 28 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1104 |
| GERMANY | 2022-03-03 | 1,900,000 | BREBAU GmbH | Art. 5 (1) GDPR, Art. 6 (1) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1103 |
| ITALY | 2022-02-10 | 2,000 | Comune di Guidizzolo | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1102 |
| ITALY | 2022-02-10 | 10,000 | Scanshare S.r.l. | Art. 28 (2) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1101 |
| ITALY | 2022-02-10 | 10,000 | Region of Tuscany | Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1100 |
| ITALY | 2022-02-10 | 3,500 | Azienda socio sanitaria territoriale Melegnano e della Martesana | Art. 5 (1) f) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1099 |
| ITALY | 2022-02-10 | 20,000,000 | Clearview Al Inc. | Art. 5 (1) a), b), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR, Art. 27 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1098 |
| ICELAND | 2022-03-08 | 7,000 | Hörpu tónlistar- og ráðstefnuhúss ohf. | Art. 5 (1) c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1097 |
| ROMANIA | 2022-03-10 | 2,000 | Operatorul Briza Land S.R.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1096 |
| ITALY | 2022-02-10 | 10,000 | Costampress S.p.A. | Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1095 |
| IRELAND | 2022-03-15 | 17,000,000 | Meta Platforms Ireland Limited | Art. 5 (2) GDPR, Art. 24 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1094 |
| CROATIA | 2022-03-08 | 89,250 | Retail company (name not available at the moment) | Art. 32 (1) b), d) GDPR, Art. 32 (2) GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1093 |
| CROATIA | 2022-03-08 | 124,245 | Energy company (name not available at the moment) | Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1092 |
| GERMANY | 2020-10-24 | 200 | Private Individual | Art. 5 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1091 |
| SPAIN | 2022-02-23 | 1,500 | WORLDWIDE CLASSIC CARS NETWORK S.L. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1090 |
| THE NETHERLANDS | 2022-01-14 | 525,000 | DPG Media Magazines B.V. | Art. 12 (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1089 |
| FINLAND | 2021-12-26 | 5,000 | Medical clinic | Art. 5 (1) a) GDPR, Art. 12 (1), (2), (3), (4) GDPR, Art. 13 (1), (2) GDPR, Art. 15 (1), (3) GDPR, Art. 25 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1088 |
| SPAIN | 2022-02-23 | 1,200 | FRUTAS Y VERDURAS LOS CAMPEONES, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1087 |
| SPAIN | 2022-02-22 | 3,000 | Hotel operator | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1086 |
| POLAND | 2022-01-19 | 117,000 | Santander Bank Polska S. A. | Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-1085 |
| SPAIN | 2022-02-22 | 1,000 | MALAGATROM, S.L.U. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1084 |
| ROMANIA | 2022-02-22 | 3,000 | IAMSAT Muntenia SA | Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1083 |
| ROMANIA | 2022-02-22 | 1,000 | Civil law firm 'Sabou, Burz & Cuc' | Art. 5 (1) a), b), c), f) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1082 |
| SPAIN | 2022-02-21 | 1,000 | Store owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1081 |
| SPAIN | 2022-02-21 | 1,500 | RESTATURANTE FUENTEBRO, S.C. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1080 |
| SPAIN | 2022-02-18 | 2,500 | Private person | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1079 |
| ITALY | 2022-01-27 | 40,000 | T.S.M. s.r.l. | Art. 13 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 157 Codice della privacy, Art. 166 (2) Codice della privacy | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1078 |
| GREECE | 2022-02-15 | 30,000 | ΛΙΜΕΝΟΣ ΗΡΑΚΛΕΙΟΥ Α.Ε. | Art. 12 (1), (2) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1077 |
| ITALY | 2022-01-27 | 2,000 | Private club 'Ruian' | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1076 |
| ITALY | 2022-01-13 | 1,000 | A.S.L. Napoli 1 Centro | Art. 5 GDPR, Art. 6 GDPR, Art. 2-ter Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1075 |
| SPAIN | 2022-02-16 | 6,000 | Private individual | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1074 |
| SPAIN | 2022-02-11 | 2,000,000 | Amazon Road Transport Spain S.L. | Art. 6 (1) GDPR, Art. 10 GDPR, Art. 10 LOPDGDD | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1073 |
| ITALY | 2022-01-13 | 1,000 | Villa Masi Residenza per anziani | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1072 |
| SPAIN | 2022-02-14 | 1,600 | RECLAMADOR, S.L. | Art. 17 GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1071 |
| NORWAY | 2022-02-01 | 5,000 | Etterforsker1 Gruppen AS | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1070 |
| POLAND | 2021-12-01 | 4,000 | Pactum Poland Sp. z o.o. | Art. 31 GDPR, Art. 58 (1) e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1069 |
| ITALY | 2022-01-13 | 14,000 | Azienda sanitaria unica regionale Marche | Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1068 |
| ITALY | 2022-01-13 | 4,000 | Medicina & Lavoro s.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1067 |
| ITALY | 2021-12-16 | 1,000 | Università Telematica Internazionale Uninettuno | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1066 |
| ITALY | 2022-01-13 | 7,500 | Azienda Sanitaria Locale Frosinone | Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1065 |
| ITALY | 2021-12-16 | 20,000 | FCA Italy s.p.a. | Art. 12 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1064 |
| ITALY | 2021-12-16 | 100,000 | Ubi Banca spa | Art. 5 (1) a), c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1063 |
| SPAIN | 2022-02-07 | 10,000 | PINTODIS, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1062 |
| SPAIN | 2022-02-04 | 2,000 | Private individual | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1061 |
| SPAIN | 2022-02-07 | 1,000 | Cafe operator | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1060 |
| SPAIN | 2022-02-01 | 900,000 | TELEFÓNICA MÓVILES ESPAÑA, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1059 |
| SPAIN | 2022-02-01 | 200,000 | XFERA MÓVILES, S.A. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1058 |
| SPAIN | 2022-02-01 | 700,000 | Orange Espagne S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1057 |
| SPAIN | 2022-02-01 | 70,000 | ORANGE ESPAÑA VIRTUAL, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1056 |
| SPAIN | 2022-02-01 | 3,940,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1055 |
| ITALY | 2021-12-17 | 10,000 | ASL Latina | Art. 5 (1) f) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1054 |
| SPAIN | 2022-02-04 | 300,000 | SEGURCAIXA ADESLAS, S.A. DE SEGUROS Y REASEGUROS | Art. 6 GDPR, Art. 17 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1053 |
| SPAIN | 2022-02-04 | 900 | Private person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1052 |
| BELGIUM | 2022-02-02 | 0 | IAB Europe | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 9 (1), (2) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 24 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR, Art. 32 (1), (2) GDPR, Art. 37 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1051 |
| GERMANY | 2020 | Fine amount between EUR 50 and EUR 100 | Restaurant | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1050 |
| GERMANY | 2020 | Fine amount between EUR 50 and EUR 100 | Restaurant | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1049 |
| GERMANY | 2020 | Fine amount between EUR 50 and EUR 100 | Restaurant | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1048 |
| SPAIN | 2022-02-02 | 2,000 | ASESORES DE SEGURIDAD PRIVADA, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1047 |
| GERMANY | 2020 | 13,000 | Company | Art. 26 (2) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-1046 |
| GERMANY | 2020 | Unknown | Company | Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1045 |
| GERMANY | 2020 | 3,000 | Restaurant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1044 |
| GERMANY | 2020 | Fine amount between EUR 300 and EUR 400 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1043 |
| GERMANY | 2020 | Fine amount between EUR 300 and EUR 400 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1042 |
| GERMANY | 2020 | Fine amount between EUR 300 and EUR 400 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1041 |
| GERMANY | 2020 | Fine amount between EUR 400 and EUR 600 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1040 |
| GERMANY | 2020 | Fine amount between EUR 400 and EUR 600 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1039 |
| GERMANY | 2020 | Fine amount between EUR 400 and EUR 600 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1038 |
| GERMANY | 2020 | 400 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1037 |
| GERMANY | 2020 | 300 | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1036 |
| GERMANY | 2020 | 10,000 | Clearview AI Inc. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-1035 |
| GERMANY | 2020 | Fine in five-digit amount | Corporation | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1034 |
| GERMANY | 2020 | Fine in three-digit amount | Medical assistant | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1033 |
| GERMANY | 2020 | Fine in four-digit amount | Operator of a ballet school | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1032 |
| GERMANY | 2019-11 | 5,000 | Restaurant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1031 |
| GERMANY | 2020 | 300 | Employee at a Covid 19 testing center | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1030 |
| GERMANY | 2020 | 10,000 | Restaurant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1029 |
| GERMANY | 2020 | Unknown | Police officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1028 |
| ITALY | 2021-11-25 | 200,000 | Aimon Srl | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 12 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1027 |
| ITALY | 2021-11-25 | 400,000 | B&T S.p.A. | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1026 |
| GREECE | 2022-01-27 | 3,200,000 | OTE Group | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1025 |
| GREECE | 2022-01-27 | 6,000,000 | Cosmote Mobile Telecommunications S.A. | Art. 5 (1) a) GDPR, Art. 5 (2) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 25 (1) GDPR, Art. 26 GDPR, Art. 28 GDPR, Art. 35 (7) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1024 |
| BELGIUM | 2022-01-27 | 2,800 | EU DisinfoLab | Art. 5 (1) a), c), f) GDPR, Art. 6 (1) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 30 GDPR, Art. 32 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1023 |
| BELGIUM | 2022-01-27 | 1,200 | Researcher | Art. 5 (1) a), c), f) GDPR, Art. 6 (1) GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 14 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1022 |
| SPAIN | 2022-01-31 | 5,000 | INCOPROSOL, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1021 |
| SPAIN | 2022-01-31 | 5,000 | Cyrana España General S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1020 |
| SPAIN | 2022-01-31 | 1,500 | Property Owner Community | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1019 |
| ROMANIA | 2022-02-01 | 1,000 | SC Grupex 2000 SRL | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1018 |
| HUNGARY | 2021-12-03 | 843 | Lawyer | Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1017 |
| ITALY | 2021-12-16 | 20,000 | Corradi s.r.l. | Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 157 Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1016 |
| ITALY | 2021-12-16 | 10,000 | Centro di Medicina preventiva s.r.l. | Art. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 37 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1015 |
| SWEDEN | 2022-01-26 | 152,000 | Uppsala hospital board | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1014 |
| SWEDEN | 2022-01-26 | 28,500 | Uppsala regional board | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1013 |
| FINLAND | 2021-12-16 | 52,000 | Motor insurance center | Art. 5 (1) a), c) GDPR, Art. 25 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1012 |
| FINLAND | 2021-12-16 | 6,500 | Travel agency | Art. 5 (1) f) GDPR, Art. 17 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1011 |
| ITALY | 2021-12-02 | 5,000 | Azienda USL di Parma | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1010 |
| IRELAND | 2021-12-09 | 110,000 | Limerick City and County Council | Art. 13 GDPR, Art. 12 GPDR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1009 |
| SPAIN | 2022-01-21 | 1,200 | Property Owner Community | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1008 |
| SPAIN | 2022-01-21 | 2,000 | Website operator | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1007 |
| ROMANIA | 2022-01-20 | 3,000 | Kaufland România SCS | Art. 15 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-1006 |
| ITALY | 2021-12-16 | 0 | Enel Energia S.p.A | Art. 5 (1) a), d) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR, Art. 130 (1), (2), (4) Codice della privacy | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1005 |
| SPAIN | 2022-01-14 | 2,400 | PHARMA TALENTS, S.L.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-1004 |
| LUXEMBOURG | 2021-11-09 | 1,500 | Unknown | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1003 |
| SPAIN | 2022-01-18 | 15,000 | GARLEX SOLUTIONS, S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-1002 |
| LUXEMBOURG | 2021-12-01 | 6,800 | Unknown | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1001 |
| SPAIN | 2022-01-17 | 1,500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-1000 |
| SPAIN | 2022-01-17 | 2,000 | MEETING PUERTO C.B. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-999 |
| SPAIN | 2022-01-14 | 1,500 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-998 |
| SPAIN | 2022-01-18 | 56,000 | VODAFONE ESPAÑA, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-997 |
| MALTA | 2022-01-17 | 65,000 | C-Planet (IT Solutions) Limited | Art. 5 (1) f) GDPR, Art. 6 (1) GDPR, Art. 9 (1), (2) GDPR, Art. 14 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 34 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-996 |
| PORTUGAL | 2021-12-21 | 1,250,000 | Lisbon City Council | Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 9 (1) a) GDPR, Art. 13 (1), (2) GDPR, Art. 35 (3) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-995 |
| BELGIUM | 2021-12-16 | 75,000 | Bank | Art. 38 (6) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-994 |
| ITALY | 2021-11-25 | 6,000 | Società H San Raffaele Resnati s.r.l. | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-993 |
| ITALY | 2021-12-02 | 30,000 | Casa di cura Fondazione Gaetano e Piera Borghi s.r.l. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-992 |
| ITALY | 2021-12-02 | 7,000 | Società Med Store Saronno s.r.l. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-991 |
| GREECE | 2021-12-29 | 75,000 | Greek Ministry of Tourism | Art. 13 GDPR, Art. 32 GDPR, Art. 33 GDPR, Art. 37 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-990 |
| SPAIN | 2022-01-13 | 1,500 | Private individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-989 |
| AUSTRIA | 2022-01-14 | 8,000,000 | REWE International AG | Unknown | Unknown | https://www.enforcementtracker.com/ETid-988 |
| IRELAND | 2021-12-02 | 60,000 | Irish Teacher Council | Art. 5 (1) GDPR, Art. 32 (1) GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-987 |
| GREECE | 2021-12-31 | 30,000 | INFO COMMUNICATION SERVICES | Art. 13 GDPR, Art. 14 GDPR, Art. 11 Law 3471/2006 | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-986 |
| GREECE | 2021-12-31 | 25,000 | PLUS REAL ADVERTISEMENT | Art. 13 GDPR, Art. 14 GDPR, Art. 11 Law 3471/2006 | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-985 |
| POLAND | 2021-12-09 | 10,000 | Warsaw University of Technology | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-984 |
| SPAIN | 2022-01-11 | 9,000 | EDUCANDO JUNTOS SL | Art. 6 (1) GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-983 |
| SPAIN | 2022-01-11 | 3,000 | Property Owner Community | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-982 |
| GREECE | 2022-01-05 | 1,000 | Εγνατία Οδός Α.Ε. | Art. 12 (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-981 |
| FRANCE | 2021-12-31 | 60,000,000 | Facebook Ireland Ltd. | Art. 82 loi Informatique et Libertés | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-980 |
| FRANCE | 2021-12-31 | 60,000,000 | Google Ireland Ltd. | Art. 82 loi Informatique et Libertés | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-979 |
| FRANCE | 2021-12-31 | 90,000,000 | Google LLC | Art. 82 loi Informatique et Libertés | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-978 |
| ROMANIA | 2021-12-06 | 6,000 | Telekom Romania Communications SA | Art. 5 (1) d), f) GDPR, Art. 5 (2) GDPR, Art. 17 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-977 |
| ITALY | 2021-11-11 | 150,000 | TIM S.p.A. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-976 |
| ITALY | 2021-12-02 | 30,000 | Ica s.r.l. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-975 |
| NORWAY | 2021-12-13 | 20,000 | Elektro & Automasjon Systemer AS | Art. 6 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-974 |
| SPAIN | 2021-12-28 | 2,000 | Call shop manager | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-973 |
| FRANCE | 2021-12-28 | 300,000 | FREE MOBILE | Art. 12 GDPR, Art. 15 GDPR, Art. 21 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-972 |
| FRANCE | 2021-12-28 | 180,000 | SLIMPAY | Art. 28 GDPR, Art. 32 GDPR, Art. 34 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-971 |
| SPAIN | 2021-12-28 | 6,000 | REAL CLUB NÁUTICO DE RIBADEO | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-970 |
| SPAIN | 2021-12-28 | 2,000 | VENTANAS MAKE YOURSELF, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-969 |
| SPAIN | 2021-12-16 | 60,000 | Banco Bilbao Vizcaya Argentaria S.A. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-968 |
| SPAIN | 2021-12-22 | 5,000 | HUBSIDE IBÉRICA S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-967 |
| SPAIN | 2021-12-22 | 5,000 | Sfam España General s.l. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-966 |
| SPAIN | 2021-12-21 | 6,000 | Private individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-965 |
| SPAIN | 2021-12-23 | 1,500 | LA OFICINA BAR | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-964 |
| SPAIN | 2021-12-17 | 4,000 | CLUB DEPORTIVO RITMO DE ANDALUCÍA | Art. 7 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-963 |
| SPAIN | 2021-12-21 | 2,000 | FUNDACION ESPANOLA DE MEDICINA ESTETICA Y LONGEVIDAD | Art. 7 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-962 |
| AUSTRIA | 2021-08-05 | 600 | Private individual | Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-961 |
| NORWAY | 2021-12-17 | 3,900 | T. Stene Transport AS | Unknown | Unknown | https://www.enforcementtracker.com/ETid-960 |
| SPAIN | 2021-12-17 | 2,000 | Online retailer | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-959 |
| SPAIN | 2021-12-17 | 2,000 | Private individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-958 |
| GREECE | 2021-12-08 | 30,000 | One Way Private Company | Art. 28 (3) c) GDPR, Art. 32 (2), (4) GDPR, Art. 11 (1) Νόμος 3471/2006 | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-957 |
| SPAIN | 2021-12-14 | 50,000 | IZA OBRAS Y PROMOCIONES, S.A. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-956 |
| HUNGARY | 2021-10-27 | 13,500 | Car importer | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-955 |
| DENMARK | 2021-12-16 | 13,450 | Municipality of Frederiksberg | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-954 |
| SPAIN | 2021-12-16 | 1,200 | Private individual | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-953 |
| FINLAND | 2021-12-07 | 608,000 | Psykoterapiakeskus Vastaamo | Art. 5 (1) f) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-952 |
| AUSTRIA | 2021-02-12 | 3,000 | Unknown | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-951 |
| NORWAY | 2021-12-13 | 6,300,000 | Grindr LLC | Art. 6 (1) GDPR, Art. 9 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-950 |
| ROMANIA | 2021-12-13 | 2,000 | SC Nobiotic Pharma SRL | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-949 |
| NORWAY | 2021-11-24 | 98,000 | Norwegian State Pension Fund (SPK) | Art. 5 (1) c), e) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-948 |
| BELGIUM | 2021-12-08 | 10,000 | Unknown | Art. 12 (3) GDPR, Art. 14 (1), (2), (3) GDPR, Art. 15 GDPR, Art. 17 (1) c) GDPR, Art. 21 (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-947 |
| THE NETHERLANDS | 2021-11-25 | 2,750,000 | Dutch Minister of Finance | Art. 5 (1) a) GDPR, Art. 6 (1) e) GDPR, Art. 8 Wbp | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-946 |
| SPAIN | 2021-12-07 | 24,000 | NBQ Technology, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-945 |
| SPAIN | 2021-12-03 | 1,000 | Store owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-944 |
| GERMANY | 2019 | Fine amount between EUR 350 and EUR 1000 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-943 |
| GERMANY | 2019 | Fine amount between EUR 50 and EUR 800 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-942 |
| GERMANY | 2019 | 500 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-941 |
| GERMANY | Unknown | 600 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-940 |
| GERMANY | Unknown | 300 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-939 |
| GERMANY | Unknown | 50 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-938 |
| SPAIN | 2021-11-02 | 2,000 | COOPERA RC SERVICES, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-937 |
| SPAIN | 2021-11-23 | 40,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-936 |
| SPAIN | 2021-11-23 | 40,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-935 |
| SPAIN | 2021-12-02 | 2,000 | IMAGINA FRAN SPORT, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-934 |
| SPAIN | 2021-12-01 | 5,000 | INTRODUCTION BUSINESS CAPITAL MEDIA, S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-933 |
| ITALY | 2021-10-14 | 8,000 | Health Protection Agency of Sardinia (ATS) | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-932 |
| ITALY | 2021-09-29 | 2,000 | Physician | Art. 5 (1) a) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-931 |
| UNITED KINGDOM | 2021-11-25 | 585,000 | Cabinet Office | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-930 |
| ITALY | 2021-10-28 | 2,000 | Anfiteatro Flavio s.r.l. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-929 |
| ITALY | 2021-10-28 | 2,000 | OTTO s.r.l. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-928 |
| LITHUANIA | 2021-11-29 | 110,000 | UAB Prime Leasing | Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-927 |
| SPAIN | 2021-11-30 | 5,000 | ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE | Art. 17 (1) GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-926 |
| SPAIN | 2021-11-30 | 20,000 | DAVISER SERVICIOS, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-925 |
| SPAIN | 2021-11-30 | 5,000 | ASOCIACIÓN ESPAÑOLA PARA LA ENSEÑANZA ONLINE | Art. 17 (1) GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-924 |
| SPAIN | 2021-11-30 | 1,500 | Neighborhood community | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-923 |
| SPAIN | 2021-11-29 | 1,000 | Restaurant owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-922 |
| SPAIN | 2021-11-29 | 4,000 | TIGERS MARKET, S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-921 |
| LUXEMBOURG | 2021-10-27 | 15,400 | Unknown | Art. 38 (1), (3) GDPR, Art. 39 (1) a), b) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-920 |
| GREECE | 2021-10-14 | 20,000 | ΚΑΠΑ ΛΑΜΔΑ ΩΜΕΓΑ ΔΙΑΦΗΜΙΣΤΙΚΗ ΕΜΠΟΡΙΚΗ ΜΟΝΟΠΡΟΣΩΠΗ ΕΤΑΙΡΕΙΑ ΠΕΡΙΟΡΙΣΜΕΝΗΣ ΕΥΘΥΝΗΣ | Art. 6 GDPR, Art. 12 (2) GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-919 |
| SPAIN | 2021-11-24 | 9,000 | UNIÓN FINANCIERA ASTURIANA S.A. E.F.C. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-918 |
| ICELAND | 2021-11-23 | 27,200 | YAY ehf. | Art. 5 GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-917 |
| ICELAND | 2021-11-23 | 51,000 | Icelandic Ministry of Industry and Innovation | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-916 |
| ROMANIA | 2021-11-26 | 2,000 | Valoris Center S.R.L. | Art. 29 GDPR, Art. 32 (1) b) GDPR, Art. 32 (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-915 |
| SPAIN | 2021-11-23 | 40,000 | Vodafone España, SAU | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-914 |
| SPAIN | 2021-11-23 | 3,000 | FUENSANTA S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-913 |
| SPAIN | 2021-11-22 | 2,000 | ANIVERSALIA NETWORKS, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-912 |
| SPAIN | 2021-11-22 | 3,000 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-911 |
| FRANCE | 2021-11-04 | 400,000 | Régie autonome des transports parisiens | Art. 5 (1) c) GDPR, Art. 5 (1) e) GDPR, Art. 5 (2) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-910 |
| CYPRUS | 2021-11-12 | 925,000 | WS WiSpear Systems Ltd | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-909 |
| SPAIN | 2021-11-15 | 40,000 | Vodafone España, SAU | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-908 |
| SPAIN | 2021-11-22 | 1,000 | Neighborhood community | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-907 |
| BULGARIA | 2021-10-26 | 380 | Bank | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-906 |
| SPAIN | 2021-11-15 | 30,000 | Vodafone España, SAU | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-905 |
| SPAIN | 2021-11-15 | 1,000 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-904 |
| SPAIN | 2021-11-15 | 1,000 | Supermarket | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-903 |
| THE NETHERLANDS | 2021-11-12 | 400,000 | Transavia | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-902 |
| POLAND | 2021-10-14 | 78,000 | Bank Millennium S.A | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-901 |
| SPAIN | 2021-11-12 | 3,000 | AD735 DATA MEDIA ADVERTISING S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-900 |
| SPAIN | 2021-11-12 | 1,500 | Company | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-899 |
| ROMANIA | 2021-11-14 | 2,900 | Vodafone România SA | Art. 32 (1) b) GDPR, Art. 32 (2) GDPR, Art. 3 (1) Law No. 506/2004, Art. 3 (3) a), b) Law No. 506/2004 | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-898 |
| GREECE | 2021-10-04 | 5,000 | PREMIUMMEDIA ΠΑΡΑΓΩΓΗ ΟΠΤΙΚΟ-ΑΚΟΥΣΤΙΚΩΝ ΕΡΓΩΝ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΙΑ | Art. 21 (3) GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-897 |
| LUXEMBOURG | 2021-10-13 | 18,000 | Unknown | Art. 37 (7) GDPR, Art. 38 (1), (2) GDPR, Art. 39 (1) b) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-896 |
| LUXEMBOURG | 2021-10-13 | 13,200 | Unknown | Art. 38 (1) GDPR, Art. 39 (1) b) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-895 |
| LUXEMBOURG | 2021-10-06 | 5,300 | Unknown | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-894 |
| IRELAND | 2021-08-20 | 1,500 | MOVE Ireland | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-893 |
| ITALY | 2021-09-16 | 5,000 | Comune di Montalbano Jonico | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 9 (1), (2), (4) GDPR, Art. 2-ter (1), (3) Codice della privacy, Art. 2-septies (8) Codice della privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-892 |
| ROMANIA | 2021-11-01 | 5,000 | S.P.E.E.H. Hidroelectrica S.A. | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-891 |
| ROMANIA | 2021-11-01 | 1,000 | IKEA ROMÂNIA SA | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-890 |
| SPAIN | 2021-10-26 | 40,000 | VODAFONE SERVICIOS, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-889 |
| SPAIN | 2021-10-26 | 40,000 | VODAFONE SERVICIOS, S.L.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-888 |
| SPAIN | 2021-10-26 | 16,000 | SERVICIOS LOGÍSTICOS MARTORELL SIGLO XXI, S.L. | Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-887 |
| SPAIN | 2021-10-26 | 64,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-886 |
| SPAIN | 2021-10-25 | 3,000 | MERCEDES GERENCIA, S.L. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-885 |
| SPAIN | 2021-10-21 | 3,000,000 | CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-884 |
| UNITED KINGDOM | 2021-10-18 | 11,800 | HIV Scotland | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-883 |
| SPAIN | 2021-10-19 | 2,000 | BEEPING FULFILMENT S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-882 |
| SPAIN | 2021-10-19 | 40,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-881 |
| ROMANIA | 2021-10-21 | 5,000 | Glove Technology SRL | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-880 |
| SPAIN | 2021-10-19 | 70,000 | Vodafone España, S.A.U. | Art. 21 GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-879 |
| NORWAY | 2021-10-18 | 412,000 | Østre Toten municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-878 |
| ITALY | 2021-09-16 | 3,296,326 | Sky Italia S.r.l. | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR, Art. 12 (2) GDPR, Art. 14 GDPR, Art. 21 GDPR, Art. 28 GDPR, Art. 29 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-877 |
| ITALY | 2021-09-16 | 200,000 | Bocconi University | Art. 5 (1) a), c), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 35 GDPR, Art. 44 GDPR, Art. 46 GDPR, Art. Art. 2-sexies Codice della Privacy | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-876 |
| IRELAND | 2021-10-06 | Only intention to issue fine | Facebook Ireland Limited | Art. 5 (1) a) GDPR, Art. 12 (1) GDPR, Art. 13 (1) c) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-875 |
| ITALY | 2021-09-16 | 5,000 | Ciechi Ardizzone Gioeni di Catania | Art. 5 (1) a), c) GDPR, Art. 12 (1) GDPR, Art. 13 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-874 |
| AUSTRIA | 2021 | 700,000 | Customer loyalty program | Unknown | Unknown | https://www.enforcementtracker.com/ETid-873 |
| AUSTRIA | 2021 | 4,000,000 | Bank | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-872 |
| AUSTRIA | 2021-09-28 | 9,500,000 | Austrian Post | Art. 12 (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-871 |
| SPAIN | 2021-10-13 | 40,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-870 |
| ITALY | 2021-09-16 | 5,000 | La Prima S.r.l. | Art. 5 GDPR, Art. 6 GDPR, Art. 24 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-869 |
| SPAIN | 2021-10-11 | 10,000 | MAF.COM ESQUI CLUB | Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-868 |
| SPAIN | 2021-10-08 | 30,000 | ORANGE ESPAGNE, S.A.U. | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-867 |
| LUXEMBOURG | 2021-08-05 | 135,000 | Insurance company | Art. 5 (1) f) GDPR, Art. 32 (1) a), b) GDPR, Art. 33 (1), (5) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-866 |
| SPAIN | 2021-10-05 | 4,000 | CLUB DEPORTIVO SANSUEÑA, S.L. | Art. 5 (1) e) GDPR, Art. 6 GDPR, Art. 32 (1) b), d) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-865 |
| SPAIN | 2021-10-04 | 5,000 | CALDERERIA Y SOLDADURA DE ESTRUCTURAS METALICAS, S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-864 |
| NORWAY | 2021-09-21 | 12,500 | Ultra-Technology AS | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-863 |
| SPAIN | 2021-10-04 | 1,000 | Store owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-862 |
| SPAIN | 2021-10-04 | 2,000 | Store owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-861 |
| SPAIN | 2021-09-04 | 1,500 | AMPUDIA DIAZ, S.L. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-860 |
| NORWAY | 2021-09-20 | 75,600 | ST. OLAVS HOSPITAL HF | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-859 |
| NORWAY | 2021-09-20 | 40,200 | Høylandet Municipality | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-858 |
| DENMARK | 2021-09-29 | 107,000 | Danish Cancer Society | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-857 |
| SPAIN | 2021-09-29 | 10,000 | ACONCAGUA JUEGOS S.A. | Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-856 |
| SPAIN | 2021-09-29 | 5,000 | CYNGASA, S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-855 |
| SPAIN | 2021-09-28 | 3,000 | Bar owner | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-854 |
| SPAIN | 2021-09-14 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-853 |
| SPAIN | 2021-09-14 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-852 |
| NORWAY | 2021-09-27 | 496,000 | Ferde AS | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 28 (3) GDPR, Art. 32 (2) GDPR, Art. 44 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-851 |
| SPAIN | 2021-09-14 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-850 |
| SPAIN | 2021-09-14 | 56,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-849 |
| SPAIN | 2021-09-24 | 3,000 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-848 |
| ISLE OF MAN | 2020-12-11 | 3,250 | Cosmetic Medical Limited | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-847 |
| GERMANY | 2021-09-24 | 900,000 | Vattenfall Europe Sales GmbH | Art. 12 GDPR, Art. 13 GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-846 |
| SPAIN | 2021-09-14 | 40,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-845 |
| SPAIN | 2021-09-20 | 18,000 | CEDICO, CENTRO DE DIAGNÓSTICO POR LA IMÁGEN, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-844 |
| GREECE | 2021-08-26 | 5,000 | NOW DOCTOR – Εταιρία Παροχής Ηλεκτρονικών Υπηρεσιών Αναζήτησης και Προβολής Ιατρών Ε.Π.Ε. | Art. 5 (1) a), e) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3) GDPR, Art. 17 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-843 |
| GREECE | 2021-09-03 | 8,000 | Rhodes Municipal Transport Company | Art. 5 (1) c) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-842 |
| GREECE | 2021-08-26 | 20,000 | National Bank of Greece | Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-841 |
| GREECE | 2021-08-26 | 20,000 | Dixons South East Europe ΑΕΒΕ-ΚΩΤΣΟΒΟΛΟΣ | Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-840 |
| DENMARK | 2021-09-17 | 67,200 | Syddanmark Region | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-839 |
| SPAIN | 2021-09-16 | 4,000 | Frigorifica Botana S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-838 |
| FRANCE | 2021-09-15 | 3,000 | Société nouvelle de l’annuaire français | Art. 16 GDPR, Art. 17 GDPR, Art. 30 GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-837 |
| DENMARK | 2021-09-16 | 10,000 | Favrskov municipality | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-836 |
| SPAIN | 2021-09-13 | 9,000 | Website operator | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-835 |
| SPAIN | 2021-09-13 | 1,000 | Hairdressing salon | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-834 |
| SPAIN | 2021-09-13 | 1,000 | GESTIONES AUTO LOW COST S. L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-833 |
| CYPRUS | 2021-09-06 | 25,000 | Hellenic Technical Enterprises Ltd. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-832 |
| CYPRUS | 2021-09-06 | 40,000 | AC Omonia | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-831 |
| CYPRUS | 2021-09-06 | 40,000 | APOEL FC | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-830 |
| ITALY | 2021-07-22 | 400,000 | Atac s.p.a. | Art. 5 GDPR, Art. 6 GDPR, Art. 30 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-829 |
| ITALY | 2021-07-22 | 30,000 | Flowbird Italia s.r.l. | Art. 5 GDPR, Art. 6 GDPR, Art. 30 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-828 |
| ITALY | 2021-07-22 | 800,000 | Roma Capitale | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 28 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-827 |
| ITALY | 2021-07-22 | 200,000 | Regione Lombardia | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-826 |
| IRELAND | 2021-09-07 | 1,400 | Vodafone Ireland Limited | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-825 |
| DENMARK | 2021-09-08 | 53,800 | Midtjylland Region | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-824 |
| SPAIN | 2021-09-02 | 4,000 | Automecanica Jerez, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR, Art. 21 LSSI | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-823 |
| SPAIN | 2021-08-23 | 1,800 | Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-822 |
| SPAIN | 2021-08-30 | 6,000 | Furnishyourspace S.L. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 (4) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-821 |
| IRELAND | 2021-09-02 | 225,000,000 | WhatsApp Ireland Ltd. | Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-820 |
| SPAIN | 2021-08-25 | 120,000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-819 |
| SPAIN | 2021-08-26 | 1,000 | Owners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-818 |
| POLAND | 2021-08-13 | 2,200 | President of the Zgierz District Court | Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-817 |
| ROMANIA | 2021-08-24 | 3,000 | Actamedica SRL | Art. 28 (1) GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-816 |
| SPAIN | 2021-08-23 | 2,000 | Company owner | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-815 |
| SPAIN | 2021-08-13 | 1,000 | Employer | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-814 |
| HUNGARY | 2021-06-18 | 28,400 | Magyar Telekom Nyrt. | Art. 5 (1) d) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3), (4) GDPR, Art. 17 (1) GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-813 |
| HUNGARY | 2021-04-20 | 2,800 | Website operator | Art. 5 (2) GDPR, Art. 24 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-812 |
| SPAIN | 2021-08-03 | 96,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-811 |
| SPAIN | 2021-08-10 | 2,000 | DESPACHO TEJEDOR INFANTES CONSULTORES ASESORES | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-810 |
| NORWAY | 2021-08-12 | 9,600 | Waxing Palace AS | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-809 |
| ITALY | 2021-06-10 | 40,000 | aiComply S.r.l. | Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-808 |
| ITALY | 2021-06-10 | 40,000 | Aeroporto Guglielmo Marconi di Bologna S.p.a. | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-807 |
| SPAIN | 2021-08-05 | 6,000 | Future Vinline S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-806 |
| SPAIN | 2021-08-09 | 5,000 | CLUB GIMNASIA RÍTMICA SAN ANTONIO | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-805 |
| SPAIN | 2021-08-09 | 1,000 | BAZTANDIS, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-804 |
| SPAIN | 2021-07-30 | 4,000 | Gas inspector | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-803 |
| SPAIN | 2021-07-30 | 2,000 | Private Individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-802 |
| SPAIN | 2021-07-30 | 600 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-801 |
| SPAIN | 2021-07-27 | 4,000 | Private Individual | Art. 5 (1) c), e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-800 |
| SPAIN | 2021-07-27 | 3,000 | INSTAPACK, S.L. | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-799 |
| SPAIN | 2021-07-27 | 3,000 | UST GLOBAL ESPAÑA, S.A. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-798 |
| SPAIN | 2021-08-05 | 3,000 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-797 |
| SPAIN | 2021-07-27 | 1,000 | APARTAMENTOS PLAYA DE COVACHOS, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-796 |
| SPAIN | 2021-07-27 | 2,000 | Vasco Andaluza de Inversiones S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-795 |
| SPAIN | 2021-07-27 | 2,000 | Gerco Fit S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-794 |
| SPAIN | 2021-07-27 | 2,000 | Body Tonic Shop S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-793 |
| AUSTRIA | 2021-08-02 | 500,000 | Unser Ö-Bonus Club GmbH | Art. 6 GDPR, Art. 7 GDPR, Art. 12 GPDR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-792 |
| GERMANY | 2020 | 65,000 | Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-791 |
| ITALY | 2021-07-22 | 2,500,000 | Deliveroo Italy s.r.l. | Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 22 (3) GDPR, Art. 25 GDPR, Art. 30 (1) c), f), g) GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 37 (7) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-790 |
| SPAIN | 2021-08-02 | 3,000 | Club Náutico el Estacio | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-789 |
| SPAIN | 2021-07-27 | 60,000 | PRA Iberia S.L. | Art. 6 (1) GDPR, Art. 15 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-788 |
| ROMANIA | 2021-07-30 | 200 | Private Individual | Art. 5 (1) a), b), (2) GDPR, Art. 6 (1) GDPR, Art. 14 (1), (4) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-787 |
| FINLAND | 2021-07-05 | 25,000 | Higher Education Institution | Art. 5 (1) c) GDPR, Art. 6 GDPR, § 3 Law 759/2004 | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-786 |
| SPAIN | 2021-07-27 | 2,000 | Owners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-785 |
| SPAIN | 2021-07-27 | 900 | Owners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-784 |
| SPAIN | 2021-07-27 | 2,400 | PODEMOS PARTIDO POLÍTICO | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-783 |
| SPAIN | 2021-07-27 | 10,000 | PERSONAL MARK, S.L. | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-782 |
| SPAIN | 2021-07-27 | 1,000 | NEXTSTEPAGENCY, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-781 |
| SPAIN | 2021-07-27 | 500 | Website operator | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-780 |
| SPAIN | 2021-07-29 | 3,000 | UNIVERSIDAD A DISTANCIA DE MADRID, S.A. | Art. 17 (1) GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-779 |
| LUXEMBOURG | 2021-07-16 | 746,000,000 | Amazon Europe Core S.à.r.l. | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-778 |
| SPAIN | 2021-07-26 | 2,520,000 | Mercadona S.A. | Art. 5 (1) c) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 (1) GDPR, Art. 35 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-777 |
| FRANCE | 2021-07-26 | 400,000 | Monsanto Company | Art. 14 GDPR, Art. 28 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-776 |
| SPAIN | 2021-07-26 | 2,000 | Fincas Miguel García S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-775 |
| SPAIN | 2021-07-26 | 2,000 | Intersumi S.C. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-774 |
| ITALY | 2021-05-27 | 150,000 | Azienda Provinciale per i Servizi Sanitari di Trento | Art. 5 (1) a), f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-773 |
| ITALY | 2021-05-27 | 120,000 | Azienda Usl della Romagna | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-772 |
| FRANCE | 2021-07-20 | 1,750,000 | SGAM AG2R LA MONDIALE | Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-771 |
| THE NETHERLANDS | 2021-04-09 | 750,000 | TikTok | Art. 12 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-770 |
| POLAND | 2021-06-30 | 3,000 | Fundację Promocji Mediacji i Edukacji Prawnej Lex Nostra | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-769 |
| SPAIN | 2021-07-12 | 45,000 | Telefónica Móviles España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-768 |
| GREECE | 2021-07-08 | 5,000 | Pediatrician | Art. 12 (1) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-767 |
| SPAIN | 2021-07-01 | 6,000 | Private Individual | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-766 |
| SPAIN | 2021-07-01 | 1,000 | Unknown | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-765 |
| SPAIN | 2021-07-07 | 2,000 | Homeowners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-764 |
| SPAIN | 2021-07-02 | 1,500 | Private Individual | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-763 |
| SPAIN | 2021-07-06 | 4,200 | Marbella Resorts S.L. | Art. 28 (3) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-762 |
| SPAIN | 2021-07-09 | 1,500 | Aparcamiento Arcusa S.L.U. | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-761 |
| LUXEMBOURG | 2021-06-29 | 12,500 | Unknown | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-760 |
| DENMARK | 2021-07-16 | 67,900 | Region of Syddanmark | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-759 |
| GERMANY | 2020 | 7,000 | Unknown | Art. 58 (1) f) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-758 |
| DENMARK | 2021-07-09 | 80,700 | Medicals Nordic I/S | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-757 |
| CROATIA | 2021-07-05 | Unknown | Insurance company | Art. 13 GDPR, Art. 14 GDPR, Art 27 (1) of the National Implementation Law | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-756 |
| SPAIN | 2021-07-08 | 4,000 | Malagatrom S.L.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-755 |
| SPAIN | 2021-07-08 | 50,000 | Caixabank S.A. | Art. 6 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-754 |
| LUXEMBOURG | 2021-06-11 | 15,000 | Unknown | Art. 38 (1), (3) GDPR, Art. 39 (1) a), b) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-753 |
| UNITED KINGDOM | 2021-07-05 | 29,000 | Mermaids | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-752 |
| THE NETHERLANDS | 2021-05-31 | 450,000 | UWV (Dutch employee insurance service provider) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-751 |
| ITALY | 2021-06-10 | 20,000 | Dentist | Art. 5 (1) a), c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-750 |
| LUXEMBOURG | 2021-06-11 | 7,600 | Unknown | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-749 |
| LUXEMBOURG | 2021-06-11 | 7,200 | Unknown | Art. 5 (1) c), e) GDPR, Art. 13 GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-748 |
| ITALY | 2021-05-13 | 84,000 | Comune di Bolzano | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 13 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-747 |
| DENMARK | 2021-07-07 | 53,800 | Nordbornholms Byggeforretning Aps | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-746 |
| CROATIA | 2021-07-05 | Unknown | IT services company | Art. 32 (1) b), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-745 |
| FINLAND | 2021-06-24 | 8,500 | Magazine publisher | Art. 5 (1) a) GDPR, Art. 7 (2), (4) GDPR, Art. 12 (2) GDPR, Art. 21 (2) GDPR, Art. 24 (1) GDPR, Art. 28 (1), (3) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-744 |
| ITALY | 2021-06-10 | 2,600,000 | Foodinho s.r.l. | Art. 5 (1) a), c), e) GDPR, Art. 13 GDPR, Art. 22 (3) GDPR, Art. 25 GDPR, Art. 30 (1) a), b), c), f), g) GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 37 (7) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-743 |
| LUXEMBOURG | 2021-04-08 | 2,800 | Unknown | Art. 5 (1) e) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-742 |
| POLAND | 2021-06-21 | 35,300 | Sopockie Towarzystwo Ubezpieczeń ERGO Hestia S.A. | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-741 |
| ICELAND | 2021-06-15 | 34,000 | Huppuís ehf | Art. 5 (1) a), c) GDPR, Art. 6 (1) GDPR, Art. 12 (1) GDPR, Art. 13 (1), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-740 |
| LITHUANIA | 2020 | 8,000 | Unknown | Art. 5 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-739 |
| NORWAY | 2021-06-04 | 49,200 | Moss municipality | Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-738 |
| ITALY | 2021-05-13 | 2,856,169 | Iren Mercato S.p.A. | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-737 |
| SPAIN | 2021-06-22 | 10,000 | TNT EXPRESS WORLDWIDE SPAIN, S.L. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-736 |
| NORWAY | 2021-06-22 | 24,800 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-735 |
| FRANCE | 2021-06-14 | 500,000 | BRICO PRIVÉ | Art. 5 (1) e) GDPR, Art. 13 GDPR, Art. 17 GDPR, Art. 32 GDPR, Art. 82 Loi informatique et libertés, Art. L. 34-5 CPCE | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-734 |
| SWEDEN | 2021-06-21 | 1,600,000 | Storstockholms Lokaltrafik | Art. 5 (1) a), c) GDPR, Art. 6 (1) f) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-733 |
| LITHUANIA | 2021-06-21 | 20,000 | UAB VS FITNESS | Art. 5 (1) a), c) GDPR, Art. 9 (1) GDPR, Art. 13 (1), (2) GDPR, Art. 30 GDPR, Art. 35 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-732 |
| GREECE | 2021-06-03 | 15,000 | PURPLE SEA MΟΝΟΠΡΟΣΩΠΗ ΙΚΕ | Art. 5 (1) a), b) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-731 |
| DENMARK | 2021-06-16 | 27,000 | Vejle Municipality | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-730 |
| POLAND | 2021-03-19 | 4,900 | Funeda Sp. z o.o. | Art. 31 GDPR, Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-729 |
| ROMANIA | 2021-06-09 | 2,000 | La Santrade S.R.L. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-728 |
| SPAIN | 2021-06-14 | 1,200 | Inmopiso Zaragoza S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-727 |
| LUXEMBOURG | 2021-05-31 | 18,000 | Unknown | Art. 38 (1), (2) GDPR, Art. 39 (1) a) GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-726 |
| THE NETHERLANDS | 2021-02-04 | 12,000 | Orthodontic Clinic | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-725 |
| LIECHTENSTEIN | 2020 | 4,100 | Unknown | Unknown | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-724 |
| NORWAY | 2021-05-28 | 39,700 | BRAbank ASA | Art. 24 GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-723 |
| SWEDEN | 2021-06-09 | 34,800 | Directorate of the Östra Skaraborg Rescue Service | Art. 5 (1) a), c) GDPR, Art. 32 (1), (4) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-722 |
| POLAND | 2021-04-27 | 5,050 | PNP S.A. | Art. 31 GDPR, Art. 58 (1) e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-721 |
| ROMANIA | 2021-06-09 | 2,000 | S.C. Dreamtime Call S.R.L. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-720 |
| SWEDEN | 2021-06-07 | 64,500 | Voice Integrate Nordic AB | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-719 |
| SWEDEN | 2021-06-07 | 1,200,000 | MedHelp AB | Art. 5 (1) a), f) GDPR, Art. 6 GDPR, Art. 9 (1) GDPR, Art. 13 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-718 |
| SWEDEN | 2021-06-07 | 50,000 | Region Stockholm | Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-717 |
| SWEDEN | 2021-06-07 | 25,000 | Region Värmland | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-716 |
| SWEDEN | 2021-06-07 | 25,000 | Region Sörmland | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-715 |
| LUXEMBOURG | 2021-05-12 | 1,000 | Unknown | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-714 |
| LUXEMBOURG | 2021-05-12 | 2,600 | Unknown | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-713 |
| LUXEMBOURG | 2021-05-12 | 2,400 | Unknown | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-712 |
| LUXEMBOURG | 2021-05-12 | 1,900 | Unknown | Art. 5 (1) c), e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-711 |
| SPAIN | 2021-06-07 | 19,600 | Radiotelevisión del principado de Asturias | Art. 5 (1) c) GDPR, Art. 12 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-710 |
| SPAIN | 2021-06-07 | 20,000 | Master Distancia S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-709 |
| SPAIN | 2021-06-04 | 6,000 | Creator Energy S.L. | Art. 6 (1) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-708 |
| ITALY | 2021-04-15 | 12,000 | Istituto Nazionale Previdenza Sociale (INPS) | Art. 5 (1) a) GDPR, Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-707 |
| SPAIN | 2021-06-02 | 4,000 | Avalos Consultores, S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-706 |
| SPAIN | 2021-05-21 | 45,000 | Telefónica de España, S.A.U | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-705 |
| ITALY | 2021-04-21 | 15,000 | Fondazione Policlinico Tor Vergata di Roma | Art. 5 (1) a), f) GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-704 |
| GREECE | 2021-05-12 | 5,000 | KARIERA A.E. | Art. 17 GDPR, Art. 21 GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-703 |
| SPAIN | 2021-05-21 | 3,000 | Homeowners Association | Art. 5 (1) c) GDPR, Art. 12 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-702 |
| SPAIN | 2021-05-27 | 2,000 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-701 |
| NORWAY | 2021-05-18 | 95,500 | Innovasjon Norge | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-700 |
| GREECE | 2021-05-17 | 10,000 | Municipal Organization for Pre-School Education and Social Solidarity (DOPAKA) of the municipality of Tavros Moschato | Art. 6 (1) c) GDPR, Art. 12 (3), (4) GDPR, Art. 17 (1) d) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-699 |
| ITALY | 2021-03-25 | 7,000 | TECNOMEDICAL S.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-698 |
| SPAIN | 2021-05-26 | 3,000 | Vodafone España, S.A.U. | Art. 58 (1) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-697 |
| SPAIN | 2021-05-25 | 6,000 | Desolasol Restauración, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-696 |
| SPAIN | 2021-05-25 | 4,000 | Alava Norte, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-695 |
| SPAIN | 2021-05-25 | 100,000 | Vodafone España, SAU | Art. 28 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-694 |
| HUNGARY | 2021-04-27 | 570 | Company | Art. 5 (1) a), (2) GDPR, Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-693 |
| HUNGARY | 2021-04-27 | 1,400 | Company | Art. 5 (1), (2) GDPR, Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-692 |
| SPAIN | 2021-05-25 | 900 | Managing Director of a company | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-691 |
| SPAIN | 2021-05-21 | 3,000 | Physician | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-690 |
| IRELAND | 2021-03-23 | 90,000 | Irish Credit Bureau DAC | Art. 5 (2) GDPR, Art. 24 (1) GDPR, Art. 25 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-689 |
| NORWAY | 2021-05-20 | 39,000 | Municipality of Oslo | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-688 |
| THE NETHERLANDS | 2020-03-24 | 15,000 | CP&A | Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-687 |
| ITALY | 2021-04-15 | 40,000 | Comune di Palermo | Art. 5 (1) f) GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-686 |
| ROMANIA | 2021-05-19 | 2,000 | Banca Comercială Română S.A. | Art. 5 (1) a), d), (2) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-685 |
| ROMANIA | 2021-05-19 | 500 | Owners Association of Iasi Municipality | Art. 58 (1) a), e) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-684 |
| ITALY | 2021-04-15 | 5,000 | Physician | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-683 |
| ITALY | 2021-04-15 | 2,000 | Società triveneta di chirurgia | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-682 |
| POLAND | 2021-04-22 | 245,000 | Cyfrowy Polsat S.A. | Art. 24 (1) GDPR, Art. 32 (1), (2) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-681 |
| GREECE | 2021-05-12 | 5,000 | A. ΕΠΙΛΟΓΗ ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ | Art. 5 (1) a), b) GDPR, Art. 12 (3) GDPR, Art. 15 GDPR, Art. 17 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-680 |
| HUNGARY | 2021-03-25 | 1,425 | Operator of a care facility | Art. 5 (1) a), b), c) GDPR, Art. 6 GDPR, Art. 13 (1), (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-679 |
| THE NETHERLANDS | 2020-12-20 | 525,000 | Locatefamily.com | Art. 27 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-678 |
| SPAIN | 2021-05-14 | 30,000 | Allianz Compañia de Seguros y Reaseguros, S.A. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-677 |
| ROMANIA | 2021-05-13 | 2,000 | Telekom Romania Communications SA | Art. 6 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-676 |
| ROMANIA | 2021-05-14 | 200 | Website operator | Art. 5 (1) a), b), (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1), (2), (3) GDPR, Art. 32 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-675 |
| ITALY | 2021-03-25 | 4,000 | Comune di Castellanza | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-674 |
| SPAIN | 2021-05-12 | 3,000 | Solram T Y R S.L. | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-673 |
| THE NETHERLANDS | 2020-06-16 | 7,500 | PVV Overijssel | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-672 |
| SPAIN | 2021-05-04 | 1,500,000 | EDP Energía, S.A.U | Art. 13 GDPR, Art. 25 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-671 |
| SPAIN | 2021-05-04 | 1,500,000 | EDP Comercializadora, S.A.U. | Art. 13 GDPR, Art. 25 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-670 |
| ICELAND | 2021-04-29 | 23,100 | InfoMentor ehf | Art. 32 (1) b), d) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-669 |
| ROMANIA | 2021-05-07 | 2,000 | World Class România S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-668 |
| NORWAY | 2021-05-05 | Only intention to issue fine | Disqus Inc. | Art. 5 (1), (2) GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-667 |
| HUNGARY | 2021-03-24 | 27,700 | Budapest Főváros Kormányhivatala XI. kerületi Hivatalát (11th District Public Health Department of the Government Office of the Capital City Budapest) | Art. 32 (1) a), b) GDPR, Art. 32 (2) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-666 |
| FINLAND | 2021-04-21 | 75,000 | ParkkiPate Oy | Art. 5 (1) c) GDPR, Art. 12 (3), (4), (6) GDPR, Art. 14 (2) a) GDPR, Art. 14 (3) GDPR, Art. 15 GDPR, Art. 17 (1) a) GDPR, Art. 25 (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-665 |
| BELGIUM | 2021-04-26 | 100,000 | Financial company | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-664 |
| ITALY | 2021-03-25 | 20,000 | GEDI News Network Spa | Art. 12 (3), (4) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-663 |
| ITALY | 2021-03-25 | 30,000 | OneDirect Srl | Art. 6 (1) GDPR, Art. 7 (1) GDPR, Art. 30 GDPR, Art. 31 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-662 |
| ITALY | 2021-03-11 | 80,000 | Planet Group Spa | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 21 (2), (3) GDPR, Art. 12 (3) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-661 |
| ITALY | 2021-03-11 | 15,000 | Mediacom s.r.l. | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-660 |
| THE NETHERLANDS | 2021-03-11 | 600,000 | Municipality of Enschede | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-659 |
| SPAIN | 2021-04-27 | 15,000 | Anytime Fitness Iberia S.L. | Art. 17 GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-658 |
| SPAIN | 2021-04-27 | 3,000 | Pagamastarde S.L. | Art. 17 (1) GDPR, Art. 21 LSSI | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-657 |
| SPAIN | 2021-04-23 | 1,000,000 | Equifax Iberica S.L. | Art. 5 (1) a), b), c), d) GDPR, Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-656 |
| CZECH REPUBLIC | 2020 | 19,200 | Unknown | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3) GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR, Art. 22 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-655 |
| CZECH REPUBLIC | 2020 | Unknown | Unknown | Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-654 |
| CZECH REPUBLIC | 2020 | Unknown | Municipality | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR, Art. 14 (3) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-653 |
| CZECH REPUBLIC | 2020 | 3,850 | Television broadcaster | Art. 12 (1) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-652 |
| CZECH REPUBLIC | 2020 | Unknown | Unknown | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-651 |
| CZECH REPUBLIC | 2020 | Unknown | Bank | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-650 |
| CZECH REPUBLIC | 2020 | Unknown | Healthcare provider | Art. 5 (1) a) GDPR, Art. 12 (1) GDPR, Art. 28 (2), (3) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-649 |
| CZECH REPUBLIC | 2020 | Unknown | Public university | Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-648 |
| ITALY | 2021-03-11 | 3,000 | Comune di San Marco in Lamis | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-647 |
| GREECE | 2021-04-16 | 2,000 | Candidate for parliamentary elections | Art. 15 GDPR, Art. 11 Law 3471/2006 | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-646 |
| SPAIN | 2021-04-22 | 4,000 | HazteOir.Org | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-645 |
| SPAIN | 2021-04-22 | 1,500 | Private Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-644 |
| NORWAY | 2021-03-21 | 19,900 | Basaren Drift AS | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-643 |
| SPAIN | 2021-04-20 | 8,000 | Highcliffe Estates Marbella S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-642 |
| CZECH REPUBLIC | 2020 | 1,900 | Unknown | Art. 12 (2) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-641 |
| CZECH REPUBLIC | 2020-05-26 | Unknown | Unknown | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-640 |
| CZECH REPUBLIC | 2020 | 387 | Private healthcare provider | Art. 24 GDPR, Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-639 |
| SPAIN | 2021-04-19 | 1,500 | Pub owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-638 |
| ROMANIA | 2021-04-19 | 1,500 | Lugera & Makler Broker S.R.L. | Art. 29 GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-637 |
| SPAIN | 2021-04-13 | 90,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-636 |
| SPAIN | 2021-04-15 | 3,000 | Private Individual | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-635 |
| GREECE | 2020-04-07 | 2,000 | Ιγνατιάδης Νικόλαος και ΣΙΑ Ε.Ε. | Art. 5 (1) c) GDPR, Art. 6 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-634 |
| ROMANIA | 2021-04-15 | 5,000 | S.C. Tip Top Food Industry S.R.L | Art. 5 (1) b), c) GDPR, Art. 5 (2) GDPR, Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-633 |
| CZECH REPUBLIC | 2020 | Unknown | Ski rental company | Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 7 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 16 GDPR, Art. 17 GDPR, Art. 18 GDPR, Art. 19 GDPR, Art. 20 GDPR, Art. 21 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-632 |
| CZECH REPUBLIC | 2020 | 2,700 | Mall.tv | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-631 |
| SPAIN | 2021-04-08 | 60,000 | Kutxabank, S.A. | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-630 |
| ITALY | 2021-02-25 | 6,000 | Azienda Ospedaliera Universitaria Careggi | Art. 5 GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-629 |
| NORWAY | 2021-04-09 | 3,400 | Miljø- og Kvalitetsledelse AS | Art. 5 (1) a) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-628 |
| NORWAY | 2021-03-15 | 100,000 | Asker Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 32 (1) b) GDPR, Art. 24 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-627 |
| GREECE | 2021-03-22 | 2,000 | Candidate for parliamentary elections | Art. 15 GDPR, Art. 11 Law 3471/2006 | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-626 |
| ITALY | 2021-02-11 | 45,000 | Istituti ospedalieri bergamaschi | Art. 5 (1) a), f) GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-625 |
| SPAIN | 2021-04-06 | 2,400 | Promotech Digital S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-624 |
| SPAIN | 2021-04-05 | 4,000 | Stockhunters S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-623 |
| SPAIN | 2021-04-05 | 3,000 | Electrotecnica Bastida S.L. | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-622 |
| SPAIN | 2021-04-05 | 3,000 | Kukimbia S.L. | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-621 |
| ITALY | 2021-03-25 | 4,500,000 | Fastweb S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 32 GPDR, Art. 33 (1) GDPR, Art. 34 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-620 |
| ITALY | 2021-02-25 | 4,000 | Ministero dell’Istruzione, Ufficio Scolastico Regionale per il Lazio | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-619 |
| ITALY | 2021-02-11 | 60,000 | Roma Servizi per La Mobilita S.r.l. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-618 |
| ITALY | 2021-02-11 | 350,000 | Roma Capitale | Art. 5 GDPR, Art. 6 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-617 |
| ITALY | 2021-02-25 | 20,000 | Gedi Gruppo Editoriale S.p.A. | Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-616 |
| ITALY | 2021-02-11 | 5,000 | Fondazione di religione e di culto “Casa sollievo della sofferenza” Opera di San Pio da Pietrelcina | Art. 5 (1) a), f) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-615 |
| ITALY | 2021-02-25 | 6,000 | Comune di Commezzadura | Art. 5 (1) a), c) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-614 |
| ROMANIA | 2021-03-30 | 10,000 | Telekom Romania Mobile Communications S.A. | Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-613 |
| THE NETHERLANDS | 2020-12-10 | 475,000 | Booking.com B.V. | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-612 |
| NORWAY | 2021-03-08 | 14,900 | Dragefossen AS | Art. 5 (1) a) GPDR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-611 |
| ITALY | 2021-02-25 | 2,000 | Comune di Conflenti | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-610 |
| SPAIN | 2021-03-15 | 600,000 | Air Europa Lineas Aereas, SA. | Art. 32 (1) GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-609 |
| NORWAY | 2021-03-15 | 4,900 | Ålesund Municipality | Art. 32 (1) b) GDPR, Art. 24 (1) GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-608 |
| SPAIN | 2021-03-23 | 1,000 | Laboratorio Octogón, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-607 |
| ROMANIA | 2021-03-23 | 2,000 | S.C. Medicover S.R.L. | Art. 32 (1) b), (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-606 |
| SPAIN | 2021-03-16 | 60,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-605 |
| SPAIN | 2021-03-18 | 3,000 | Asesoría Alpi-Clúa S.L. | Art. 5 (1) f) GDPR, Art. 32 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-604 |
| SPAIN | 2021-03-15 | 2,000 | Heredad de Urueña S.A. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-603 |
| SPAIN | 2021-03-15 | 3,000 | Cultural association | Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-602 |
| BELGIUM | 2021-03-15 | 1,000 | School | Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 8 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-601 |
| ITALY | 2021-01-14 | 75,000 | Regione Lazio | Art. 5 (2) GDPR, Art. 28 GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-600 |
| ITALY | 2021-02-11 | 75,000 | Ministero dello Sviluppo Economico | Art. 5 (1) a), b), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 37 (1), (7) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-599 |
| ITALY | 2020-12-17 | 2,000 | Ordine degli Assistenti Sociali della Regione Lazio | Art. 12 (3), (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-598 |
| SPAIN | 2021-03-15 | 5,000 | Certime S.A. | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-597 |
| SPAIN | 2021-03-12 | 12,000 | NBQ Technology, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-596 |
| SPAIN | 2021-03-12 | 1,500 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-595 |
| SPAIN | 2021-03-11 | 8,150,000 | Vodafone España, S.A.U. | Art. 28 GDPR, Art. 24 GDPR, Art. 44 GDPR, Art. 21 LSSI, Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-594 |
| SPAIN | 2021-03-10 | 90,000 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR, Art. 17 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-593 |
| SPAIN | 2021-03-10 | 50,000 | Equifax Iberica S.L. | Art. 6 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-592 |
| ITALY | 2021-02-25 | 300,000 | Istituto Nazionale Previdenza Sociale (INPS) | Art. 5 (1) a), c), d) GDPR, Art. 25 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-591 |
| ITALY | 2020-12-17 | 10,000 | Comune di Luino | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR, Art. 37 (1) a) GDPR, Art. 37 (7) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-590 |
| ITALY | 2020-12-17 | 4,000 | Comune di Santo Stefano Belbo | Art. 5 (1) a), c) GDPR, Art. 6 (1) c), e) GDPR, Art. 6 (2) GDPR, Art. 6 (3) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-589 |
| SPAIN | 2021-03-10 | 8,000 | Filigrana Comunicación S.L.U. | Art. 6 (1) GDPR, Art. 13 GPDR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-588 |
| SPAIN | 2021-03-10 | 10,000 | Hospital Campogrande DE | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-587 |
| GERMANY | 2021-03-10 | 300,000 | VfB Stuttgart 1893 AG | Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-586 |
| SPAIN | 2021-03-09 | 15,000 | Homeowners Association | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-585 |
| POLAND | 2021-01-11 | 30,000 | Enea S.A. | Art. 33 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-584 |
| POLAND | 2021-01-15 | 4,600 | Anwara Sp. z.o.o. | Art. 31 GDPR, Art. 58 (1) a) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-583 |
| ROMANIA | 2021-03-04 | 500 | Natural person holding the position of General Secretary for a political party in Bucharest | Art. 32 (1), (2) GDPR, Art. 58 (1) a), e) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-582 |
| CYPRUS | 2021-03-03 | 40,000 | Electricity Authority of Cyprus | Art. 6 (1) GDPR, Art. 9 (2) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-581 |
| CYPRUS | 2021-03-03 | 6,000 | KEPIDES | Art. 32 (4) | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-580 |
| CYPRUS | 2021-03-03 | 10,000 | Cypriot Real Estate Registration Authority | Art. 12 GDPR, Art. 15 GDPR, Art. 31 GDPR, Art. 58 (1) e) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-579 |
| CYPRUS | 2021-03-03 | 25,000 | Hellenic Bank | Art. 5 (1) e), f) GDPR, Art. 32 (1) b), c) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-578 |
| SPAIN | 2021-03-02 | 200,000 | I-DE Redes Eléctricas Inteligentes, S.A.U | Art. 5 (1) b), c) GDPR, Art. 6 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-577 |
| LITHUANIA | 2021-03-02 | 15,000 | Registrų Centras | Art. 32 (1) b), c) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-576 |
| GERMANY | 2021-03-03 | 0 | Private Individual | Art. 5 GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-575 |
| SPAIN | 2021-03-02 | 9,000 | Unknown | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-574 |
| NORWAY | 2021-03-02 | 24,400 | Unknown | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-573 |
| LITHUANIA | 2021-02-26 | 3,000 | IT sprendimai sėkmei | Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-572 |
| LITHUANIA | 2021-02-26 | 12,000 | Nacionaliniam visuomenės sveikatos centrui (NVSC) | Art. 5 (1), (2) GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 35 GDPR, Art. 58 (2) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-571 |
| IRELAND | 2020-08-12 | 85,000 | Tusla Child and Family Agency | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-570 |
| HUNGARY | 2020-12-10 | 22,200 | Budapesti Műszaki és Gazdaságtudományi Egyetem (Budapest University of Technology and Economics) | Art. 5 (1) a), b), c) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-569 |
| HUNGARY | 2020-12-16 | 97,150 | Unknown | Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 12 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-568 |
| SPAIN | 2021-02-24 | 12,000 | Avilon Center 2016 S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-567 |
| CROATIA | 2021-02-22 | Unknown | Security company (name not available at the moment) | Art. 32 (1) b), d) GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-566 |
| SPAIN | 2021-02-12 | 1,600 | Ripobruna 207, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-565 |
| POLAND | 2021-02-11 | 22,200 | Krajowa Szkoła Sądownictwa i Prokuratury | Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 28 (3) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-564 |
| ITALY | 2021-01-14 | 18,000 | Azienda Usl di Bologna | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-563 |
| ITALY | 2021-01-14 | 2,000 | Poliambulatorio Talenti S.r.l. | Art. 12 (3) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-562 |
| ITALY | 2021-01-27 | 10,000 | Azienda Ospedaliero Universitaria di Parma | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-561 |
| ITALY | 2021-01-27 | 50,000 | Azienda Ospedaliero Universitaria Senese | Art. 5 (1) f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-560 |
| ITALY | 2021-01-27 | 50,000 | Azienda USL della Romagna | Art. 5 (1) a), d), f) GDPR, Art. 9 GDPR, Art. 32 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-559 |
| ITALY | 2021-01-14 | 30,000 | Azienda sanitaria provinciale di Enna | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-558 |
| SPAIN | 2021-02-16 | 1,000 | The Washpoint S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-557 |
| ITALY | 2021-01-14 | 8,000 | Agenzia regionale protezione ambientale Campania (ARPAC) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-556 |
| THE NETHERLANDS | 2021-02-11 | 440,000 | OLVG | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-555 |
| SPAIN | 2021-02-12 | 120,000 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-554 |
| LATVIA | 2021-02-09 | 65,000 | Lursoft IT SIA | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-553 |
| IRELAND | 2020-12-17 | 70,000 | University College Dublin | Art. 5 (1) e), f) GDPR, Art. 32 (1) GDPR, Art. 33 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-552 |
| POLAND | 2021-01-05 | 19,000 | Unknown | Art. 34 (1), (2) GDPR, Art. 58 (2) e) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-551 |
| ROMANIA | 2021-02-10 | 1,000 | ING Bank N.V. Amsterdam - Bucharest office | Art. 29 GDPR, Art. 32 (2), (4) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-550 |
| SPAIN | 2021-02-11 | 24,000 | Vamavi Phone S.L. | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 LOPDGDD, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-549 |
| SPAIN | 2021-02-09 | 5,000 | Predase Servicios Integrales S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-548 |
| SPAIN | 2021-02-08 | 5,000 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-547 |
| SPAIN | 2021-02-08 | 3,000 | Patio Ancestral S.L. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-546 |
| SPAIN | 2021-02-04 | 2,000 | Private Person | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-545 |
| SPAIN | 2021-02-03 | 100,000 | Iberdrola Clientes | Art. 5 (1) d) GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-544 |
| ITALY | 2020-11-26 | 3,000 | Charly Mike s.r.l. | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-543 |
| SPAIN | 2021-02-01 | 3,000 | IDFINANCE Spain, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-542 |
| SPAIN | 2021-02-01 | 24,000 | Xfera Moviles S.A. | Art. 58 (2) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-541 |
| NORWAY | 2021-02-03 | 19,300 | Cyberbook AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-540 |
| ITALY | 2020-12-17 | 100,000 | Azienda Unità Sanitaria Locale Toscana Sud Est | Art. 5 (1) f) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 28 GDPR, Art. 30 GDPR, Art. 32 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-539 |
| POLAND | 2020-12-09 | 2,850 | Smart Cities Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-538 |
| BELGIUM | 2021-01-27 | 50,000 | Family Service / N.D.P.K. nv. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-537 |
| FRANCE | 2021-01-27 | 75,000 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-536 |
| FRANCE | 2021-01-27 | 150,000 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-535 |
| SPAIN | 2021-01-21 | 75,000 | Telefónica Móviles España, SAU | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-534 |
| BELGIUM | 2021-01-22 | 25,000 | Unknown | Art. 5 (1) f), (2) GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 (1), (5) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-533 |
| ITALY | 2020-12-17 | 40,000 | Miropass S.r.l. | Art. 5 (1) a), e) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-532 |
| ITALY | 2020-12-17 | 500,000 | Roma Capitale (Rome Municipality) | Art. 5 (1) a) GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 28 (2), (3) GDPR, Art. 32 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-531 |
| NORWAY | 2021-01-19 | 9,700 | Aquateknikk AS | Art. 5 GPDR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-530 |
| SPAIN | 2021-01-21 | 50,000 | Alterna Operador Integral S.L. | Art. 6 (1) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-529 |
| SPAIN | 2021-01-20 | 1,200 | Individual | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-528 |
| POLAND | 2021-01-05 | 5,500 | Śląski Uniwersytet Medyczny (Medical University of Silesia) | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-527 |
| BELGIUM | 2021-01-12 | 10,000 | Unknown | Art. 6 (1) GDPR, Art. 12 (3) GDPR, Art. 21 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-526 |
| NORWAY | 2021-01-14 | 38,600 | Coop Finnmark SA | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-525 |
| NORWAY | 2021-01-12 | 38,600 | Unknown | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-524 |
| HUNGARY | 2020-11-18 | 28 | Unknown | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-523 |
| SPAIN | 2021-01-13 | 2,000,000 | Caixabank S.A. | Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-522 |
| ITALY | 2020-10-29 | 4,000 | Borgo Fonte Scura s.r.l. | Art. 5 (1) a) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-521 |
| ITALY | 2020-10-29 | 20,000 | Gaypa s.r.l. | Art. 5 (1) a), c), e) GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-520 |
| GERMANY | 2021-01-08 | 10,400,000 | notebooksbilliger.de | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-519 |
| ESTONIA | 2020-12-01 | 100,000 | Azeta.ee e-apteek | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-518 |
| ESTONIA | 2020-12-01 | 100,000 | Südameapteegi e-apteek | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-517 |
| ESTONIA | 2020-12-01 | 100,000 | Apotheka e-apteek | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-516 |
| NORWAY | 2021-01-07 | 7,250 | Gveik AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-515 |
| NORWAY | 2021-01-06 | 9,700 | Lindstrand Trading AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-514 |
| CZECH REPUBLIC | 2021-01-04 | 118,500 | Unknown | Art. 6 (1) GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-513 |
| POLAND | 2019-11 | 1,770 | L. Sp. z o.o. | Art. 5 (1) a), f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-512 |
| FRANCE | 2021-01-05 | 20,000 | Nestor SAS | Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-511 |
| POLAND | 2020-12-09 | 18,850 | TUiR Warta S.A. | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-510 |
| POLAND | 2020-12-17 | 235,300 | ID Finance Poland Sp. z o.o. | Art. 5 (1) f) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-509 |
| FRANCE | 2020-12-07 | 7,300 | Perfomeclic | Art. 5 (1) c), e) GDPR, Art. 14 GDPR, Art. 21 GDPR, Art. 28 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-508 |
| NORWAY | 2021-01-04 | 95,500 | Innovasjon Norge | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-507 |
| SPAIN | 2021-01-04 | 54,000 | Vodafone España, S.A.U. | Art. 5 (1) d), f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-506 |
| ROMANIA | 2020-12-30 | 3,000 | ING Bank N.V. Amsterdam - Bucharest office | Art. 5 (1) a) - d) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-505 |
| ROMANIA | 2020-12-29 | 1,000 | Qualitance QBS SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-504 |
| ITALY | 2020-11-26 | 20,000 | Concentrix Cvg Italy s.r.l. | Art. 5 (1) a), c) GDPR, Art. 6 (1) b), c) GDPR, Art. 9 (1) b) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-503 |
| ITALY | 2020-11-26 | 10,000 | Reti Televisive Italiane S.p.a. | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-502 |
| POLAND | 2020-12-28 | 18,930 | Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-501 |
| BELGIUM | 2020-12-23 | 15,000 | Unknown | Art. 14 (1), (2) GDPR, Art. 12 (3) GDPR, Art. 6 GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-500 |
| BELGIUM | 2020-12-23 | 50,000 | Unknown | Art. 14 (1), (2) GDPR, Art. 12 (1), (2), (3) GDPR, Art. 15 (1) GDPR, Art. 5 (1) c), (2) GDPR, Art. 24 (1), (2) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-499 |
| ROMANIA | 2020-12-22 | 2,000 | S.C. C&V Water Control S.A. | Art. 58 (1) a), e) GDPR, Art. 58 (2) i) GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-498 |
| SPAIN | 2020-12-22 | 6,000 | Iberdrola Clientes, SAU | Art. 48 (1) b) LGT, Art. 21 GDPR, Art. 23 (4) LOPDGDD | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-497 |
| SPAIN | 2020-12-21 | 36,000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-496 |
| HUNGARY | 2020-12-16 | 1,385 | Next Time Media Agency Ltd. (Next Time Media Ügynökség Kft.) | Art. 32 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-495 |
| HUNGARY | 2020-12-16 | 55,400 | Robinson Tours Ltd. (Robinson Tours Idegenforgalmi és Szolgáltató Kft.) | Art. 25 (1), (2) GDPR, Art. 32 (1) b) GDPR, Art. 34 (1) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-494 |
| HUNGARY | 2020-12-16 | 1,940 | Unknown | Art. 5 (1) b), c) GDPR, Art. 13 (1) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-493 |
| SPAIN | 2020-12-15 | 10,000 | Online Services | Art. 13 GDPR, Art. 8 (1) GDPR, Art. 6 (1) a) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-492 |
| FRANCE | 2020-12-17 | 6,000 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-491 |
| FRANCE | 2020-12-17 | 3,000 | Doctor | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-490 |
| ROMANIA | 2020-12-17 | 100,000 | Banca Transilvania SA | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-489 |
| LATVIA | 2020-12-15 | 6,250 | Unknown | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-488 |
| LATVIA | 2020-12-15 | 15,000 | HH Invest SIA | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-487 |
| SWEDEN | 2020-12-15 | 29,500 | Uppsalahem AB | Art. 5 GDPR, Art. 6 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-486 |
| IRELAND | 2020-12-15 | 450,000 | Twitter International Company | Art. 33 (1), (5) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-485 |
| GREECE | 2020-10-29 | 1,000 | American College of Greece | Art. 12 (3), (4) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-484 |
| POLAND | 2020-12-14 | 443,000 | Virgin Mobile Polska | Art. 5 (1) f), (2) GDPR, Art. 25 (1) GDPR, Art. 32 (1) b), d), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-483 |
| SWEDEN | 2020-12-11 | 54,000 | Umeå University | Art. 5 (1) f) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-482 |
| SPAIN | 2020-12-11 | 5,000,000 | Banco Bilbao Vizcaya Argentaria, S.A. | Art. 6 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-481 |
| SPAIN | 2020-12-10 | 4,000 | Borjamotor, S.A. | Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-480 |
| BELGIUM | 2020-11-13 | 1,500 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 30 GDPR, Art. 37 (5) GDPR, Art. 37 (7) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-479 |
| SPAIN | 2020-12-09 | 10,000 | Unknown | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-478 |
| SPAIN | 2020-12-09 | 40,000 | Xfera Moviles S.A. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-477 |
| SPAIN | 2020-12-02 | 10,000 | Losada Advocats S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-476 |
| SPAIN | 2020-11-27 | 1,200 | Private Individual | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-475 |
| NORWAY | 2020-12-03 | 18,840 | Municipality of Indre Østfold | Art. 6 GDPR, Art. 32 (1) b) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-474 |
| SWEDEN | 2020-12-03 | 2,900,000 | Capio St. Göran AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-473 |
| SWEDEN | 2020-12-03 | 390,100 | Karolinska University Hospital of Solna | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-472 |
| SWEDEN | 2020-12-03 | 341,300 | Sahlgrenska University Hospital | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-471 |
| SWEDEN | 2020-12-03 | 243,800 | Västerbotten Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-470 |
| SWEDEN | 2020-12-03 | 243,800 | Östergötland Region | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-469 |
| SPAIN | 2020-12-03 | 2,400 | Dr Marín Cirugia Plástica, S.L.P. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-468 |
| SWEDEN | 2020-12-03 | 1,168,000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-467 |
| SWEDEN | 2020-12-03 | 1,463,000 | Aleris Sjukvård AB | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 32 (1) GDPR, Art. 32 (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-466 |
| SPAIN | 2020-12-02 | 5,000 | Asociación de Víctimas por Arbitrariedades Judiciales, (JAVA) | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-465 |
| SPAIN | 2020-12-02 | 3,000 | Comercio Online Levante, S.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-464 |
| SPAIN | 2020-12-02 | 6,000 | Servicio de Alojamientos Responsables, S.L. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-463 |
| AUSTRIA | 2020-10-19 | 150 | Private Individual | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-462 |
| AUSTRIA | 2020-10-19 | 600 | Private Individual | Art. 5 (1) a) GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-461 |
| BELGIUM | 2020-11-25 | 1,500 | Private Individual | Art. 6 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-460 |
| ITALY | 2020-11-23 | 20,000 | Burgo Group S.p.A | Art. 5 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-459 |
| SPAIN | 2020-11-25 | 40,000 | Miraclia Telecomunicaciones S.L. | Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-458 |
| FRANCE | 2020-11-18 | 2,250,000 | Carrefour France | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR, Art. 33 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-457 |
| SWEDEN | 2020-11-25 | 19,500 | Gnosjö Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-456 |
| SWEDEN | 2020-11-24 | 394,000 | City of Stockholm | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-455 |
| FRANCE | 2020-11-18 | 800,000 | Carrefour Banque | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-454 |
| ROMANIA | 2020-11-24 | 5,000 | Dada Creation S.R.L. | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-453 |
| SPAIN | 2020-11-18 | 2,000 | Anmavas 61, S.L. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-452 |
| ROMANIA | 2020-11-23 | 4,000 | Vodafone România SA | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-451 |
| SPAIN | 2020-11-23 | 12,000 | Recambios Villalegre S.L. | Art. 6 GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-450 |
| IRELAND | 2020-08-18 | 65,000 | Cork University Maternity Hospital | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-449 |
| ITALY | 2020-11-17 | 2,000 | Comune di Collegno | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-448 |
| ITALY | 2020-11-17 | 30,000 | Provincial Health Authority of Cosenza | Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-447 |
| SPAIN | 2020-11-16 | 42,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-446 |
| SPAIN | 2020-11-16 | 1,600 | Homeowners Association | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-445 |
| SPAIN | 2020-11-11 | 42,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-444 |
| SPAIN | 2020-10-26 | 50,000 | Conseguridad SL | Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-443 |
| SPAIN | 2020-10-26 | 4,000 | Organic Natur 03 S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-442 |
| SPAIN | 2020-11-10 | 3,000 | Miguel Ibáñez Bezanilla, S.L. | Art. 13 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-441 |
| UNITED KINGDOM | 2020-11-13 | 1,405,000 | Ticketmaster UK Limited | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-440 |
| SPAIN | 2020-11-06 | 20,000 | Xfera Moviles S.A. | Art. 31 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-439 |
| ITALY | 2020-11-12 | 12,251,601 | Vodafone Italia S.p.A. | Art. 5 (1), (2) GDPR, Art. 6 (1) GDPR, Art. 7 GDPR, Art. 15 (1) GDPR, Art. 16 GDPR, Art. 21 GDPR, Art. 24 GDPR, Art. 25 (1) GDPR, Art. 32 GDPR, Art. 33 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-438 |
| SPAIN | 2020-11-19 | 36,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-437 |
| SPAIN | 2020-11-05 | 75,000 | Telefonica Moviles Espana, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-436 |
| SPAIN | 2020-11-03 | 30,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-435 |
| SPAIN | 2020-10-28 | 4,000 | Play Orenes, S.L. | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-434 |
| ITALY | 2020-10-26 | 20,000 | Università Campus Bio-medico di Roma (Polyclinic) | Art. 5 (2) a), f) GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-433 |
| CYPRUS | 2020-10-22 | 6,000 | Cyprus Police | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-432 |
| SPAIN | 2020-10-28 | 36,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-431 |
| HUNGARY | 2020-10-23 | 54,800 | Deichmann Cipőkereskedelmi Korlátolt Felelősségű Társaságnak | Art. 12 GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 25 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-430 |
| LITHUANIA | 2020-10-21 | 15,000 | Vilnius City Municipality Administration | Art. 5 (1) d) GDPR, Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-429 |
| ITALY | 2020-09-03 | 2,000 | Comune di Casaloldo | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-428 |
| HUNGARY | 2020-07-23 | 1,700 | Employer | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-427 |
| SPAIN | 2020-09-22 | 7,800 | Iweb Internet Learning, S.L. | Art. 7 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-426 |
| ROMANIA | 2020-10-20 | 2,000 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-425 |
| SPAIN | 2020-10-06 | 4,000 | Callesgarcia, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-424 |
| SPAIN | 2020-10-03 | 3,000 | Avata Hispania, S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 28 (3) g) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-423 |
| CYPRUS | 2020-10-19 | 15,000 | Bank of Cyprus Public Company Ltd | Art. 5 (1) f) GDPR, Art. 5 (2) GDPR, Art. 15 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-422 |
| CYPRUS | 2020-10-19 | 1,000 | Grant Ideas Ltd | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-421 |
| ROMANIA | 2020-10-15 | 3,000 | S.C. Marsorom S.R.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-420 |
| SPAIN | 2020-10-09 | 5,000 | Caja Rural San José de Nules S. Cooperativa de Crédito | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-419 |
| SPAIN | 2020-10-09 | 50,000 | Centro de Investigación y Estudio para la Obesidad, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-418 |
| SPAIN | 2020-10-09 | 2,000 | Private Person | Art. 5 (1) c) GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-417 |
| NORWAY | 2020-09-25 | 13,900 | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-416 |
| SPAIN | 2020-10-09 | 900 | Café Restaurante B.B.B | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-415 |
| SPAIN | 2020-09-30 | 3,000 | Venu Sanz Chef, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-414 |
| ROMANIA | 2020-10-01 | 2,000 | Asociația de proprietari Militari R | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-413 |
| ROMANIA | 2020-10-01 | 3,000 | Megareduceri TV S.R.L. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-412 |
| SPAIN | 2020-10-06 | 60,000 | Lycamobile | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-411 |
| POLAND | 2020-06-03 | 1,168 | Entrepreneur running a non-public nursery and pre-school | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-410 |
| HUNGARY | 2020-07-16 | 28 | Google Ireland Ltd. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-409 |
| SPAIN | 2020-09-25 | 60,000 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-408 |
| ITALY | 2020-09-30 | 60,000 | Scanshare s.r.l. | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 9 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-407 |
| ITALY | 2020-09-30 | 80,000 | Azienda Ospedaliera di Rilievo Nazionale 'Antonio Cardarelli' (Private Hospital) | Art. 5 (1) a) GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 28 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-406 |
| GERMANY | 2020-10-01 | 35,258,708 | H&M Hennes & Mauritz Online Shop A.B. & Co. KG | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-405 |
| SPAIN | 2020-09-22 | 60,000 | GLP Instalaciones 86, SL | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-404 |
| BELGIUM | 2020-09-07 | 5,000 | Former mayor of a community | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-403 |
| ITALY | 2020-09-07 | 2,000 | Istituto Comprensivo Statale Crucoli Torretta | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-402 |
| ROMANIA | 2020-09-08 | 2,000 | Sanatatea Press Group S.R.L. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-401 |
| GREECE | 2020-09-11 | 8,000 | Private Person | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-400 |
| SPAIN | 2020-09-11 | 1,500 | Political Party | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-399 |
| SPAIN | 2020-09-16 | 10,000 | Property owners community | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-398 |
| SPAIN | 2020-09-17 | 3,000 | Grupo Carolizan | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-397 |
| SPAIN | 2020-09-17 | 60,000 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-396 |
| ROMANIA | 2020-09-01 | 500 | Apartment building owners association | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 25 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-395 |
| HUNGARY | 2020-07-23 | 560 | Forbes Hungary | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-394 |
| GREECE | 2020-08-03 | 3,000 | Candidate for parliamentary elections | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-393 |
| POLAND | 2020-09-08 | 11,200 | Warsaw University of Life Sciences | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-392 |
| ITALY | 2020-07-02 | 15,000 | Mapei S.p.A. | Art. 5 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-391 |
| SPAIN | 2020-09-07 | 3,000 | Barcelona Airport Security Guard Association ('AVSAB') | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-390 |
| SPAIN | 2020-09-01 | 75,000 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-389 |
| SPAIN | 2020-07-31 | 1,500 | Tour & People Max S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-388 |
| POLAND | 2020-08-31 | 22,700 | Surveyor General of Poland ('GKK') | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-387 |
| SPAIN | 2020-08-28 | 5,000 | Basketball Federation of Castilla and Leon | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-386 |
| SPAIN | 2020-08-28 | 50,000 | Bankia S.A. | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-385 |
| ESTONIA | 2020-08-17 | 48 | Police Officer | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-384 |
| SPAIN | 2020-08-17 | 5,000 | Party of the Socialists of Catalonia | Art. 5 (1) b) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-383 |
| SPAIN | 2020-07-31 | 45,000 | Vodafone España SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-382 |
| POLAND | 2020-07-15 | 22,300 | Office for geodesy and cartography | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-381 |
| BELGIUM | 2020-07-28 | 3,000 | Communal political association | Art. 5 GDPR, Art. 6 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-380 |
| ITALY | 2020-07-29 | 4,000 | Region of Campania | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-379 |
| ITALY | 2020-07-29 | 3,000 | Community of San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-378 |
| ITALY | 2020-07-30 | 2,000 | Community of Manduria | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-377 |
| ITALY | 2020-08-04 | 1,000 | Supermarket | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-376 |
| ITALY | 2020-08-04 | 5,000 | National Institute for Social Security - Department of the Province of Brescia | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-375 |
| ITALY | 2020-08-04 | 15,000 | Mapei S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-374 |
| ITALY | 2020-08-05 | 2,000 | School | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-373 |
| AUSTRIA | 2020-08-05 | 100 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-372 |
| SPAIN | 2020-08-05 | 3,000 | Restaurant | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-371 |
| FINLAND | 2020-08-05 | 7,000 | Acc Consulting Varsinais-Suomi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-370 |
| SPAIN | 2020-08-06 | 3,000 | Just Landed S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-369 |
| ITALY | 2020-08-06 | 3,000 | GTL S.R.L. | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-368 |
| ITALY | 2020-08-10 | 10,000 | Community of Baronissi | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-367 |
| ITALY | 2020-08-10 | 10,000 | Cavauto S.R.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-366 |
| SPAIN | 2020-08-04 | 60,000 | Vodafone España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-365 |
| SPAIN | 2020-08-06 | 3,000 | GROW BEATS SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-364 |
| DENMARK | 2020-08-04 | 20,100 | PrivatBo A.M.B.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-363 |
| FRANCE | 2020-08-05 | 250,000 | Spartoo | Art. 5 (1) GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-362 |
| DENMARK | 2020-07-28 | 147,800 | Arp Hansen Hotel Group A/S | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-361 |
| ROMANIA | 2020-07-27 | 5,000 | SC Cntar Tarom SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-360 |
| ROMANIA | 2020-07-30 | 2,000 | Romanian Post National Company | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-359 |
| ROMANIA | 2020-07-30 | 2,000 | SC Viva Credit IFN SA | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-358 |
| BELGIUM | 2020-07-14 | 5,000 | Operator of CCTV of a residential building | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-357 |
| SPAIN | 2020-07-23 | 5,000 | El Real Sporting de Gijón S.A.D. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-356 |
| SPAIN | 2020-07-23 | 5,000 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-355 |
| SPAIN | 2020-07-23 | 75,000 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-354 |
| SPAIN | 2020-07-23 | 70,000 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-353 |
| SPAIN | 2020-07-23 | 55,000 | Telefónica Móviles España, SAU | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-352 |
| SPAIN | 2020-07-23 | 10,000 | El Periódico de Catalunya, S.L.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-351 |
| SPAIN | 2020-07-20 | 70,000 | Xfera Moviles S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-350 |
| SPAIN | 2020-07-20 | 80,000 | Orange Espagne S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-349 |
| GREECE | 2020-06-29 | 5,000 | New York College S.A. | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-348 |
| SPAIN | 2020-07-20 | 1,500 | Comercial Vigobrandy, SL | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-347 |
| SPAIN | 2020-07-20 | 40,000 | Iberia Lae SA Operadora Unipersonal | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-346 |
| SPAIN | 2020-07-20 | 24,000 | Banco Bilbao Vizcaya Argentaria, SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-345 |
| BELGIUM | 2020-07-14 | 600,000 | Google Belgium SA | Art. 5 GDPR, Art. 6 GDPR, Art. 17 (1) a) GDPR, Art. 12 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-344 |
| SPAIN | 2020-07-10 | 55,000 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-343 |
| SPAIN | 2020-07-10 | 5,000 | School Fitness Holiday & Franchising S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-342 |
| SPAIN | 2020-07-10 | 5,000 | Global Business Travel Spain SLU | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-341 |
| SPAIN | 2020-07-10 | 12,000 | Vodafone España, SAU | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-340 |
| SPAIN | 2020-07-10 | 1,000 | Centro Internacional De Crecimiento Laboral Y Profesional S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-339 |
| SPAIN | 2020-07-10 | 1,500 | Auto Desguaces Iglesias S.L. | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-338 |
| ITALY | 2020-07-13 | 800,000 | Iliad Italia S.p.A. | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-337 |
| ITALY | 2020-07-13 | 16,700,000 | Wind Tre S.p.A. | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 24 GDPR, Art. 25 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-336 |
| ITALY | 2020-07-13 | 200,000 | Merlini s.r.l. | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 28 GDPR, Art. 29 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-335 |
| THE NETHERLANDS | 2020-07-06 | 830,000 | Bureau Krediet Registration ('BKR') | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-334 |
| NORWAY | 2020-07-10 | 46,660 | Municipality of Rælingen | Art. 32 GDPR, Art. 35 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-333 |
| POLAND | 2020-07-10 | 3,400 | East Power Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-332 |
| ROMANIA | 2020-07-09 | 15,000 | Proleasing Motors SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-331 |
| SPAIN | 2020-07-02 | 5,000 | Xfera Moviles S.A. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-330 |
| SPAIN | 2020-07-02 | 3,600 | Saunier-Tec Mantenimientos de Calor y Frio, SL. | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-329 |
| NORWAY | 2020-07-02 | Only intention to issue fine | Odin Flissenter AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-328 |
| SPAIN | 2020-07-02 | 4,000 | De Vere Spain S.L. | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-327 |
| SPAIN | 2020-07-02 | 24,000 | Iberdrola Clientes | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-326 |
| ITALY | 2020-03-05 | 3,000 | San Giorgio Jonico | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-325 |
| ITALY | 2020-01-30 | 4,000 | Comune di Colledara | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-324 |
| SPAIN | 2020-06-19 | 6,000 | National Police Brigade | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-323 |
| NORWAY | 2020-06-19 | Only intention to issue fine | Aquateknikk AS | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-322 |
| NORWAY | 2020-06-22 | 112,000 | Østfold HF Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-321 |
| IRELAND | 2020-06-30 | 40,000 | Tusla Child and Family Agency | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-320 |
| DENMARK | 2020-06-30 | 6,700 | Lejre Municipality | Art. 5 GDPR, Art. 6 GDPR, Art. 33 GDPR, Art. 34 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-319 |
| ISLE OF MAN | 2020-06-25 | 13,500 | Department of Home Affairs | Art. 12 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-318 |
| BELGIUM | 2020-06-08 | 5,000 | Municipal employee | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-317 |
| BELGIUM | 2020-06-16 | 1,000 | Unknown | Art. 17 GDPR, Art. 21 GDPR, Art. 31 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-316 |
| BELGIUM | 2020-06-19 | 10,000 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-315 |
| SWEDEN | 2020-06-16 | 1,900 | Housing Association | Art. 5 GDPR, Art. 6 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-314 |
| HUNGARY | 2020-06-12 | 288,000 | Digi Távközlési Szolgáltató Kft. ('Digi') (electronic communication service provider) | Art. 5 (1) b), (e) GDPR, Art. 32 (1), (2) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-313 |
| ROMANIA | 2020-06-11 | 3,000 | Telekom Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-312 |
| SPAIN | 2020-06-15 | 75,000 | Xfera Moviles S.A. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-311 |
| ROMANIA | 2020-06-18 | 4,000 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-310 |
| SPAIN | 2020-06-16 | 2,000 | Café Bar | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-309 |
| SPAIN | 2020-06-22 | 2,000 | Comunidad de propietarios demelza beach | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-308 |
| SPAIN | 2020-06-23 | 7,500 | Miraclia (telecommunications company) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-307 |
| GERMANY | 2020-06-30 | 1,240,000 | Allgemeine Ortskrankenkasse ('AOK') (health insurance company) | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-306 |
| HUNGARY | 2020-01-24 | 1,450 | Accounting firm | Art. 24 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-305 |
| HUNGARY | 2020-03-19 | 5,800 | Unknown Company | Art. 6 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-304 |
| HUNGARY | 2020-03-26 | 2,890 | Bank | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-303 |
| ESTONIA | 2020-04-30 | 500 | Housing Association | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-302 |
| ROMANIA | 2020-04-23 | 3,000 | Telekom Romania Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-301 |
| SPAIN | 2020-06-09 | 2,000 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-300 |
| SPAIN | 2020-06-09 | 2,000 | Attorney | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-299 |
| SPAIN | 2020-06-09 | 3,000 | Salad Market S.L. (Catering Company) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-298 |
| ROMANIA | 2020-04-23 | 3,000 | Estee Lauder Romania | Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-297 |
| BELGIUM | 2020-05-14 | 50,000 | Social Media Provider | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-296 |
| BULGARIA | 2020-04-14 | 2,000 | Political Party | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-295 |
| NORWAY | 2020-05-03 | 134,000 | Telenor Norge AS | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-294 |
| SPAIN | 2020-06-09 | 40,000 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-293 |
| NORWAY | 2020-09-03 | 276,000 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-292 |
| SPAIN | 2020-06-04 | 4,000 | Iberdrola Clientes | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-291 |
| SPAIN | 2020-06-09 | 25,000 | Glovoapp23 | Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-290 |
| SPAIN | 2020-06-09 | 39,000 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-289 |
| SPAIN | 2020-06-09 | 75,000 | Equifax Iberica, S.L. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-288 |
| SPAIN | 2020-06-09 | 1,000 | Property Owner | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-287 |
| SPAIN | 2020-06-09 | 540 | Chenming Ye (Bazar Real) | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-286 |
| SPAIN | 2020-06-09 | 5,000 | Consulting de Seguridad e Investigacion Mira Dp Madrid S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-285 |
| HUNGARY | 2020-03-09 | 870 | Creditor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-284 |
| FINLAND | 2020-05-29 | 72,000 | Taksi Helsinki | Art. 5 GDPR, Art. 6 GDPR, Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-283 |
| BELGIUM | 2020-05-29 | 1,000 | Non-profit organisation | Art. 6 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-282 |
| FINLAND | 2020-05-22 | 12,500 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-281 |
| FINLAND | 2020-05-22 | 16,000 | Kymen Vesi Oy | Art. 35 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-280 |
| FINLAND | 2020-05-22 | 100,000 | Posti Group Oyj | Art. 12 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-279 |
| IRELAND | 2020-05-17 | 75,000 | Tusla Child and Family Agency | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-278 |
| DENMARK | 2020-05-15 | 6,700 | JobTeam A/S DKK | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-277 |
| SWEDEN | 2020-05-12 | 11,200 | Health and Medical Board of the Region of Örebro County | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-276 |
| ROMANIA | 2020-05-05 | 5,000 | Banca Comercială Română SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-275 |
| THE NETHERLANDS | 2020-04-30 | 725,000 | Unknown Organisation | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-274 |
| SWEDEN | 2020-04-29 | 18,700 | National Government Service Centre (NGSC) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-273 |
| BELGIUM | 2020-04-28 | 50,000 | Proximus SA | Art. 31 GDPR, Art. 58 GDPR, Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-272 |
| GERMANY | 2019 | 50,000 | Unknown Company | Art. 15 GDPR, Art. 28 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-271 |
| BULGARIA | 2020-01-06 | 5,110 | Utility Company | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-270 |
| BULGARIA | 2020-02-20 | 2,560 | L.E. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR, Art. 6 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-269 |
| BULGARIA | 2020-02-20 | 2,560 | T.K. EOOD | Art. 25 (1) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-268 |
| POLAND | 2020-03-09 | 4,400 | Vis Consulting Sp. z o.o. | Art. 31 GDPR, Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-267 |
| SPAIN | 2020-03-25 | 5,000 | Xfera Moviles S.A. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-266 |
| ITALY | 2020-02-13 | 4,000 | Comune di Urago | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-265 |
| ROMANIA | 2020-03-25 | 3,000 | Dante International | Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-264 |
| ROMANIA | 2020-03-25 | 4,150 | Vodafone Romania | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-263 |
| ROMANIA | 2020-03-25 | 3,000 | Enel Energie | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-262 |
| ROMANIA | 2020-03-25 | 2,000 | SOS Infertility Association | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-261 |
| HUNGARY | 2020-03-04 | 290 | Representative of a local government | Art. 5 GDPR, Art. 6 GDPR, Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-260 |
| HUNGARY | 2019-10-15 | 2,860 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-259 |
| HUNGARY | 2019-08-08 | 1,715 | Government Office Managing the Real Estate Register | Art. 5 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-258 |
| HUNGARY | 2019-08-02 | 4,290 | Public area maintenance company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-257 |
| HUNGARY | 2019-07-17 | 8,575 | Budapest Environs Regional Court | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-256 |
| HUNGARY | 2019-06-26 | 2,850 | Financial Enterprise | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-255 |
| HUNGARY | 2019-06-26 | 2,850 | Unknown | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-254 |
| HUNGARY | 2019-06-03 | 2,850 | Claim management company | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-253 |
| HUNGARY | 2019-05-31 | 2,000 | Local bank | Art. 12 (3), (4), (5) GDPR, Art. 15 GDPR, Art. 18 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-252 |
| HUNGARY | 2019-05-21 | 286 | Directorate of Social and Child Welfare Institutions of the Ferencvaros District of Budapest | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-251 |
| GREECE | 2020-03-20 | 8,000 | Speech and Special Education Centre - Mihou Dimitra | Art. 15 GDPR, Art. 58 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-250 |
| ITALY | 2020-02-06 | 20,000 | RTI - Reti Televisive Italiane s.p.a. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-249 |
| SPAIN | 2020-03-19 | 6,000 | Oliveros Ustrell, S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-248 |
| SPAIN | 2020-03-16 | 6,000 | Amalfi Servicios de Restauracion S.L. | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-247 |
| SPAIN | 2020-03-12 | 2,000 | Homeowners Association | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-246 |
| SPAIN | 2020-03-06 | 3,200 | Retailer | Art. 13 GDPR, Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-245 |
| SPAIN | 2020-03-16 | 4,000 | Private Person | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-244 |
| SPAIN | 2020-03-16 | 5,000 | Centro De Estudio Dirigidos Delta, S.L. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-243 |
| GREECE | 2020-02-21 | 5,000 | Public Power Corporation S.A. | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-242 |
| ROMANIA | 2020-02-11 | 3,000 | Vodafone Romania | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-241 |
| SPAIN | 2020-03-18 | 30,000 | Telefónica | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-240 |
| CROATIA | 2020-03-13 | Unknown | Bank (name not available at the moment) | Art. 15 (1), (3) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-239 |
| GERMANY | 2019-08-05 | 200 | Private person (YouTube-Channel) | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-238 |
| NORWAY | 2020-02-28 | Only intention to issue fine | Coop Finnmark SA | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-237 |
| GERMANY | 2019 | 2,000 | Restaurant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-236 |
| NORWAY | 2020-02-26 | Only intention to issue fine | Rælingen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-235 |
| ICELAND | 2020-03-10 | 9,000 | Breiðholt Upper Secondary School | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-234 |
| ICELAND | 2020-03-10 | 20,600 | National Center of Addiction Medicine ('SAA') | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-233 |
| SWEDEN | 2020-03-11 | 5,000,000 | Google LLC | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-232 |
| DENMARK | 2020-03-10 | 14,000 | Gladsaxe Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-231 |
| DENMARK | 2020-03-10 | 7,000 | Hørsholm Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-230 |
| SPAIN | 2020-03-09 | 15,000 | Gesthotel Activos Balagares | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-229 |
| SPAIN | 2020-03-06 | 4,000 | Private individual | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-228 |
| ITALY | 2020-03-06 | 4,000 | Liceo Scientifico Nobel di Torre del Greco | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-227 |
| ITALY | 2020-03-06 | 4,000 | Liceo Artistico Statale di Napoli | Art. 5 GDPR, Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-226 |
| SPAIN | 2020-03-04 | 60,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-225 |
| POLAND | 2020-03-04 | 0 | School in Gdansk (Danzig) (fine imposed against town of Gdansk) | Art. 5 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-224 |
| SPAIN | 2020-03-03 | 24,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-223 |
| SPAIN | 2020-03-03 | 40,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-222 |
| SPAIN | 2020-03-03 | 42,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-221 |
| SPAIN | 2020-03-03 | 1,800 | Solo Embrague | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-220 |
| SPAIN | 2020-02-28 | 3,600 | AEMA Hispánica | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-219 |
| THE NETHERLANDS | 2020-03-03 | 525,000 | Royal Dutch Tennis Association ('KNLTB') | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-218 |
| SPAIN | 2020-02-25 | 6,000 | Casa Gracio Operation | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-217 |
| SPAIN | 2020-02-25 | 48,000 | HM Hospitales | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-216 |
| SPAIN | 2020-02-28 | 48,000 | Vodafone ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-215 |
| SPAIN | 2020-02-27 | 120,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-214 |
| ITALY | 2020-01-23 | 30,000 | Sapienza Università di Roma | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-213 |
| ITALY | 2020-01-23 | 30,000 | Azienda Ospedaliero Universitaria Integrata di Verona (Hospital) | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-212 |
| SPAIN | 2020-02-14 | 30,000 | Xfera Moviles S.A. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-211 |
| SPAIN | 2020-02-14 | 42,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-210 |
| SPAIN | 2020-02-14 | 80,000 | Iberdrola Clientes | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-209 |
| SPAIN | 2020-02-18 | 1,500 | Mymoviles Europa 2000, S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-208 |
| SPAIN | 2020-02-14 | 3,000 | Colegio Arenales Carabanchel (School) | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-207 |
| SPAIN | 2020-02-14 | 2,500 | Grupo Valsor Y Losan, S.L. | Art. 5 (1) f) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-206 |
| GERMANY | 2019 | Unknown | Hamburger Volksbank eG | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-205 |
| GERMANY | 2019 | 20,000 | Hamburger Verkehrsverbund GmbH (HVV GmbH) | Art. 33 GDPR, Art. 34 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-204 |
| GERMANY | 2019 | 51,000 | Facebook Germany GmbH | Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-203 |
| ITALY | 2020-01-15 | 10,000 | Community of Francavilla Fontana | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-202 |
| SPAIN | 2020-02-04 | 1,500 | Cafetería Nagasaki | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-201 |
| SPAIN | 2020-02-03 | 800 | Automoción | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-200 |
| SPAIN | 2020-02-03 | 5,000 | Queseria Artesenal Ameco S.L. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-199 |
| SPAIN | 2020-02-03 | 6,670 | Banco Bilbao Vizcaya Argentaria S.L. | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-198 |
| SPAIN | 2020-02-03 | 75,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-197 |
| SPAIN | 2020-02-03 | 20,000 | Iberia Lineas Aereas de Espana, S.A. Operadora Unipersonal | Art. 5 GDPR, Art. 6 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-196 |
| SPAIN | 2020-02-03 | 50,000 | Vodafone España, S.A.U. | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-195 |
| SPAIN | 2020-02-03 | 60,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-194 |
| SPAIN | 2020-02-03 | 75,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-193 |
| SPAIN | 2020-02-03 | 60,000 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-192 |
| SPAIN | 2020-01-14 | 3,600 | Zhang Bordeta 2006, S.L. (Store and Restaurant) | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-191 |
| GERMANY | 2019-10-24 | 100,000 | Food company | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-190 |
| ITALY | 2020-01-15 | 27,800,000 | TIM (telecommunications operator) | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-189 |
| GREECE | 2019-12-19 | 150,000 | Aegean Marine Petroleum Network Inc. | Art. 5 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-188 |
| ITALY | 2019-12-11 | 3,000,000 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-187 |
| ITALY | 2019-12-11 | 8,500,000 | Eni Gas e Luce | Art. 5 GDPR, Art. 6 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-186 |
| ROMANIA | 2019-12-13 | 5,000 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 9 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-185 |
| ROMANIA | 2019-12-13 | 5,000 | Entirely Shipping & Trading S.R.L. | Art. 5 (1) GDPR, Art. 6 GDPR, Art. 7 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-184 |
| GREECE | 2020-01-13 | 15,000 | Allseas Marine S.A. | Art. 5 (1) a), (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-183 |
| CYPRUS | 2020-01-13 | 1,000 | eShop for Sports (M.L. PRO.FIT SOLUTIONS LTD) | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-182 |
| CYPRUS | 2019-10-25 | 2,000 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-181 |
| CYPRUS | 2019-10-25 | 10,000 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-180 |
| CYPRUS | 2019-10-25 | 70,000 | LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd | Art. 6 GDPR, Art. 9 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-179 |
| CYPRUS | 2020-01-13 | 9,000 | Social Insurance Services of the Ministry of Labor, Welfare and Social Insurance | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-178 |
| ROMANIA | 2019-12-16 | 6,000 | SC Enel Energie S.A. (Electricity Distributor) | Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 21 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-177 |
| ROMANIA | 2019-12-10 | 14,000 | Hora Credit IFN SA | Art. 5 GDPR, Art. 25 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-176 |
| SPAIN | 2020-01-07 | 10,000 | Asociación de Médicos Demócratas | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-175 |
| SPAIN | 2020-01-07 | 75,000 | EDP Comercializadora, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-174 |
| SPAIN | 2020-01-07 | 75,000 | EDP España S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-173 |
| SPAIN | 2020-01-09 | 3,000 | Vodafone España, S.A.U. | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-172 |
| SPAIN | 2020-01-07 | 44,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-171 |
| GERMANY | 2019 | 294,000 | Unknown | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-170 |
| BELGIUM | 2019-12-17 | 15,000 | Website providing legal information | Art. 6 GDPR, Art. 12 GDPR, Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-169 |
| BULGARIA | 2019-10-08 | 5,112 | The Ministry of Interior Affairs | Art. 5 (1) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-168 |
| BULGARIA | 2019-10-07 | 511 | B.D. | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-167 |
| BULGARIA | 2019-10-28 | 511 | Employer | Art. 12 (3) GDPR, Art. 15 (1) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-166 |
| BULGARIA | 2019-09-03 | 1,121 | Private enforcement agent | Art. 12 (4) GDPR, Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-165 |
| BULGARIA | 2019-09-03 | 11,760 | Commercial representative of telecommunication service provider | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-164 |
| BULGARIA | 2019-09-03 | 5,113 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-163 |
| BULGARIA | 2019-09-03 | 1,022 | Telecommunication service provide | Art. 6 (1) GDPR, Art. 25 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-162 |
| SPAIN | 2019-12-10 | 5,000 | Shop Macoyn, S.L. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-161 |
| ROMANIA | 2019-11-29 | 500 | Homeowners Association | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-160 |
| BELGIUM | 2019-12-17 | 2,000 | Nursing Care Organisation | Art. 12 GDPR, Art. 15 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-159 |
| UNITED KINGDOM | 2019-12-17 | 320,000 | Doorstep Dispensaree Ltd. (Pharmacy) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-158 |
| HUNGARY | 2019-12-11 | 1,430 | Unknown Company | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 24 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-157 |
| ROMANIA | 2019-12-18 | 2,000 | Telekom Romania Mobile Communications SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-156 |
| GREECE | 2019-10-18 | 20,000 | Wind Hellas Telecommunications | Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-155 |
| THE NETHERLANDS | 2019-10-31 | 50,000 | Menzis (Health Insurance Company) | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-154 |
| SPAIN | 2019-10-23 | 60,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-153 |
| SPAIN | 2019-11-06 | 60,000 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-152 |
| SPAIN | 2019-11-19 | 6,000 | Sports Bar | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-151 |
| HUNGARY | 2019-10-24 | 7,400 | Military Hospital | Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-150 |
| ROMANIA | 2019-12-02 | 2,000 | Nicola Medical Team 17 SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-149 |
| ROMANIA | 2019-11-26 | 3,000 | Modern Barber | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-148 |
| SPAIN | 2019-12-10 | 1,600 | Megastar SL | Art. 5 (1) c) GDPR, Art. 13 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-147 |
| SPAIN | 2019-12-03 | 5,000 | Linea Directa Aseguradora | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-146 |
| ROMANIA | 2019-12-16 | 2,000 | Globus Score SRL | Art. 58 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-145 |
| SWEDEN | 2019-12-16 | 35,000 | Nusvar AB | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-144 |
| GERMANY | 2019 | 800 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-143 |
| SPAIN | 2019-12-03 | 1,500 | Cerrajeria Verin S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-142 |
| SPAIN | 2019-11-28 | 75,000 | Curenergía Comercializador de último recurso | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-141 |
| BULGARIA | 2019-09-03 | 28,100 | National Revenue Agency | Art. 6 (1) GDPR, Art. 58 (2) e) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-140 |
| HUNGARY | 2019-10 | 15,100 | Town of Kerepes | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-139 |
| SPAIN | 2019 | 3,600 | AMADOR RECREATIVOS, S.L | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-138 |
| SPAIN | 2019 | 9,000 | Employer | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-137 |
| SPAIN | 2019 | 20,000 | Employer | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-136 |
| SPAIN | 2019 | 40,000 | Vodafone España, S.A.U. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-135 |
| SPAIN | 2019 | 30,000 | Vodafone España, S.A.U. | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-134 |
| SPAIN | 2019 | 48,000 | TELEFONICA MOVILES ESPAÑA, S.A.U. | Art. 5 (1) a) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-133 |
| SPAIN | 2019 | 48,000 | VODAFONE ONO, S.A.U. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-132 |
| SPAIN | 2019 | 36,000 | VODAFONE ONO, S.A.U. | Art. 5 (1) f) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-131 |
| SPAIN | 2019 | 21,000 | Vodafone España, S.A.U. | Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-130 |
| GERMANY | 2019-12-09 | 10,000 | Rapidata GmbH | Art. 37 GDPR | Insufficient involvement of data protection officer | https://www.enforcementtracker.com/ETid-129 |
| GERMANY | 2020-11-11 | 900,000 | Telecoms provider (1&1 Telecom GmbH) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-128 |
| ROMANIA | 2019-11-29 | 2,500 | Royal President S.R.L. | Art. 15 GDPR, Art. 6 GDPR, Art. 32 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-127 |
| ROMANIA | 2019-11-28 | 0 | ING Bank N.V. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-126 |
| ROMANIA | 2019-12-04 | 20,000 | S CNTAR TAROM SA (Airline) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-125 |
| BELGIUM | 2019-11-28 | 5,000 | Municipal alderman | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-124 |
| BELGIUM | 2019-11-28 | 5,000 | Mayor | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-123 |
| GERMANY | 2019-12-03 | 105,000 | Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-122 |
| SPAIN | Unknown | 10,000 | Ikea Ibérica | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-121 |
| LATVIA | 2019-11 | 150,000 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-120 |
| SPAIN | 2019-11-19 | 60,000 | Xfera Moviles S.A. | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-119 |
| FRANCE | 2019-11-21 | 500,000 | Futura Internationale | Art. 5 GDPR, Art. 6 GDPR, Art. 13 GDPR, Art. 14 GDPR, Art. 21 GDPR, Art. 31 GDPR, Art. 44 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-118 |
| SPAIN | 2019-11-14 | 30,000 | Telefónica SA | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-117 |
| ROMANIA | 2019-11-22 | 2,000 | BNP Paribas Personal Finance S.A. | Art. 12 GDPR, Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-116 |
| ROMANIA | 2019-11-25 | 11,000 | FAN Courier Express SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-115 |
| SPAIN | 2019-11-21 | 60,000 | Viaqua Xestión Integral Augas de Galicia | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-114 |
| SPAIN | 2019-11-19 | 60,000 | Corporación radiotelevisión espanola | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-113 |
| CZECH REPUBLIC | Unknown | 980 | Individual entrepreneur - no further details published | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-112 |
| CZECH REPUBLIC | Unknown | 588 | Alza.cz a.s. | Art. 6 GDPR, Art. 7 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-111 |
| SPAIN | 2019-11-13 | 3,000 | General Confederation of Labour ('CGT') | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-110 |
| SLOVAKIA | Unknown | 50,000 | Social Insurance Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-109 |
| PORTUGAL | 2019-03-19 | 2,000 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-108 |
| THE NETHERLANDS | 2019-10-31 | 900,000 | UWV (Dutch employee insurance service provider) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-107 |
| SPAIN | 2019-10-31 | 6,000 | Jocker Premium Invex | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-106 |
| SPAIN | 2019-11-06 | 900 | Cerrajero Online | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-105 |
| SPAIN | Unknown | 12,000 | Madrileña Red de Gas | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-104 |
| SPAIN | 2019-11-07 | 900 | TODOTECNICOS24H S.L. | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-103 |
| POLAND | 2019-10-16 | 47,000 | ClickQuickNow | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-102 |
| GERMANY | 2019 | 80,000 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-101 |
| SPAIN | 2019-10-25 | 36,000 | Vodafone España, S.A.U. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-100 |
| GERMANY | 2019-10-30 | Unknown | Deutsche Wohnen SE | Art. 5 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-99 |
| GERMANY | 2021-02-23 | 0 | Deutsche Wohnen SE | Art. 5 GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-98 |
| POLAND | 2019-10-18 | 9,380 | Major of Aleksandrów Kujawski | Art. 28 GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-97 |
| AUSTRIA | 2019-10-29 | 16,000,000 | Austrian Post | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-96 |
| SLOVAKIA | Unknown | 40,000 | Slovak Telekom | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-95 |
| SPAIN | 2019-10-16 | 8,000 | Iberdrola Clientes | Art. 31 GDPR | Insufficient cooperation with supervisory authority | https://www.enforcementtracker.com/ETid-94 |
| SPAIN | 2019-10-16 | 60,000 | Xfera Moviles S.A. | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-93 |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-92 |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-91 |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-90 |
| SLOVAKIA | Unknown | Unknown | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-89 |
| ROMANIA | 2019-09-26 | 9,000 | Inteligo Media SA | Art. 5 (1) a) GDPR, Art. 6 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-88 |
| CYPRUS | 2019 | 14,000 | Doctor | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-87 |
| SPAIN | 2019-10-01 | 30,000 | Vueling Airlines | Art. 5 GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-86 |
| ROMANIA | 2019-10-09 | 20,000 | Vreau Credit SRL | Art. 32 GDPR, Art. 33 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-85 |
| ROMANIA | 2019-10-09 | 15,000 | Raiffeisen Bank SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-84 |
| GREECE | 2019-10-07 | 200,000 | Telecommunication Service Provider | Art. 21 (3) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-83 |
| GREECE | 2019-10-07 | 200,000 | Telecommunication Service Provider | Art. 5 (1) c) GDPR, Art. 25 GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-82 |
| SPAIN | Unknown | 9,600 | Restaurant (SANTI 3000, S.L.) | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-81 |
| BELGIUM | 2019-09-17 | 10,000 | Merchant | Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-80 |
| POLAND | 2019-09-10 | 660,000 | Morele.net | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-79 |
| GERMANY | 2019-09-19 | 195,407 | Delivery Hero | Art. 15 GDPR, Art. 17 GDPR, Art. 21 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-78 |
| PORTUGAL | 2019-03-25 | 2,000 | Unknown | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-77 |
| PORTUGAL | 2019-02-05 | 20,000 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-76 |
| NORWAY | 2019-04-29 | 120,000 | Oslo Municipal Education Department | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-75 |
| HUNGARY | 2019-06-25 | 15,150 | Unknown | Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-74 |
| LATVIA | 2019-08-26 | 7,000 | Online Services | Art. 17 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-73 |
| BULGARIA | 2019-08-28 | 511,000 | DSK Bank | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-72 |
| BULGARIA | 2019-08-28 | 2,600,000 | National Revenue Agency | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-71 |
| SPAIN | 2019-08-16 | 60,000 | AVON COSMETICS | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-70 |
| AUSTRIA | 2019-07 | 11,000 | Private person (soccer coach) | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-69 |
| AUSTRIA | 2019-08 | 25,000 | Company in the medical sector | Art. 13 GDPR, Art. 35 GDPR, Art. 37 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-68 |
| SWEDEN | 2019-08-20 | 18,630 | School in Skellefteå | Art. 5 (1) c) GDPR, Art. 9 GDPR, Art. 35 GDPR, Art. 36 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-67 |
| ROMANIA | 2019-10-17 | 2,500 | UTTIS INDUSTRIES SRL | Art. 12 GDPR, Art. 13 GDPR, Art. 5 (1) c) GDPR, Art. 6 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-66 |
| GREECE | 2019-07-30 | 150,000 | PWC Business Solutions | Art. 5 (1) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 13 (1) c) GDPR, Art. 14 (1) c) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-65 |
| FRANCE | 2019-07-25 | 180,000 | ACTIVE ASSURANCES (car insurer) | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-64 |
| THE NETHERLANDS | 2019-06-18 | 350,000 | Haga Hospital | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-63 |
| ROMANIA | 2019-07-05 | 3,000 | LEGAL COMPANY & TAX HUB SRL | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-62 |
| HUNGARY | 2019-05-23 | 92,146 | Organizer of SZIGET festival and VOLT festival | Art. 6 GDPR, Art. 5 (1) b) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-61 |
| UNITED KINGDOM | 2020-10-30 | 20,450,000 | Marriott International, Inc | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-60 |
| ROMANIA | 2019-07-02 | 15,000 | WORLD TRADE CENTER BUCHAREST SA | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-59 |
| UNITED KINGDOM | 2020-10-16 | 22,046,000 | British Airways | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-58 |
| ROMANIA | 2019-06-27 | 130,000 | UNICREDIT BANK SA | Art. 25 (1) GDPR, Art. 5 (1) c) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-57 |
| SPAIN | Unknown | 60,000 | ENDESA (energy supplyer) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-56 |
| BULGARIA | 2019-03-26 | 5,100 | A.P. EOOD | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-55 |
| BULGARIA | 2019-04-08 | 510 | Medical centers | Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 9 (2) GDPR, Art. 6 (1) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-54 |
| HUNGARY | 2019-04-05 | 1,900 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-53 |
| HUNGARY | 2019-04-17 | 9,400 | Unknown | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-52 |
| FRANCE | 2019-06-13 | 20,000 | Employer UNIONTRAD COMPANY | Art. 5 (1) c) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 32 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-51 |
| GERMANY | 2019-05-09 | 1,400 | Police Officer | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-50 |
| SPAIN | Unknown | 27,000 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-49 |
| SPAIN | Unknown | 60,000 | Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL) | Art. 5 (1) f) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-48 |
| SPAIN | 2019-06-11 | 250,000 | Professional Football League (LaLiga) | Art. 5 (1) a) GDPR, Art. 7 (3) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-47 |
| SPAIN | Unknown | 5,000 | Vodafone España, S.A.U. | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-46 |
| PORTUGAL | 2018-07-17 | 400,000 | Public Hospital | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-45 |
| POLAND | 2019-04-25 | 12,950 | Sports association | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-44 |
| POLAND | 2019-03-26 | 220,000 | Private company working with data from publicly available sources | Art. 14 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-43 |
| NORWAY | 2019-03 | 170,000 | Bergen Municipality | Art. 5 (1) f) GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-42 |
| MALTA | 2019-02-18 | 5,000 | Lands Authority | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-41 |
| LITHUANIA | 2019-05-16 | 61,500 | Payment service provider UAB MisterTango | Art. 5 GDPR, Art. 32 GDPR, Art. 33 GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-40 |
| ITALY | 2019-04-17 | 50,000 | Italian political party Movimento 5 Stelle | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-39 |
| HUNGARY | 2019-04-05 | 34,375 | Hungarian political party | Art. 33 (1) GDPR, Art. 33 (5) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-38 |
| HUNGARY | 2019-03-04 | 3,200 | Unnamed financial institution | Art. 5 (1) b) GDPR, Art. 5 (1) c) GDPR, Art. 13 (3) GDPR, Art. 17 (1) GDPR, Art. 6 (4) GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-37 |
| HUNGARY | 2019-02-28 | 3,200 | Mayor's Office of the city of Kecdkemét | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-36 |
| HUNGARY | 2018-12-18 | 3,200 | Unknown | Art. 12 (4) GDPR, Art. 15 GDPR, Art. 18 (1) c) GDPR, Art. 13 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-35 |
| HUNGARY | 2019-02-20 | 1,560 | Debt collector | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-34 |
| HUNGARY | 2019-02-08 | 1,560 | Bank | Art. 5 (1) d) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-33 |
| GERMANY | 2019-03 | 50,000 | N26 | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-32 |
| GERMANY | 2018 | 500 | Unknown | Unknown | Unknown | https://www.enforcementtracker.com/ETid-31 |
| GERMANY | Unknown | 118 | Unknown | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-30 |
| GERMANY | 2018 | 20,000 | Unknown | Art. 33 (1) GDPR, Art. 34 (1) GDPR | Insufficient fulfilment of data breach notification obligations | https://www.enforcementtracker.com/ETid-29 |
| GERMANY | 2019-02-05 | 2,500 | Private person | Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-28 |
| GERMANY | 2019-04-12 | 80,000 | Company in the financial sector | Art. 5 GDPR, Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-27 |
| GERMANY | 2018-12-17 | 5,000 | Kolibri Image Regina und Dirk Maass GbR | Art. 28 (3) GDPR | Insufficient data processing agreement | https://www.enforcementtracker.com/ETid-26 |
| GERMANY | 2018-11-21 | 20,000 | Knuddels.de | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-25 |
| FRANCE | 2019-05-28 | 400,000 | SERGIC (Real Estate) | Art. 5 (1) e) GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-24 |
| FRANCE | 2019-01-21 | 50,000,000 | Google LLC | Art. 13 GDPR, Art. 14 GDPR, Art. 6 GDPR, Art. 5 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-23 |
| DENMARK | 2021-02-12 | 13,450 | IDdesign A / S | Art. 5 (1) e) GDPR, Art. 5 (2) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-22 |
| DENMARK | 2019 | 160,000 | Taxa 4x35 | Art. 5 (1) e) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-21 |
| CZECH REPUBLIC | 2019-05-06 | 194 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-20 |
| CZECH REPUBLIC | Unknown | 3,140 | UniCredit Bank Czech Republic and Slovakia, a.s. | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-19 |
| CZECH REPUBLIC | 2019-03-21 | 10,000 | Unknown | Art. 5 (1) GDPR | Non-compliance with general data processing principles | https://www.enforcementtracker.com/ETid-18 |
| CZECH REPUBLIC | 2019-02-26 | 776 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-17 |
| CZECH REPUBLIC | 2018-10-25 | 388 | Unknown | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-16 |
| CZECH REPUBLIC | 2019-02-04 | 1,165 | Credit brokerage | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-15 |
| CZECH REPUBLIC | 2019-02-28 | 582 | Unknown | Art. 32 GDPR | Insufficient technical and organisational measures to ensure information security | https://www.enforcementtracker.com/ETid-14 |
| CZECH REPUBLIC | 2019-02-04 | 1,165 | Car renting company | Art. 5 (1) a) GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-13 |
| CZECH REPUBLIC | 2019-01-10 | 388 | Employer | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-12 |
| CYPRUS | 2019 | 10,000 | Newspaper | Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-11 |
| CYPRUS | 2019 | 5,000 | State Hospital | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-10 |
| BULGARIA | 2019-02-22 | 500 | Employer | Art. 15 GDPR | Insufficient fulfilment of data subjects rights | https://www.enforcementtracker.com/ETid-9 |
| BULGARIA | 2019-01-17 | 500 | Bank | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-8 |
| BULGARIA | 2019-02-26 | 27,100 | Telecommunication service provider | Art. 6 GDPR, Art. 5 (1) a) GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-7 |
| BULGARIA | 2018-12-04 | 500 | Bank | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-6 |
| BELGIUM | 2019-05-28 | 2,000 | Mayor | Art. 5 (1) b) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-5 |
| AUSTRIA | 2018-12-20 | 2,200 | Private person | Art. 5 (1) a) GDPR, Art. 5 (1) c) GDPR, Art. 6 (1) GDPR, Art. 13 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-4 |
| AUSTRIA | 2018-09-27 | 300 | Private car owner | Art. 5 (1) a) GDPR, Art. 6 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-3 |
| AUSTRIA | 2018 | 1,800 | Kebab restaurant | Art. 5 GDPR, Art. 13 GDPR, Art. 14 GDPR | Insufficient legal basis for data processing | https://www.enforcementtracker.com/ETid-2 |
| AUSTRIA | 2018-12-09 | 4,800 | Betting place | Art. 13 GDPR | Insufficient fulfilment of information obligations | https://www.enforcementtracker.com/ETid-1 |
