312 GDPR fines

Enforcement decisions from 21 jurisdictions, reported by INPLP member firms. Each entry links to the authority’s own publication where one is on record.

• Dutch DPA

  Netherlands·2021-07-22

  750,000 EUR
  Art. 12Violating the privacy of young children.

• Foodinho S.r.l.

  Italy·2021-07-10

  2,600,000 EUR
  Art. 5Art. 13Art. 22Art. 30Art. 35Art. 37Failure to comply with general data processing principles, with the obligation to provide sufficient information to the data subject and to implement suitable measures for automated processing.

• Mermaids

  United Kingdom·2021-07-08

  25,000 GBP
  Art. 5Monetary fine for failure to provide adequate physical security arrangements to protects its customers' personal data as per Art 32 GDPR. The company also failed to prevent fraudulent activities on its customers' bank cards as per Art 5(1)(f).

• Dutch DPA

  Netherlands·2021-07-07

  450,000 EUR
  Art. 32Insufficient security measures, even after several data breaches. The UWV has insufficiently checked and evaluated its own security measures.

• Dutch DPA

  Netherlands·2021-06-10

  12,000 EUR
  Art. 32The orthodontic practice is fined because new patients could register via an unsecured website.

• Dutch DPA

  Netherlands·2021-05-19

  15,000 EUR
  Art. 9Art. 32A maintenance company (CP&A) is fined because of a violation of art. 9,lid 1 by processing health data of its employees. In addition, CP&A did not take adequate security measures for these data processing.

• Iren Mercato S.p.A.

  Italy·2021-05-13

  2,856,169 EUR
  Art. 6Art. 7Art. 5Insufficient legal basis for data processing, improper use of the legitimate interest as a legal basis for data processing and breach of the principles of accountability.

• Comune di Bolzano

  Italy·2021-05-13

  84,000 EUR
  Art. 5Art. 9Art. 13Art. 35Failure to comply with data minimisation principles, with the obligation to provide sufficient information to the data subject, failure to provide an impact assessment.

• Dutch DPA

  Netherlands·2021-05-12

  525,000 EUR
  Art. 27Art. 3Locatefamily.com publishes people's addresses and phone numbers, often without those people's knowledge.

• Dutch DPA

  Netherlands·2021-05-11

  7,500 EUR
  Art. 33Not reporting a data breach, which leaked people's political views. In the event of a serious data breach, a reporting obligation applies.

• Dutch DPA

  Netherlands·2021-05-11

  475,000 EUR
  Art. 33Reporting a data breach 22 days to late.

• Dutch DPA

  Netherlands·2021-04-29

  600,000 EUR
  Art. 5Art. 6Using wifitracking without any legal basis by a town/municipality but to follow shoppers and people who live or work in the city center.

• Fastweb S.p.A.

  Italy·2021-03-25

  4,501,868 EUR
  Art. 5Art. 6Art. 25Art. 24Art. 32Art. 33Art. 34Failure to comply with general data processing principles, with the principle of accountability and privacy by design and by default, to report the breach of personal data

• Tik Tok

  Italy·2021-03-25

  Temporary limitation of the processing of personal data
  Art. 25Failure to comply with the principle of accountability and privacy by design and by default.

• Budapest Főváros Kormányhivatala XI. kerületi Hivatala

  Hungary·2021-03-14

  10,000,000 HUF
  Art. 32Art. 33Art. 34Data breach resulting in a high risk to the rights and freedoms of natural persons

• Dutch DPA

  Netherlands·2021-02-12

  440,000 EUR
  Art. 32No sufficient measures in place to prevent access to medical records

• Roma Capitale

  Italy·2021-02-11

  350,000 EUR
  Art. 5Art. 6Art. 28Art. 32Failure to comply with general data processing principles, insufficient legal basis for data processing, failure to stipulate a data processing agreement, insufficient l measures to ensure information security.

• Azienda Ospedaliero Universitaria Senese

  Italy·2021-01-27

  10,000 EUR
  Art. 5Art. 9This fine concerns breaches due to: (i) failure to comply with the integrity and confidentiality principle; (ii) processing of special categories of personal data without adequate legal basis.

• Azienda USL della Romagna

  Italy·2021-01-27

  50,000 EUR
  Art. 5Art. 9Art. 32Failure to comply with general data processing principles, processing of special categories of personal data without proper legal basis, insufficient technical and organisational measures to ensure the ongoing information security.

• Roma Capitale

  Italy·2020-12-17

  500,000 EUR
  Art. 5Art. 13Art. 14Art. 28Art. 32Failure to comply with general data processing principles, the obligation to provide sufficient information to the data subject, provide a contract or other legal act for the processing by the processor, measures to ensure information security.

• Grammar school Nové Zámky

  Slovakia·2020-11-24

  700 EUR
  Art. 5Insufficient legal basis for data processing

• Ticketmaster UK Limited

  United Kingdom·2020-11-13

  1,250,000 GBP
  Art. 5Monetary fine for failure to provide adequate physical security arrangements to protects its customers' personal data as per Art 32 GDPR. The company also failed to prevent fraudulent activities on its customers' bank cards as per Art 5(1)(f).

• Vodafone Italia S.p.A.

  Italy·2020-11-12

  12,251,601 EUR
  Art. 5Art. 6Art. 7Art. 15Art. 16Art. 21Art. 24Art. 25Art. 32Art. 33No measures ensuring the control of the legitimacy of the data collected, consent for the sharing of data, marketing actvies in contrast with the right to objects, inadequate security measures and mismanagement of data breaches

• Marriott International Inc

  United Kingdom·2020-10-30

  18,400,000 GBP
  Art. 32Monetary fine for failure to provide adequate security arrangements to protects its customers' personal data as per Art 32 GDPR

• Natural person

  Slovakia·2020-10-29

  300 EUR
  Art. 5Insufficient legal basis for data processing, breach of the principle of transparency

• AMERICAN COLLEGE OF GREECE (ACG)

  Greece·2020-10-29

  2,000 EUR
  Art. 12Delayed and incomplete response to rights of access and deletion

• Private Person - Doctor

  Austria·2020-10-19

  600 EUR
  Art. 4Art. 5Art. 9Art. 83Monetary fine; Lack of legal basis for data processing

• Private person

  Austria·2020-10-19

  150 EUR
  Art. 4Art. 5Art. 6Art. 83Monetary fine; Lack of legal basis for data processing

• British Airways

  United Kingdom·2020-10-16

  20,000,000 GBP
  Art. 32Monetary fine for failure to provide adequate security arrangements to protects its customers' personal data as per Art 32 GDPR

• SENECA TOURS s.r.o.

  Slovakia·2020-10-13

  1,300 EUR
  Art. 13Art. 5Art. 4breach of the principle of transparency, Insufficient legal basis for data processing

• Megareduceri TV SRL

  Romania·2020-10-01

  3,000 EUR
  Art. 83Failure to implement the corrective measure

• Owners associations Militari R

  ·2020-10-01

  2,000 EUR
  Art. 83Failure to implement the corrective measure

• QUALITA s.r.o.

  Slovakia·2020-09-09

  500 EUR
  Art. 12Insufficient legal basis for data processing, unathorized processing of perdonal data , breach of the principle of transparency

• Sanatatea Press Group SRL

  Romania·2020-09-08

  2,000 EUR
  Art. 1Breach of the security measures imposed by GDPR

• Owners association Navodari

  Romania·2020-09-01

  500 EUR
  Art. 5Art. 6Art. 83Illegal processing of personal data

• Private Citizen (pseudonymized)

  Greece·2020-08-26

  8,000 EUR
  Art. 5Unlawful and non-transparent use of CCTV in a private residence

• Primary school M.R.Štefánika

  Slovakia·2020-08-18

  6,000 EUR
  Art. 5Art. 6Art. 29Art. 12Art. 15Insufficient legal basis for data processing,absence of consent breach of information obligations, breach of the principles of accountability and transparency

• Compania Nationala Posta Romana

  Romania·2020-07-30

  2,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Bank of Cyprus Public Company Ltd

  Cyprus·2020-07-27

  15,000 EUR
  Loss of data and prevention of data subject's right of access

• Iliad Italia S.p.A.

  Italy·2020-07-09

  800,000 EUR
  Art. 5Art. 32This fine concerns breaches due to (i) failure to comply with the lawfulness, fairness and transparency principle; (ii)insufficient security measures applied to the storage of traffic data.

• Wind Tre S.p.A.

  Italy·2020-07-09

  16,729,600 EUR
  Art. 5Art. 6Art. 7Art. 12Art. 24Art. 25Failure to comply with the lawfulness, fairness and transparency, absence of consent for data processing, failure to take appropriate measures to provide information, failure to comply with the principle of accountability and privacy.

• Proleasing Motors SRL

  Romania·2020-07-09

  15,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Transport company Bratislava a.s.

  Slovakia·2020-07-07

  20,000 EUR
  Art. 5Insufficient legal basis for data processing, Breach of the information obligation

• Kaufland SR v.o.s.

  Slovakia·2020-07-07

  3,500 EUR
  Art. 12Art. 5Breach of the principle of transparency

• Dutch DPA

  Netherlands·2020-07-06

  830,000 EUR
  Art. 12Art. 15Too high barriers for the insight of your personal data.

• NEW YORK COLLEGE S.A.

  Greece·2020-06-29

  5,000 EUR
  Art. 5Violation of right to be informed

• Enel Energie Muntenia SA

  Romania·2020-06-18

  4,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Estee Lauder Romania SRL

  Romania·2020-06-11

  3,000 EUR
  Lack of legals basis for data processing

• Telekom Romania Communications SA

  Romania·2020-06-11

  3,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• TUSLA

  Ireland·2020-06-01

  40,000 EUR
  Art. 5accidental disclosure of contact, location and school information of children in foster care to a grandparent, allowing the grandparent to contact the foster parent about the children

• Banca Comerciala Romana SA

  Romania·2020-05-05

  5,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• TUSLA

  Ireland·2020-05-01

  75,000 EUR
  Art. 5accidentally disclosing contact and location data of a mother and child to their alleged abuser

• Dutch DPA

  Netherlands·2020-04-30

  725,000 EUR
  Art. 9Processing of fingerprints (biometric data) by obliging employees to have their fingerprints scanned when they log in and out for work.

• "SOS Infertilitatea" Association

  Romania·2020-03-25

  2,000 EUR
  Art. 58Non-cooperation with supervisory authority

• Dante International S.A. (owner of e-MAG.ro)

  Romania·2020-03-25

  3,000 EUR
  Art. 6Art. 21Non-compliance with lawful basis for data processing, non-observance of the data subject's right to object

• CENTER FOR SPEECH AND SPECIAL EDUCATION - MICHOU DIMITRA

  Greece·2020-03-20

  8,000 EUR
  Art. 5Art. 15Violation of parent's right to access personal data of minors

• Vodafone Romania S.A.

  Romania·2020-03-18

  3,000 EUR
  Art. 5Art. 32Infringement of data accuracy and confidentiality principles

• Dutch DPA

  Netherlands·2020-03-03

  525,000 EUR
  Art. 5Art. 6The Dutch DPA imposed a fine of 525,000 euros for the unlawful sale of personal data by the Dutch national tennis association the KNLTB.

• PUBLIC POWER COMPANY S.A. HELLAS (DEI)

  Greece·2020-02-21

  5,000 EUR
  Art. 12Art. 15Violation of right to access

• Large Social Media Company

  Germany·2020-02-13

  51,000 EUR
  Art. 37Lack of appointment of data protection officer

• Italian Data Protection Authority

  Italy·2020-02-06

  20,000 EUR
  Art. 5This fine concerns the violation of principles of lawfulness and fairness of data processing

• BeMi real estate agency, s.r.o. as the controller, processor of BeMi real estate agency, s.r.o.

  Slovakia·2020-01-27

  2,580 EUR
  Art. 5Art. 33The processor has violated the principle of data confidentiality and the controller has breached the obligation under Art. 33 GDPR to report the breach of personal data.

• The town of Rajecké Teplice

  Slovakia·2020-01-24

  10,000 EUR
  Art. 5Art. 12Art. 13The Controller processed personal data in an illegal manner, kept camera recordings for longer than the time he had set, did not provide the data subjects with information pursuant to Art.13 GDPR in connection with the camera information system.

• Slovak Fishermen's Association, Municipal Organization of Žilina

  Slovakia·2020-01-24

  The Authority did not impose a measure to remedy the identified deficiencies The Authority did not impose a fine, instead reprimanded the controller for the breach of the principle of legality
  Art. 5The controller published personal data of the proposer without given consent of the proposer

• Italian Data Protection Authority

  Italy·2020-01-23

  30,000 EUR
  Art. 5This fine concerns insufficient technical and organisational measures to ensure information security

• Italian Data Protection Authority

  Italy·2020-01-23

  30,000 EUR
  Art. 32This fine concerns insufficient technical and organisational measures to ensure information security

• Entirely Shipping&Trading S.R.L.

  Romania·2020-01-16

  5,000 EUR
  Art. 5Breach of the controller's obligation to inform data subjects Breach of the principles governing the processing of personal data Lack of legal basis for the processing of data Failure to comply with the conditions for consent

• TIM S.p.A.

  Italy·2020-01-15

  27,802,946 EUR
  Art. 5Art. 6Art. 7Art. 13Art. 21Art. 24Art. 32Art. 33Concerns breaches due to (i) unsolicited telemarketing calls; (ii) absence of consent for marketing activities; (iii) invalid consent collected for the use of data controller's apps; (iv) inadequate security measures; (v) mismanagement of data breaches

• Enel Energie S.A.

  Romania·2020-01-14

  3,000 EUR
  Art. 5Art. 21Infrigement of data accuracy principle Lack of legal basis for data processing Non-observance of the data subject's right to object

• ALLSEAS MARINE S.A.

  Greece·2020-01-13

  15,000 EUR
  Art. 5Violation of an employee's right to access their personal data and unlawful operation of a CCTV system.

• Hora Credit IFN S.A.

  Romania·2020-01-13

  10,000 EUR
  Art. 5Breach of data accuracy and confidentiality principles; Inssuficient organisational and technical measures; Failure to comply with the deadline to notify the personal data breach to the supervisory authority

• Stavebné bytové družstvo Trenčín

  Slovakia·2020-01-10

  0 EUR
  Art. 5Without a legal basis, the controller enabled the proposer's surname in connection with the information "returned stamps for action and refunded court fee", which was subsequently delivered by the controller to 32 owners of flats and non - residential pre

• The town of Tesáre

  Slovakia·2020-01-07

  2,500 EUR
  Art. 5The controller published the birth number without the existence of a legal basis in the minutes of the regular meeting of the Municipal Council in Tesáry

• Grand Ideas Ltd

  Cyprus·2020

  1,000 EUR
  Art. 6Sending unauthorised marketing email without consent

• Homeowners Association

  Romania·2019-12-23

  500 EUR
  Art. 32Lack of adeqaute organisational and technical measures

• Doorstep Dispensaree Ltd. (Pharmacy)

  United Kingdom·2019-12-20

  320,000 GBP
  Art. 32Monetary fine for failure to provide adequate physical security arrangements to protects its customers' personal data as per Art 32 GDPR

• TESCO STORES SR, a.s.

  Slovakia·2019-12-19

  10,000 EUR
  Art. 12The proposal's request concerning the exercise of the right of access to his personal data was not compiled with within the time limit set in the GDPR.

• AEGEAN MARINE PETROLEUM NETWORK INC.

  Greece·2019-12-19

  150,000 EUR
  Art. 5Violation of essential data protection principles mainly integrity and accountability

• Website operator

  Belgium·2019-12-17

  15,000 EUR
  Art. 6Art. 12Insufficient legal basis for data processing (no lawful consent); and violation of transparency obligations

• Globus Score S.R.L.

  Romania·2019-12-16

  2,000 EUR
  Art. 83Art. 58Lack of cooperation with Romanian Data Protection Authority

• Modern Barber S.R.L.

  Romania·2019-12-13

  3,000 EUR
  Art. 83Art. 58Lack of cooperation with Romanian Data Protection Authority

• Nicola Medical Team 17 S.R.L.

  Romania·2019-12-13

  2,000 EUR
  Art. 83Art. 58Lack of cooperation with Romanian Data Protection Authority

• Eni Gas e Luce S.p.A. (electricity and gas)

  Italy·2019-12-11

  3,000,000 EUR
  Art. 5Art. 32Breaches due to the conclusion of unsolicited contracts for the supply of electricity and gas under ‘deregulated market’ conditions, due to the inadequacy of privacy policies adopted by Eni Gas e Luce S.p.A.

• Eni Gas e Luce S.p.A. (electricity and gas)

  Italy·2019-12-11

  8,500,000 EUR
  Art. 5Art. 6Art. 7Art. 25The violations include (i) the use of advertising calls without the consent of the contacted person; (ii) the absence of adequate technical and organisational measures; (iii) the unlawful data retention and (iv) the unlawful processing of personal data ac

• Newspaper

  Turkey·2019-12-09

  125,000 TRY
  Art. 12Unlawful processing of sensitive data

• Unknown

  Germany·2019-12-09

  9,550,000 EUR
  Art. 32Inadequate technical and organisational measures to ensure information security

• Unknown

  Germany·2019-12-09

  10,000 EUR
  Art. 37Lack of appointment of data protection officer

• The town of Rajec

  Slovakia·2019-12-03

  9,000 EUR
  Art. 5In the record of processing activities, the controller did not specify the legal basis for the processing of personal data by the camera information system.

• Unknown

  Germany·2019-12-03

  105,000,000 EUR
  Art. 5Non-compliance with general data processing principles

• Royal President S.R.L.

  Romania·2019-11-29

  2,500 EUR
  Art. 12Art. 15Art. 5Art. 32Lack of adeqaute organisational and technical measures

• SC CNTAR TAROM S.A.

  Romania·2019-11-29

  20,000 EUR
  Art. 32Lack of suitable organisational and technical measures

• Bank

  Turkey·2019-11-26

  100,000 TRY
  Art. 12Illegal use of customer data

• Mayor

  Belgium·2019-11-25

  5,000 EUR
  Art. 5Art. 6Violation of purpose limitation principle, and insufficient legal basis for data processing

• Candidate in local elections

  Belgium·2019-11-25

  5,000 EUR
  Art. 5Art. 6Violation of purpose limitation principle, and insufficient legal basis for data processing

• Kebab restaurant

  Austria·2019-11-25

  1,800 EUR
  Art. 5Art. 6Monetary fine because of lack of insufficient legal basis for data processing, lack of video surveillance indication and excessive storage duration

• ING Bank N.V. Amsterdam - Bucharest Subsidiary

  Romania·2019-11-25

  80,000 EUR
  Art. 25Art. 5Art. 32Lack of required organisational and technical measures

• Futura Internationale

  France·2019-11-21

  500,000 EUR
  Art. 5Art. 6Art. 13Art. 14Art. 21Unsatisfactory execution of the rights of the data subjects

• Viaqua Xestión Integral Augas de Galicia

  Spain·2019-11-21

  60,000 EUR
  Art. 6Inadequate legal basis for data processing

• Corporación radiotelevisión espanola

  Spain·2019-11-19

  60,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Xfera Moviles S.A.

  Spain·2019-11-19

  60,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Telefónica SA

  Spain·2019-11-14

  30,000 EUR
  Art. 5Failure to comply the general data processing principles

• General Confederation of Labour ('CGT')

  Spain·2019-11-13

  3,000 EUR
  Art. 6Inadequate legal basis for data processing

• Insurance Company

  Turkey·2019-11-07

  100,000 TRY
  Art. 12Unlawful use of public data

• Doctor

  Turkey·2019-11-07

  50,000 TRY
  Art. 12Sending commercial messages to mobile phone

• TODOTECNICOS24H S.L.

  Spain·2019-11-07

  900,000 EUR
  Art. 13Insufficient fulfilment of information obligations

• Cerrajero Online

  Spain·2019-11-06

  1,500 EUR
  Art. 13Insufficient fulfilment of information obligations

• Aukčný Dom, s.r.o.

  Slovakia·2019-11-04

  3,000 EUR
  Art. 5Aukčný Dom, s.r.o., in the processing of personal data of proposers, violated the principle of legality by publishing photographs of pictorial portraits

• UWV (Dutch employee insurance service provider)

  Netherlands·2019-10-31

  900,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Jocker Premium Invex

  Spain·2019-10-31

  6,000 EUR
  Art. 6Inadequate legal basis for data processing

• Huge rental company

  Germany·2019-10-30

  14,500,000 EUR
  Art. 5Art. 25Non-compliance with general data processing principles

• Austrian Post AG (Österreichische Post AG) Mail service provider

  Austria·2019-10-29

  18,000,000 EUR
  Art. 5Art. 6Monetary fine because of the inadequate legal basis for data processing

• VODAFONE ESPANA, S.A.U.

  Spain·2019-10-25

  36,000 EUR
  Art. 5Art. 6Insufficient legal basis for data processing

• FAN COURIER EXPRESS S.R.L.

  Romania·2019-10-25

  11,000 EUR
  Art. 32Art. 5Lack of required organisational and technical measures

• LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd ("the Louis Company Group")

  Cyprus·2019-10-25

  70,000 EUR
  The use of the Bradford Factor for employees profiling and sick leave monitoring constituted unlawful processing of personal data.

• BNP Paribas Personal Finance SA Paris Bucharest Subsidiary (CETELEM IFN S.A.)

  Romania·2019-10-22

  2,000 EUR
  Art. 12Failure to comply with the deadline for responding to the request of data subject

• Unknown

  Germany·2019-10-17

  80,000 EUR
  Art. 32No sufficient measures to ensure information security

• Unknown

  Germany·2019-10-17

  80,000
  Art. 32No sufficient measures to ensure information security

• Xfera Moviles S.A.

  Spain·2019-10-16

  60,000 EUR
  Art. 5Art. 6Inadequate legal basis for data processing

• Iberdrola Clientes

  Spain·2019-10-16

  8,000 EUR
  Art. 31Lack of cooperation with the supervisory authority

• INTELIGO MEDIA SA

  Romania·2019-10-15

  9,000 EUR
  Art. 5Art. 6Art. 7Inadequate legal basis for data processing

• Oslo Municipality

  Norway·2019-10-11

  51,000 EUR
  Art. 32Monetary fine

• Raiffeisen Bank SA

  Romania·2019-10-09

  150,000 EUR
  Art. 32Lack of required organisational and technical measures

• Vreau Credit SRL

  Romania·2019-10-09

  20,000 EUR
  Lack of appropriate organisational and technical measures

• An airline company

  Turkey·2019-10-01

  100,000 TRY
  Art. 4Failure to comply with duties related to ensuring information security + Insufficient legal basis for sensitive data processing

• A mobile network operator company

  Turkey·2019-10-01

  NON
  Art. 11NON

• Vueling Airlines

  Spain·2019-10-01

  30,000 EUR
  Art. 5Art. 6Inadequate legal basis for data processing

• Huge rental company

  Germany·2019-10-01

  15 EUR
  Art. 5Art. 25Non-compliance with the principles of data processing

• Hellenic Telecommunications Organization S.A. (OTE)

  Greece·2019-09-30

  200,000 EUR
  Art. 25Art. 21Breach of data protection by design and failure to effectively comply with data subject's right to object to processing for direct marketing purposes

• City Councilor of Aglantzia Municipality

  Cyprus·2019-09-25

  1,000 EUR
  Unauthorised processing of personal data by City Councilor

• Odborné učilište

  Slovakia·2019-09-24

  0 EUR
  Art. 5Art. 9The controller published the proposer's personal data in the scope of name, surname and address. The controller did not designate or disclose the contact details of the data protection officer, nor did he notify them to the Authority.

• Food Delivery Service Company

  Germany·2019-09-19

  195,407 EUR
  Art. 15Art. 17Art. 21Failure to comply with the rights of the data subjects

• Facebook Inc

  Turkey·2019-09-18

  1,600,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• A bank

  Turkey·2019-09-18

  100,000 TRY
  Art. 4Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles

• Sevinç Eğitim Kurumları (Education Insitution)

  Turkey·2019-09-18

  50,000 TRY
  Art. 3Insufficient technical and organisational measures to ensure information security + Failure to comply witj duty of data controller to prevent unlawful data processing

• Merchant

  Belgium·2019-09-17

  10,000 EUR
  Art. 5Art. 6Art. 12Violation of proportionalitypprinciple, no legal basis, and violation of transparency obligations

• Hellenic Telecommunications Organization S.A. (OTE)

  Greece·2019-09-13

  200,000 EUR
  Art. 25Art. 5Art. 11Violation of data protection by design and the principle of data accuracy

• Auctioneer

  Cyprus·2019-09-12

  2,000 EUR
  Breach of personal data by auctioneer

• Individual Doctor

  Cyprus·2019-09-06

  14,000 EUR
  The posting of sensitive personal data of a patient from a Doctor on Instagram

• O2 Slovakia, s.r.o.

  Slovakia·2019-09-05

  0 EUR
  Art. 6Controller was creating the orders via the controller's website by pre-filling the consents to send the marketing offers.

• A medical ambulatory, whose corporate purpose includes in particular the diagnosis and therapy of allergic diseases

  Austria·2019-08-30

  50,000 EUR
  Art. 7Art. 13Art. 35Art. 37Monetary fine because of several infringements

• Bulgarian Commission for Personal Data Protection

  Bulgaria·2019-08-28

  5,100,000 BGN
  Art. 32Incompliance with the requirement to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services

• Bulgarian Commission for Personal Data Protection

  Bulgaria·2019-08-28

  1,000,000 BGN
  Art. 32Incompliance with the requirement to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services

• S Şans Oyunları A.Ş

  Turkey·2019-08-27

  180,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the data subjects in the shortest time possible

• A tourism company

  Turkey·2019-08-27

  500,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA and the data subjects in the compulsory deadline

• AVON COSMETICS

  Spain·2019-08-16

  60,000 EUR
  Art. 6Insufficient legal basis for data processing

• The municipality of Horné Plachtince

  Slovakia·2019-08-09

  4,000 EUR
  Art. 5Without the existence of a legal basis, the controller published the birth number of the two data subjects on the website www.horne-plachtince.eu

• UTTIS INDUSTRIES S.R.L.

  Romania·2019-08-06

  2,500 EUR
  Art. 12Art. 5Art. 6failure to comply with the obligation to provide transparent information and the principle of data minimisation

• PriceWaterhouseCoopers Business Solutions SA (PWC BS)

  Greece·2019-07-26

  150,000 EUR
  Art. 5Art. 6Unlawful and non-transparent processing of employees' personal data and failure to demonstrate compliance

• ACTIVE ASSURANCES (car insurer)

  France·2019-07-25

  180,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• NON

  Turkey·2019-07-23

  NON
  Art. 4NON

• Insurance Company Description

  France·2019-07-18

  180,000 EUR
  Monetary fine

• Dubmash Inc

  Turkey·2019-07-17

  730,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Haga Hospital

  Netherlands·2019-07-16

  460,000 EUR
  Art. 32Not having sufficient internal security (measures) for patient records.

• LEGAL COMPANY & TAX HUB S.R.L.

  Romania·2019-07-12

  3,000 EUR
  Art. 32Lack of suitable organisational and technical measures

• TODOTECNICOS24H S.L.

  Spain·2019-07-11

  900 EUR
  Art. 13Information obligation non-compliance

• An investment company

  Turkey·2019-07-08

  75,000 TRY
  Art. 12Non-compliance with general data processing principles

• WORLD TRADE CENTER BUCHAREST S.A.

  Romania·2019-07-08

  15,000 EUR
  Art. 32Lack of required organisational and technical measures

• UNICREDIT BANK S.A.

  Romania·2019-07-04

  130,000 EUR
  Art. 25Art. 5Lack of appropriate organisational and technical measures

• Mimar Sinan Üniversitesi

  Turkey·2019-07-01

  NON
  Art. 15Failure to comply with duties related to ensuring information security + Insufficient legal basis for sensitive data processing

• VODAFONE ONO, S.A.U.

  Spain·2019-06-28

  36,000 EUR
  Art. 5Non-compliance with general data processing principles

• POP Akadémia - Pokora Odvaha Pokoj

  Slovakia·2019-06-17

  0 EUR
  Art. 5The controller has not provide necessary information in the scope of Art. The operator continued to publish the photo after withdrawing the proposer's consent to the publication of the photograph.13 GDPR in obtaining the personal data.

• Employer - UNIONTRAD COMPANY

  France·2019-06-13

  20,000 EUR
  Art. 5Art. 12Art. 13Art. 32Poor legal basis for data processing

• Social Insurance Agency in Slovakia

  Slovakia·2019-06-13

  50,000 EUR
  Art. 24Art. 32Social Insurance Agency in Slovakia violated the proposer's right to protection of his personal data by sending personal data of applicants to the adress of the holders of social insurance of the EU member states via Slovenská pošta.

• Cerrajero Online

  Spain·2019-06-11

  1,500 EUR
  Art. 13Information obligation non-compliance

• Professional Football League (LaLiga)

  Spain·2019-06-11

  250,000 EUR
  Art. 5Art. 7Insufficient fulfilment of information obligations

• Xfera Moviles S.A.

  Spain·2019-06-04

  60,000 EUR
  Art. 5Art. 6Insufficient legal basis for data processing

• VODAFONE ESPAÑA, S.A.U.,

  Spain·2019-06-03

  40 EUR
  Art. 6Insufficient legal basis for data processing

• IDdesign A / S

  Denmark·2019-06-03

  200,850 EUR
  Art. 5Failure to comply with the principle of storage limitation - Proposed fine

• Unknown

  Turkey·2019-05-31

  NON
  Art. 9Crossborder Data Transfer Requirements

• An asset management company

  Turkey·2019-05-31

  20,000 TRY
  Art. 5Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles

• A joint-stock company

  Turkey·2019-05-31

  50,000 TRY
  Art. 5Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles

• A gym owner company

  Turkey·2019-05-31

  Unknown
  Art. 6Art. 4Insufficient technical and organisational measures to ensure information security + Insufficient legal basis for data processing

• Unknown

  Turkey·2019-05-31

  50,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security

• Mayor

  Belgium·2019-05-28

  2,000 EUR
  Art. 5Art. 6Violation of purpose limitation principle, and insufficient legal basis for data processing

• SERGIC (Real Estate)

  France·2019-05-28

  400,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• AMADOR RECREATIVOS, S.L

  Spain·2019-05-25

  8,000 EUR
  Art. 5Failure to comply the general data processing principles

• Clickbus Seyahat Hizmetleri A.Ş.

  Turkey·2019-05-16

  1,000,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Marriott International Inc.

  Turkey·2019-05-16

  1,450,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Cathay Pasific Airway Limited

  Turkey·2019-05-16

  550,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Anonymous

  Czech Republic·2019-05-13

  80,000 CZK
  Art. 5Art. 32Inadequate legal basis for data processing and inadequate technical and organisational measures to guarantee information security

• Police Officer

  Germany·2019-05-09

  1,400 EUR
  Art. 6Insufficient legal basis for data processing

• Public service company - employer

  Czech Republic·2019-05-06

  5,000 CZK
  Art. 15Insufficient fulfilment of data subjects rights

• Deco Proteste Editores, Lda

  Portugal·2019-05-06

  107,000 EUR
  Art. 6Inadequate fulfilment of the requirements to send unsolicited direct marketing communications

• Municipality Bratislava - Ruzinov district

  Slovakia·2019-05-02

  The Authority did not impose a measure to remedy the identified deficiencies
  Art. 5Bratislava Ruzinov City District delivered the decision to the applicant, while the applicant was not an authorized entity to deliver the decision.

• T.C. Ziraat Bankası A.Ş

  Turkey·2019-05-02

  NON
  Art. 5Non-compliance with the notification obligation + Insufficient legal basis for data processing

• FERPLAST SLOVAKIA, Limited Liability Company

  Slovakia·2019-04-29

  the personal data proceedings have been suspended
  Art. 5The company suspected that as an employer of an xy employee, it had violated the protection of the employee's personal health data.

• Ministry of Interior of the Slovak Republic

  Slovakia·2019-04-17

  The Authority did not impose a measure to remedy the identified deficiencies
  Art. 5The Office for the Protection of Personal Data dealt with a complaint against the Ministry of the Interior of the Slovak Republic for an alleged violation of the legislation on the protection of personal data.

• Breikot Management Ltd

  Cyprus·2019-04-12

  13,000 EUR
  Art. 5Art. 29Publication of photographs of individuals in the printed form of "24h" newspaper

• Sigma Live Ltd

  Cyprus·2019-04-12

  5,000 EUR
  Art. 6Sigma Live Ltd had published and processed the complainant's personal data without their prior consent.

• Facebook

  Turkey·2019-04-11

  550,000 TRY
  Art. 12Failure to implement sufficient measures to ensure information security, and to fulfill information obligations

• Associazione Rousseau - Movimento 5 stelle (Italian political party)

  Italy·2019-04-04

  50,000 EUR
  Art. 32This fine concerns insufficient technical and organisational measures

• Skroutz.com.cy

  Cyprus·2019-03-28

  3,400 EUR
  Unauthorised promotional material e-mailed to material sent to individuals.

• Private Entity

  Portugal·2019-03-25

  2,000 EUR
  Art. 13Insufficient fulfilment of information obligations

• An energy company

  Turkey·2019-03-25

  NON
  Art. 4Explanation of legitimate interest for as a legal basis for Data Processing

• A supermarket (Full name dislosed)

  Turkey·2019-03-25

  NON
  Art. 13Insufficient legal basis for data processing

• Anonymous

  Czech Republic·2019-03-21

  250,000 CZK
  Art. 5Non-compliance with general data processing principles

• Private Entity

  Portugal·2019-03-19

  2,000 EUR
  Art. 13Inadequate fulfilment of information obligations

• Taxa 4x35

  Denmark·2019-03-18

  1,200,000 DKK
  Art. 5Non-compliance with general data processing principles and principles of data minimisation - Proposed fine

• Bergen Municipality

  Norway·2019-03-18

  170,000 EUR
  Art. 5Art. 32Failure to implement sufficient measures to ensure information security

• Altius Insurance Ltd

  Cyprus·2019-03-13

  4,000 EUR
  Art. 6Unauthorised SMS advertising material sent to non-customers.

• State Hospital

  Cyprus·2019-03-01

  5,000 EUR
  Art. 15Non-compliance with subjects' rights protection safeguards

• Private Bank

  Germany·2019-03-01

  50,000 EUR
  Art. 6Inadequate legal basis for data processing

• Anonymous

  Czech Republic·2019-02-28

  15,000 CZK
  Art. 5Art. 28Insufficient technical and organisational measures to ensure information security

• Anonymous

  Czech Republic·2019-02-26

  20,000 CZK
  Art. 15Insufficient fulfilment of data subjects rights

• Lands Authority

  Malta·2019-02-18

  5,000 EUR
  Art. 5Art. 32Insufficient technical and organisational measures to ensure information security

• Municipality Veľká Lomnica

  Slovakia·2019-02-11

  The Authority did not impose a measure to remedy the identified deficiencies
  Art. 10The municipality of Veľká Lomnica violated the proposer's right to protection against unauthorized disclosure of information about the proposer by publishing a statement containing the proposer's personal information.

• Dopravný podnik Bratislava, joint stock company

  Slovakia·2019-02-06

  1,000 EUR
  Art. 15Art. 12Failed to comply with the proposer's request to apply the proposer's right of access to his personal data processed through audiovisual recording media and to provide a copy thereof

• Car brand

  Portugal·2019-02-05

  20,000 EUR
  Art. 15Insufficient fulfilment of data subjects rights

• Private person

  Germany·2019-02-05

  2,500 EUR
  Art. 6Art. 5Insufficient legal basis for data processing

• Credit brokerage

  Czech Republic·2019-02-04

  30,000 CZK
  Art. 5Insufficient technical and organisational measures to ensure information security

• Car renting company

  Czech Republic·2019-02-04

  30,000 CZK
  Art. 5Insufficient fulfilment of information obligations

• Small shipping company

  Germany·2019-01-23

  5,000 EUR
  Art. 28Violation of Art. 28 GDPR

• Madrileña Red de Gas

  Spain·2019-01-21

  12,000 EUR
  Art. 32Failure to implement sufficient measures to ensure information security

• Google Inc.

  France·2019-01-21

  50,000,000 EUR
  Art. 13Art. 14Art. 6Art. 5Lack of legal basis for data processing

• Employer

  Czech Republic·2019-01-10

  10,000 CZK
  Art. 6Insufficient legal basis for data processing

• Politis Newspaper

  Cyprus·2019-01-09

  10,000 EUR
  Art. 5Publication of names and photographs of police-investigators at Larnaca Airport by Politis newspaper

• Bulgarian Commission for Personal Data Protection

  Bulgaria·2019

  5,000 BGN
  Art. 5Incompliance with the requirement to ensure that personal data is accurate (infringement of the "accuracy" principle)

• Company - energy distributor

  Czech Republic·2019

  40,000 CZK
  Art. 6Art. 29Insufficient legal basis for data processing and processing

• Provider of social services - Retirement home

  Czech Republic·2019

  50,000 CZK
  Art. 5Art. 6Art. 9Art. 12Art. 13Art. 24Art. 25Art. 30Insufficient legal basis for data processing and insufficient technical and organisational measures to ensure information security

• No information available

  Malta·2019

  10,000 EUR
  No information available

• UniCredit Bank Czech Republic and Slovakia, a.s.

  Czech Republic·2019

  80,000 CZK
  Art. 5Art. 6Insufficient legal basis for data processing

• Democratic Party

  Cyprus·2019

  3,000 EUR
  Unauthorised use of direct phone calls to individuals.

• Anonymous individuals

  Cyprus·2019

  2,000 EUR
  Unauthorised processing of personal data for purposes other than those originally intended. Unauthorised sending of messages to individuals.

• Online shop with electronics - Alza.cz a.s.

  Czech Republic·2019

  15,000 CZK
  Art. 6Art. 7Art. 12Art. 29Insufficient legal basis for data processing

• Natural person (enterpreneur)

  Czech Republic·2019

  25,000 CZK
  Art. 5Art. 28Art. 32Insufficient technical and organisational measures to ensure information security

• Company

  Czech Republic·2019

  10,000 CZK
  Art. 6Art. 17Insufficient legal basis for data processing and insufficient fulfilment of data subject rights

• M.L. PRO.FIT SOLUTIONS LTD

  Cyprus·2019

  1,000 EUR
  Art. 6Sending SMS marketing messages without consent.

• A.G. QUICKSPA LIMITED

  Cyprus·2019

  1,200 EUR
  Art. 6Sending SMS marketing messages without consent.

• Telecom Company Description

  France·2018-12-26

  250,000 EUR
  Fine

• Unknown

  Turkey·2018-12-24

  NON
  Art. 17Criminal Proceeding Conditions

• Private person. - Owner of a residential unit in an apartment building.

  Austria·2018-12-20

  2,200 EUR
  Art. 5Art. 6Art. 13Monetary fine because of lack of insufficient legal basis for data processing

• Multinational Transportation Network Company

  France·2018-12-19

  400,000 EUR
  Fine

• Pharmacy

  Turkey·2018-12-05

  Unknown
  Art. 6Non-compliance with general data processing principles

• A bank

  Turkey·2018-12-05

  NON
  Art. 4Maximum data storage time limits

• Unknown

  Germany·2018-12-01

  20,000 EUR
  Art. 83Art. 33Art. 34Failure to comply with the obligation to provide information

• Dutch DPA

  Netherlands·2018-11-27

  600,000
  Art. 33In 2016, a data breach occurred at the Uber group in which unauthorized persons gained access to personal data of customers and drivers.

• Social Media Chat Platform

  Germany·2018-11-21

  20,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• A legal entity

  Turkey·2018-11-19

  NON
  Art. 2Scope of the Law

• Archbishop Makarios III Hospital

  Cyprus·2018-11-07

  15,000 EUR
  Loss of patient file by the hospital

• Online Advertising Company Description

  France·2018-10-30

  missing
  Formal Notice

• Association

  Czech Republic·2018-10-25

  10,000 CZK
  Art. 15Insufficient fulfilment of data subjects rights

• Public Institution

  Turkey·2018-10-16

  Instructed the Data Controller
  Art. 11Insufficient fulfilment of data subjects rights

• Centro Hospitalar Barreiro Montijo, EPE

  Portugal·2018-10-09

  400,000 EUR
  Art. 5Art. 32Insufficient technical and organisational measures to ensure information security and violation of the data minimization principle

• One of the largest e-shops in Czech Republic

  Czech Republic·2018-10-03

  1,500,000 CZK
  Insufficient technical and organisational measures to ensure information security

• Private car owner

  Austria·2018-09-27

  300 EUR
  Art. 5Art. 6Monetary fine because of lack of insufficient legal basis for data processing, lack of video surveillance indication

• Unknown

  Turkey·2018-09-13

  N/A
  Art. 3Definition of Data Controller

• Sports betting company

  Austria·2018-09-12

  4,800 EUR
  Art. 5Art. 6Monetary fine becuase of lack of insufficient legal basis for data processing, lack of video surveillance indication and excessive storage duration

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Failure to implement sufficient measures to ensure information security

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 4Non-compliance with the principle of data minimization

• Unknown

  Turkey·2018-08-02

  NON
  Art. 28Unknown

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Non-compliance with the right of consent

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Insufficient fulfilment of information obligations

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 4Insufficient technical and organisational measures to ensure information security

• Unknown

  Turkey·2018-08-02

  Instructed the Data Controller
  Art. 11Non-compliance with information obligations

• Unknown

  Turkey·2018-08-02

  Instructed the Data Controller
  Art. 4Insufficient fulfilment of data subjects rights

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Insufficient technical and organisational measures to ensure information security

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 4Non-compliance with general data processing principles

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 5Failure to implement sufficient measures to ensure information security

• Unknown

  Turkey·2018-07-26

  Instructed the Data Controller
  Art. 7Non-compliance with the right of consent, and information obligations

• Video Hosting Platform Description

  France·2018-07-24

  50,000 EUR
  Fine

• Social Housing Public Organisation Description

  France·2018-07-24

  30,000 EUR
  Fine

• Private Person - Soccer Coach

  Austria·2018-07-01

  11,000 EUR
  Monetary fine because of non-compliance with lawful basis for data processing

• Public Institution

  Turkey·2018-06-28

  N/A
  Art. 7Insufficient technical and organisational measures to ensure information security

• Social Housing Non-Profit Organisation

  France·2018-06-21

  75,000 EUR
  Fine

• Optical Retail Company

  France·2018-05-07

  250,000 EUR
  Fine

• No information available

  Malta·2018

  19,500 EUR
  No information available

• Various companies

  Denmark·2018

  361,000 EUR
  Art. 5Inspections and proposed monetary fines for non-compliance with general data processing principles

• Toy Manufacturer

  France·2017-11-20

  missing
  Formal Notice

• CYTA Ltd, Social Insurance Services of the Ministry of the Ministry of Labour, Welfare and Social Insurance of Cyprus, Cyprus Police

  Cyprus·2017

  10,000 EUR
  Art. 32Unauthorised access to data and lack of security of processing

• FIN, spol s.r.o.

  Slovakia

  7,000 EUR
  Art. 5Art. 33The controller violated the principle of confidentiality by unauthorized processing and access to the personal data of the data subjects.

• Restaurant

  Spain

  12,000 EUR
  Art. 5Art. 6Insufficient legal basis for data processing

• CNTAR TAROM SA

  Romania

  5,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• S.C. C&V Water Control S.A.

  Romania

  2,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• ING Bank N.V. Amsterdam - Bucharest Subsidiary

  Romania

  3,000 EUR
  Art. 5Art. 6Infringement of transparency, purpose limitation, data minimisation and accuracy principles, Lack of legal basis for data processing

• ING Bank N.V. Amsterdam - Bucharest Subsidiary

  Romania

  1,000 EUR
  Art. 29Art. 32Insufficient organisational and technical measures

• Natural person

  Romania

  200 EUR
  Art. 5Art. 6Art. 13Art. 32Non-observance of the transparency and purpose limitation principles regarding data processing

• Association of apartment owners

  Romania

  500 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• ENDESA (energy supplyer)

  Spain

  60,000 EUR
  Art. 5Insufficient legal basis for data processing

• VODAFONE ESPANA, S.A.U.

  Spain

  5,000 EUR
  Art. 5Failure to comply the general data processing principles

• Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL)

  Spain

  60,000 EUR
  Art. 5Insufficient legal basis for data processing

• Unknown

  Turkey

  NON
  NON

• Ready-wear Company

  Turkey

  Unknown, also Instructed the Data Controller
  Insufficient technical and organisational measures to ensure information security

• VODAFONE ESPANA, S.A.U.

  Spain

  27,000 EUR
  Art. 5Insufficient fulfilment of data subjects rights

• Unknown

  Germany

  118,000 EUR
  Art. 6Insufficient legal basis for data processing

• Public Roads Administration of Norway

  Norway

  367,000 EUR
  Art. 17Art. 25The public roads administration had failed to comply with its obligations under the GDPR Article 17 (Right to erasure)

• Megareduceri TV S.R.L.

  Romania

  3,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• City Council of Nelas

  Portugal

  2,500 EUR
  Disclousure of personal data regarding the health of two citizens on social media.

• S.C. Viva Credit IFN S.A.

  Romania

  2,000 EUR
  Art. 12Art. 17Failure to respond within the legal deadline to the request of data subject regarding the right "to be forgotten"

• obec Mojtín

  Slovakia

  1,000 EUR
  Art. 87Unlawful processing of personal identification number.

• Prima banka

  Slovakia

  13,300 EUR
  Art. 5Art. 12Art. 15Improper fulfillment of the information obligation, non-transparent processing of the data subject's request for access to data

• Romanian Post National Company

  Romania

  2,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Association of apartment owners - FC5 Building, Navodari city, Constanta county

  Romania

  500 EUR
  Art. 5Art. 6Art. 25Art. 83Non-observance of data processing principles and of the data subject's right to information on his/her personal data processed by the controller, Non-compliance with lawful basis for data processing

• Sanatatea Press Group S.R.L.

  Romania

  2,000 EUR
  Art. 5Art. 32Infringement of data integrity and confidentiality principle, Insufficient organisational and technical measures

• Association of apartment owners Militari R, Chiajna village

  Romania

  2,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• S.C. Marsorom S.R.L.

  Romania

  3,000 EUR
  Insufficient organisational and technical measures

• Globus Score SRL

  Romania

  2,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• Vodafone România S.A.

  Romania

  4,000 EUR
  Non-observance of the data subject's right of access and right to erasure, Failure of the controller to prove that it has responded within the legal deadline to the request of data subject

• DADA CREATION S.R.L.

  Romania

  5,000 EUR
  Art. 32Art. 33Lack of organisational and technical measures, Failure to notify the data breach to the supervisory authority

• Banca Transilvania SA

  Romania

  100,000 EUR
  Art. 32Art. 5Insufficient organisational and technical measures, Infringement of data integrity and confidentiality principle

• Administrative-Territorial Unit 4th District of Bucharest

  Romania

  N/A
  Art. 5Art. 6Infringement of lawfulness, fairness and transparency principle, Lack of legal ground for data processing

• Cluj-Napoca Municipality

  Romania

  N/A
  Art. 5Art. 6Infringement of lawfulness, fairness and transparency principle, Lack of legal ground for data processing

• Qualitance QBS SA

  Romania

  1,000 EUR
  Art. 32Insufficient organisational and technical measures

• Natural person acting as a General Secretary for a political party in Bucharest

  Romania

  500 EUR
  Art. 32Art. 58Lack of appropriate organisational and technical measures

• S.C. Medicover S.R.L.

  Romania

  2,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• TELEKOM ROMÂNIA MOBILE COMMUNICATIONS S.A.

  Romania

  10,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• S.C. TIP TOP FOOD INDUSTRY S.R.L.

  Romania

  5,000 EUR
  Art. 5Art. 6Art. 7Infringement of purpose limitation and accuracy principles regarding the processing of personal data, Lack of legal basis for data processing, Non-observance of the conditions for consent

• Lugera & Makler Broker S.R.L.

  Romania

  1,500 EUR
  Art. 29Art. 32Insufficient organisational and technical measures

• World Class România S.A.

  Romania

  2,000 EUR
  Art. 32Insufficient organisational and technical measures

• Telekom Romania Communications S.A.

  Romania

  2,000 EUR
  Art. 6Art. 21Lack of legal basis for data processing, Non-observance of the right to object of data subject

• Banca Comercială Română S.A.

  Romania

  2,000 EUR
  Art. 5Art. 6Non-observance of the transparency and accuracy principles regarding data processing, Lack of legal basis for data processing

• Vodafone România S.A.

  Romania

  5,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• SC Dreamtime Call S.R.L.

  Romania

  2,000 EUR
  Art. 83Non-cooperation with the supervisory authority