312 GDPR fines

Enforcement decisions from 21 jurisdictions, reported by INPLP member firms. Each entry links to the authority’s own publication where one is on record.

• Unknown

  Germany·2019-12-03

  105,000,000 EUR
  Art. 5Non-compliance with general data processing principles

• Google Inc.

  France·2019-01-21

  50,000,000 EUR
  Art. 13Art. 14Art. 6Art. 5Lack of legal basis for data processing

• TIM S.p.A.

  Italy·2020-01-15

  27,802,946 EUR
  Art. 5Art. 6Art. 7Art. 13Art. 21Art. 24Art. 32Art. 33Concerns breaches due to (i) unsolicited telemarketing calls; (ii) absence of consent for marketing activities; (iii) invalid consent collected for the use of data controller's apps; (iv) inadequate security measures; (v) mismanagement of data breaches

• British Airways

  United Kingdom·2020-10-16

  20,000,000 GBP
  Art. 32Monetary fine for failure to provide adequate security arrangements to protects its customers' personal data as per Art 32 GDPR

• Marriott International Inc

  United Kingdom·2020-10-30

  18,400,000 GBP
  Art. 32Monetary fine for failure to provide adequate security arrangements to protects its customers' personal data as per Art 32 GDPR

• Austrian Post AG (Österreichische Post AG) Mail service provider

  Austria·2019-10-29

  18,000,000 EUR
  Art. 5Art. 6Monetary fine because of the inadequate legal basis for data processing

• Wind Tre S.p.A.

  Italy·2020-07-09

  16,729,600 EUR
  Art. 5Art. 6Art. 7Art. 12Art. 24Art. 25Failure to comply with the lawfulness, fairness and transparency, absence of consent for data processing, failure to take appropriate measures to provide information, failure to comply with the principle of accountability and privacy.

• Huge rental company

  Germany·2019-10-30

  14,500,000 EUR
  Art. 5Art. 25Non-compliance with general data processing principles

• Vodafone Italia S.p.A.

  Italy·2020-11-12

  12,251,601 EUR
  Art. 5Art. 6Art. 7Art. 15Art. 16Art. 21Art. 24Art. 25Art. 32Art. 33No measures ensuring the control of the legitimacy of the data collected, consent for the sharing of data, marketing actvies in contrast with the right to objects, inadequate security measures and mismanagement of data breaches

• Budapest Főváros Kormányhivatala XI. kerületi Hivatala

  Hungary·2021-03-14

  10,000,000 HUF
  Art. 32Art. 33Art. 34Data breach resulting in a high risk to the rights and freedoms of natural persons

• Unknown

  Germany·2019-12-09

  9,550,000 EUR
  Art. 32Inadequate technical and organisational measures to ensure information security

• Eni Gas e Luce S.p.A. (electricity and gas)

  Italy·2019-12-11

  8,500,000 EUR
  Art. 5Art. 6Art. 7Art. 25The violations include (i) the use of advertising calls without the consent of the contacted person; (ii) the absence of adequate technical and organisational measures; (iii) the unlawful data retention and (iv) the unlawful processing of personal data ac

• Bulgarian Commission for Personal Data Protection

  Bulgaria·2019-08-28

  5,100,000 BGN
  Art. 32Incompliance with the requirement to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services

• Fastweb S.p.A.

  Italy·2021-03-25

  4,501,868 EUR
  Art. 5Art. 6Art. 25Art. 24Art. 32Art. 33Art. 34Failure to comply with general data processing principles, with the principle of accountability and privacy by design and by default, to report the breach of personal data

• Eni Gas e Luce S.p.A. (electricity and gas)

  Italy·2019-12-11

  3,000,000 EUR
  Art. 5Art. 32Breaches due to the conclusion of unsolicited contracts for the supply of electricity and gas under ‘deregulated market’ conditions, due to the inadequacy of privacy policies adopted by Eni Gas e Luce S.p.A.

• Iren Mercato S.p.A.

  Italy·2021-05-13

  2,856,169 EUR
  Art. 6Art. 7Art. 5Insufficient legal basis for data processing, improper use of the legitimate interest as a legal basis for data processing and breach of the principles of accountability.

• Foodinho S.r.l.

  Italy·2021-07-10

  2,600,000 EUR
  Art. 5Art. 13Art. 22Art. 30Art. 35Art. 37Failure to comply with general data processing principles, with the obligation to provide sufficient information to the data subject and to implement suitable measures for automated processing.

• Facebook Inc

  Turkey·2019-09-18

  1,600,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• One of the largest e-shops in Czech Republic

  Czech Republic·2018-10-03

  1,500,000 CZK
  Insufficient technical and organisational measures to ensure information security

• Marriott International Inc.

  Turkey·2019-05-16

  1,450,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Ticketmaster UK Limited

  United Kingdom·2020-11-13

  1,250,000 GBP
  Art. 5Monetary fine for failure to provide adequate physical security arrangements to protects its customers' personal data as per Art 32 GDPR. The company also failed to prevent fraudulent activities on its customers' bank cards as per Art 5(1)(f).

• Taxa 4x35

  Denmark·2019-03-18

  1,200,000 DKK
  Art. 5Non-compliance with general data processing principles and principles of data minimisation - Proposed fine

• Clickbus Seyahat Hizmetleri A.Ş.

  Turkey·2019-05-16

  1,000,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Bulgarian Commission for Personal Data Protection

  Bulgaria·2019-08-28

  1,000,000 BGN
  Art. 32Incompliance with the requirement to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services

• TODOTECNICOS24H S.L.

  Spain·2019-11-07

  900,000 EUR
  Art. 13Insufficient fulfilment of information obligations

• UWV (Dutch employee insurance service provider)

  Netherlands·2019-10-31

  900,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Dutch DPA

  Netherlands·2020-07-06

  830,000 EUR
  Art. 12Art. 15Too high barriers for the insight of your personal data.

• Iliad Italia S.p.A.

  Italy·2020-07-09

  800,000 EUR
  Art. 5Art. 32This fine concerns breaches due to (i) failure to comply with the lawfulness, fairness and transparency principle; (ii)insufficient security measures applied to the storage of traffic data.

• Dutch DPA

  Netherlands·2021-07-22

  750,000 EUR
  Art. 12Violating the privacy of young children.

• Dubmash Inc

  Turkey·2019-07-17

  730,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Dutch DPA

  Netherlands·2020-04-30

  725,000 EUR
  Art. 9Processing of fingerprints (biometric data) by obliging employees to have their fingerprints scanned when they log in and out for work.

• Dutch DPA

  Netherlands·2018-11-27

  600,000
  Art. 33In 2016, a data breach occurred at the Uber group in which unauthorized persons gained access to personal data of customers and drivers.

• Dutch DPA

  Netherlands·2021-04-29

  600,000 EUR
  Art. 5Art. 6Using wifitracking without any legal basis by a town/municipality but to follow shoppers and people who live or work in the city center.

• Cathay Pasific Airway Limited

  Turkey·2019-05-16

  550,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA within the necessary timelimit

• Facebook

  Turkey·2019-04-11

  550,000 TRY
  Art. 12Failure to implement sufficient measures to ensure information security, and to fulfill information obligations

• Dutch DPA

  Netherlands·2021-05-12

  525,000 EUR
  Art. 27Art. 3Locatefamily.com publishes people's addresses and phone numbers, often without those people's knowledge.

• Dutch DPA

  Netherlands·2020-03-03

  525,000 EUR
  Art. 5Art. 6The Dutch DPA imposed a fine of 525,000 euros for the unlawful sale of personal data by the Dutch national tennis association the KNLTB.

• A tourism company

  Turkey·2019-08-27

  500,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the DPA and the data subjects in the compulsory deadline

• Futura Internationale

  France·2019-11-21

  500,000 EUR
  Art. 5Art. 6Art. 13Art. 14Art. 21Unsatisfactory execution of the rights of the data subjects

• Roma Capitale

  Italy·2020-12-17

  500,000 EUR
  Art. 5Art. 13Art. 14Art. 28Art. 32Failure to comply with general data processing principles, the obligation to provide sufficient information to the data subject, provide a contract or other legal act for the processing by the processor, measures to ensure information security.

• Dutch DPA

  Netherlands·2021-05-11

  475,000 EUR
  Art. 33Reporting a data breach 22 days to late.

• Haga Hospital

  Netherlands·2019-07-16

  460,000 EUR
  Art. 32Not having sufficient internal security (measures) for patient records.

• Dutch DPA

  Netherlands·2021-07-07

  450,000 EUR
  Art. 32Insufficient security measures, even after several data breaches. The UWV has insufficiently checked and evaluated its own security measures.

• Dutch DPA

  Netherlands·2021-02-12

  440,000 EUR
  Art. 32No sufficient measures in place to prevent access to medical records

• Centro Hospitalar Barreiro Montijo, EPE

  Portugal·2018-10-09

  400,000 EUR
  Art. 5Art. 32Insufficient technical and organisational measures to ensure information security and violation of the data minimization principle

• SERGIC (Real Estate)

  France·2019-05-28

  400,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Multinational Transportation Network Company

  France·2018-12-19

  400,000 EUR
  Fine

• Public Roads Administration of Norway

  Norway

  367,000 EUR
  Art. 17Art. 25The public roads administration had failed to comply with its obligations under the GDPR Article 17 (Right to erasure)

• Various companies

  Denmark·2018

  361,000 EUR
  Art. 5Inspections and proposed monetary fines for non-compliance with general data processing principles

• Roma Capitale

  Italy·2021-02-11

  350,000 EUR
  Art. 5Art. 6Art. 28Art. 32Failure to comply with general data processing principles, insufficient legal basis for data processing, failure to stipulate a data processing agreement, insufficient l measures to ensure information security.

• Doorstep Dispensaree Ltd. (Pharmacy)

  United Kingdom·2019-12-20

  320,000 GBP
  Art. 32Monetary fine for failure to provide adequate physical security arrangements to protects its customers' personal data as per Art 32 GDPR

• Professional Football League (LaLiga)

  Spain·2019-06-11

  250,000 EUR
  Art. 5Art. 7Insufficient fulfilment of information obligations

• Anonymous

  Czech Republic·2019-03-21

  250,000 CZK
  Art. 5Non-compliance with general data processing principles

• Telecom Company Description

  France·2018-12-26

  250,000 EUR
  Fine

• Optical Retail Company

  France·2018-05-07

  250,000 EUR
  Fine

• IDdesign A / S

  Denmark·2019-06-03

  200,850 EUR
  Art. 5Failure to comply with the principle of storage limitation - Proposed fine

• Hellenic Telecommunications Organization S.A. (OTE)

  Greece·2019-09-13

  200,000 EUR
  Art. 25Art. 5Art. 11Violation of data protection by design and the principle of data accuracy

• Hellenic Telecommunications Organization S.A. (OTE)

  Greece·2019-09-30

  200,000 EUR
  Art. 25Art. 21Breach of data protection by design and failure to effectively comply with data subject's right to object to processing for direct marketing purposes

• Food Delivery Service Company

  Germany·2019-09-19

  195,407 EUR
  Art. 15Art. 17Art. 21Failure to comply with the rights of the data subjects

• Insurance Company Description

  France·2019-07-18

  180,000 EUR
  Monetary fine

• S Şans Oyunları A.Ş

  Turkey·2019-08-27

  180,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security + Failure to notify the data subjects in the shortest time possible

• ACTIVE ASSURANCES (car insurer)

  France·2019-07-25

  180,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Bergen Municipality

  Norway·2019-03-18

  170,000 EUR
  Art. 5Art. 32Failure to implement sufficient measures to ensure information security

• PriceWaterhouseCoopers Business Solutions SA (PWC BS)

  Greece·2019-07-26

  150,000 EUR
  Art. 5Art. 6Unlawful and non-transparent processing of employees' personal data and failure to demonstrate compliance

• Raiffeisen Bank SA

  Romania·2019-10-09

  150,000 EUR
  Art. 32Lack of required organisational and technical measures

• AEGEAN MARINE PETROLEUM NETWORK INC.

  Greece·2019-12-19

  150,000 EUR
  Art. 5Violation of essential data protection principles mainly integrity and accountability

• UNICREDIT BANK S.A.

  Romania·2019-07-04

  130,000 EUR
  Art. 25Art. 5Lack of appropriate organisational and technical measures

• Newspaper

  Turkey·2019-12-09

  125,000 TRY
  Art. 12Unlawful processing of sensitive data

• Unknown

  Germany

  118,000 EUR
  Art. 6Insufficient legal basis for data processing

• Deco Proteste Editores, Lda

  Portugal·2019-05-06

  107,000 EUR
  Art. 6Inadequate fulfilment of the requirements to send unsolicited direct marketing communications

• Bank

  Turkey·2019-11-26

  100,000 TRY
  Art. 12Illegal use of customer data

• Insurance Company

  Turkey·2019-11-07

  100,000 TRY
  Art. 12Unlawful use of public data

• An airline company

  Turkey·2019-10-01

  100,000 TRY
  Art. 4Failure to comply with duties related to ensuring information security + Insufficient legal basis for sensitive data processing

• A bank

  Turkey·2019-09-18

  100,000 TRY
  Art. 4Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles

• Banca Transilvania SA

  Romania

  100,000 EUR
  Art. 32Art. 5Insufficient organisational and technical measures, Infringement of data integrity and confidentiality principle

• Comune di Bolzano

  Italy·2021-05-13

  84,000 EUR
  Art. 5Art. 9Art. 13Art. 35Failure to comply with data minimisation principles, with the obligation to provide sufficient information to the data subject, failure to provide an impact assessment.

• Unknown

  Germany·2019-10-17

  80,000 EUR
  Art. 32No sufficient measures to ensure information security

• UniCredit Bank Czech Republic and Slovakia, a.s.

  Czech Republic·2019

  80,000 CZK
  Art. 5Art. 6Insufficient legal basis for data processing

• ING Bank N.V. Amsterdam - Bucharest Subsidiary

  Romania·2019-11-25

  80,000 EUR
  Art. 25Art. 5Art. 32Lack of required organisational and technical measures

• Unknown

  Germany·2019-10-17

  80,000
  Art. 32No sufficient measures to ensure information security

• Anonymous

  Czech Republic·2019-05-13

  80,000 CZK
  Art. 5Art. 32Inadequate legal basis for data processing and inadequate technical and organisational measures to guarantee information security

• An investment company

  Turkey·2019-07-08

  75,000 TRY
  Art. 12Non-compliance with general data processing principles

• Social Housing Non-Profit Organisation

  France·2018-06-21

  75,000 EUR
  Fine

• TUSLA

  Ireland·2020-05-01

  75,000 EUR
  Art. 5accidentally disclosing contact and location data of a mother and child to their alleged abuser

• LGS Handling Ltd, Louis Travel Ltd, and Louis Aviation Ltd ("the Louis Company Group")

  Cyprus·2019-10-25

  70,000 EUR
  The use of the Bradford Factor for employees profiling and sick leave monitoring constituted unlawful processing of personal data.

• Xfera Moviles S.A.

  Spain·2019-06-04

  60,000 EUR
  Art. 5Art. 6Insufficient legal basis for data processing

• Xfera Moviles S.A.

  Spain·2019-10-16

  60,000 EUR
  Art. 5Art. 6Inadequate legal basis for data processing

• ENDESA (energy supplyer)

  Spain

  60,000 EUR
  Art. 5Insufficient legal basis for data processing

• Debt collecting agancy (GESTIÓN DE COBROS, YO COBRO SL)

  Spain

  60,000 EUR
  Art. 5Insufficient legal basis for data processing

• Viaqua Xestión Integral Augas de Galicia

  Spain·2019-11-21

  60,000 EUR
  Art. 6Inadequate legal basis for data processing

• Corporación radiotelevisión espanola

  Spain·2019-11-19

  60,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Xfera Moviles S.A.

  Spain·2019-11-19

  60,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• AVON COSMETICS

  Spain·2019-08-16

  60,000 EUR
  Art. 6Insufficient legal basis for data processing

• Oslo Municipality

  Norway·2019-10-11

  51,000 EUR
  Art. 32Monetary fine

• Large Social Media Company

  Germany·2020-02-13

  51,000 EUR
  Art. 37Lack of appointment of data protection officer

• A medical ambulatory, whose corporate purpose includes in particular the diagnosis and therapy of allergic diseases

  Austria·2019-08-30

  50,000 EUR
  Art. 7Art. 13Art. 35Art. 37Monetary fine because of several infringements

• Azienda USL della Romagna

  Italy·2021-01-27

  50,000 EUR
  Art. 5Art. 9Art. 32Failure to comply with general data processing principles, processing of special categories of personal data without proper legal basis, insufficient technical and organisational measures to ensure the ongoing information security.

• Doctor

  Turkey·2019-11-07

  50,000 TRY
  Art. 12Sending commercial messages to mobile phone

• Provider of social services - Retirement home

  Czech Republic·2019

  50,000 CZK
  Art. 5Art. 6Art. 9Art. 12Art. 13Art. 24Art. 25Art. 30Insufficient legal basis for data processing and insufficient technical and organisational measures to ensure information security

• Associazione Rousseau - Movimento 5 stelle (Italian political party)

  Italy·2019-04-04

  50,000 EUR
  Art. 32This fine concerns insufficient technical and organisational measures

• Sevinç Eğitim Kurumları (Education Insitution)

  Turkey·2019-09-18

  50,000 TRY
  Art. 3Insufficient technical and organisational measures to ensure information security + Failure to comply witj duty of data controller to prevent unlawful data processing

• A joint-stock company

  Turkey·2019-05-31

  50,000 TRY
  Art. 5Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles

• Unknown

  Turkey·2019-05-31

  50,000 TRY
  Art. 12Insufficient technical and organisational measures to ensure information security

• Video Hosting Platform Description

  France·2018-07-24

  50,000 EUR
  Fine

• Private Bank

  Germany·2019-03-01

  50,000 EUR
  Art. 6Inadequate legal basis for data processing

• Social Insurance Agency in Slovakia

  Slovakia·2019-06-13

  50,000 EUR
  Art. 24Art. 32Social Insurance Agency in Slovakia violated the proposer's right to protection of his personal data by sending personal data of applicants to the adress of the holders of social insurance of the EU member states via Slovenská pošta.

• Company - energy distributor

  Czech Republic·2019

  40,000 CZK
  Art. 6Art. 29Insufficient legal basis for data processing and processing

• TUSLA

  Ireland·2020-06-01

  40,000 EUR
  Art. 5accidental disclosure of contact, location and school information of children in foster care to a grandparent, allowing the grandparent to contact the foster parent about the children

• VODAFONE ONO, S.A.U.

  Spain·2019-06-28

  36,000 EUR
  Art. 5Non-compliance with general data processing principles

• VODAFONE ESPANA, S.A.U.

  Spain·2019-10-25

  36,000 EUR
  Art. 5Art. 6Insufficient legal basis for data processing

• Italian Data Protection Authority

  Italy·2020-01-23

  30,000 EUR
  Art. 5This fine concerns insufficient technical and organisational measures to ensure information security

• Italian Data Protection Authority

  Italy·2020-01-23

  30,000 EUR
  Art. 32This fine concerns insufficient technical and organisational measures to ensure information security

• Credit brokerage

  Czech Republic·2019-02-04

  30,000 CZK
  Art. 5Insufficient technical and organisational measures to ensure information security

• Social Housing Public Organisation Description

  France·2018-07-24

  30,000 EUR
  Fine

• Telefónica SA

  Spain·2019-11-14

  30,000 EUR
  Art. 5Failure to comply the general data processing principles

• Vueling Airlines

  Spain·2019-10-01

  30,000 EUR
  Art. 5Art. 6Inadequate legal basis for data processing

• Car renting company

  Czech Republic·2019-02-04

  30,000 CZK
  Art. 5Insufficient fulfilment of information obligations

• VODAFONE ESPANA, S.A.U.

  Spain

  27,000 EUR
  Art. 5Insufficient fulfilment of data subjects rights

• Natural person (enterpreneur)

  Czech Republic·2019

  25,000 CZK
  Art. 5Art. 28Art. 32Insufficient technical and organisational measures to ensure information security

• Mermaids

  United Kingdom·2021-07-08

  25,000 GBP
  Art. 5Monetary fine for failure to provide adequate physical security arrangements to protects its customers' personal data as per Art 32 GDPR. The company also failed to prevent fraudulent activities on its customers' bank cards as per Art 5(1)(f).

• Italian Data Protection Authority

  Italy·2020-02-06

  20,000 EUR
  Art. 5This fine concerns the violation of principles of lawfulness and fairness of data processing

• Anonymous

  Czech Republic·2019-02-26

  20,000 CZK
  Art. 15Insufficient fulfilment of data subjects rights

• Car brand

  Portugal·2019-02-05

  20,000 EUR
  Art. 15Insufficient fulfilment of data subjects rights

• An asset management company

  Turkey·2019-05-31

  20,000 TRY
  Art. 5Insufficient technical and organisational measures to ensure information security + Non-compliance with general data processing principles

• Employer - UNIONTRAD COMPANY

  France·2019-06-13

  20,000 EUR
  Art. 5Art. 12Art. 13Art. 32Poor legal basis for data processing

• SC CNTAR TAROM S.A.

  Romania·2019-11-29

  20,000 EUR
  Art. 32Lack of suitable organisational and technical measures

• Vreau Credit SRL

  Romania·2019-10-09

  20,000 EUR
  Lack of appropriate organisational and technical measures

• Unknown

  Germany·2018-12-01

  20,000 EUR
  Art. 83Art. 33Art. 34Failure to comply with the obligation to provide information

• Social Media Chat Platform

  Germany·2018-11-21

  20,000 EUR
  Art. 32Insufficient technical and organisational measures to ensure information security

• Transport company Bratislava a.s.

  Slovakia·2020-07-07

  20,000 EUR
  Art. 5Insufficient legal basis for data processing, Breach of the information obligation

• No information available

  Malta·2018

  19,500 EUR
  No information available

• Website operator

  Belgium·2019-12-17

  15,000 EUR
  Art. 6Art. 12Insufficient legal basis for data processing (no lawful consent); and violation of transparency obligations

• ALLSEAS MARINE S.A.

  Greece·2020-01-13

  15,000 EUR
  Art. 5Violation of an employee's right to access their personal data and unlawful operation of a CCTV system.

• Anonymous

  Czech Republic·2019-02-28

  15,000 CZK
  Art. 5Art. 28Insufficient technical and organisational measures to ensure information security

• Archbishop Makarios III Hospital

  Cyprus·2018-11-07

  15,000 EUR
  Loss of patient file by the hospital

• WORLD TRADE CENTER BUCHAREST S.A.

  Romania·2019-07-08

  15,000 EUR
  Art. 32Lack of required organisational and technical measures

• Online shop with electronics - Alza.cz a.s.

  Czech Republic·2019

  15,000 CZK
  Art. 6Art. 7Art. 12Art. 29Insufficient legal basis for data processing

• Dutch DPA

  Netherlands·2021-05-19

  15,000 EUR
  Art. 9Art. 32A maintenance company (CP&A) is fined because of a violation of art. 9,lid 1 by processing health data of its employees. In addition, CP&A did not take adequate security measures for these data processing.

• Proleasing Motors SRL

  Romania·2020-07-09

  15,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Bank of Cyprus Public Company Ltd

  Cyprus·2020-07-27

  15,000 EUR
  Loss of data and prevention of data subject's right of access

• Individual Doctor

  Cyprus·2019-09-06

  14,000 EUR
  The posting of sensitive personal data of a patient from a Doctor on Instagram

• Prima banka

  Slovakia

  13,300 EUR
  Art. 5Art. 12Art. 15Improper fulfillment of the information obligation, non-transparent processing of the data subject's request for access to data

• Breikot Management Ltd

  Cyprus·2019-04-12

  13,000 EUR
  Art. 5Art. 29Publication of photographs of individuals in the printed form of "24h" newspaper

• Madrileña Red de Gas

  Spain·2019-01-21

  12,000 EUR
  Art. 32Failure to implement sufficient measures to ensure information security

• Restaurant

  Spain

  12,000 EUR
  Art. 5Art. 6Insufficient legal basis for data processing

• Dutch DPA

  Netherlands·2021-06-10

  12,000 EUR
  Art. 32The orthodontic practice is fined because new patients could register via an unsecured website.

• Private Person - Soccer Coach

  Austria·2018-07-01

  11,000 EUR
  Monetary fine because of non-compliance with lawful basis for data processing

• FAN COURIER EXPRESS S.R.L.

  Romania·2019-10-25

  11,000 EUR
  Art. 32Art. 5Lack of required organisational and technical measures

• Merchant

  Belgium·2019-09-17

  10,000 EUR
  Art. 5Art. 6Art. 12Violation of proportionalitypprinciple, no legal basis, and violation of transparency obligations

• Azienda Ospedaliero Universitaria Senese

  Italy·2021-01-27

  10,000 EUR
  Art. 5Art. 9This fine concerns breaches due to: (i) failure to comply with the integrity and confidentiality principle; (ii) processing of special categories of personal data without adequate legal basis.

• TESCO STORES SR, a.s.

  Slovakia·2019-12-19

  10,000 EUR
  Art. 12The proposal's request concerning the exercise of the right of access to his personal data was not compiled with within the time limit set in the GDPR.

• No information available

  Malta·2019

  10,000 EUR
  No information available

• Politis Newspaper

  Cyprus·2019-01-09

  10,000 EUR
  Art. 5Publication of names and photographs of police-investigators at Larnaca Airport by Politis newspaper

• Employer

  Czech Republic·2019-01-10

  10,000 CZK
  Art. 6Insufficient legal basis for data processing

• Hora Credit IFN S.A.

  Romania·2020-01-13

  10,000 EUR
  Art. 5Breach of data accuracy and confidentiality principles; Inssuficient organisational and technical measures; Failure to comply with the deadline to notify the personal data breach to the supervisory authority

• Unknown

  Germany·2019-12-09

  10,000 EUR
  Art. 37Lack of appointment of data protection officer

• The town of Rajecké Teplice

  Slovakia·2020-01-24

  10,000 EUR
  Art. 5Art. 12Art. 13The Controller processed personal data in an illegal manner, kept camera recordings for longer than the time he had set, did not provide the data subjects with information pursuant to Art.13 GDPR in connection with the camera information system.

• Association

  Czech Republic·2018-10-25

  10,000 CZK
  Art. 15Insufficient fulfilment of data subjects rights

• Company

  Czech Republic·2019

  10,000 CZK
  Art. 6Art. 17Insufficient legal basis for data processing and insufficient fulfilment of data subject rights

• CYTA Ltd, Social Insurance Services of the Ministry of the Ministry of Labour, Welfare and Social Insurance of Cyprus, Cyprus Police

  Cyprus·2017

  10,000 EUR
  Art. 32Unauthorised access to data and lack of security of processing

• TELEKOM ROMÂNIA MOBILE COMMUNICATIONS S.A.

  Romania

  10,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• The town of Rajec

  Slovakia·2019-12-03

  9,000 EUR
  Art. 5In the record of processing activities, the controller did not specify the legal basis for the processing of personal data by the camera information system.

• INTELIGO MEDIA SA

  Romania·2019-10-15

  9,000 EUR
  Art. 5Art. 6Art. 7Inadequate legal basis for data processing

• AMADOR RECREATIVOS, S.L

  Spain·2019-05-25

  8,000 EUR
  Art. 5Failure to comply the general data processing principles

• Iberdrola Clientes

  Spain·2019-10-16

  8,000 EUR
  Art. 31Lack of cooperation with the supervisory authority

• CENTER FOR SPEECH AND SPECIAL EDUCATION - MICHOU DIMITRA

  Greece·2020-03-20

  8,000 EUR
  Art. 5Art. 15Violation of parent's right to access personal data of minors

• Private Citizen (pseudonymized)

  Greece·2020-08-26

  8,000 EUR
  Art. 5Unlawful and non-transparent use of CCTV in a private residence

• Dutch DPA

  Netherlands·2021-05-11

  7,500 EUR
  Art. 33Not reporting a data breach, which leaked people's political views. In the event of a serious data breach, a reporting obligation applies.

• FIN, spol s.r.o.

  Slovakia

  7,000 EUR
  Art. 5Art. 33The controller violated the principle of confidentiality by unauthorized processing and access to the personal data of the data subjects.

• Primary school M.R.Štefánika

  Slovakia·2020-08-18

  6,000 EUR
  Art. 5Art. 6Art. 29Art. 12Art. 15Insufficient legal basis for data processing,absence of consent breach of information obligations, breach of the principles of accountability and transparency

• Jocker Premium Invex

  Spain·2019-10-31

  6,000 EUR
  Art. 6Inadequate legal basis for data processing

• Mayor

  Belgium·2019-11-25

  5,000 EUR
  Art. 5Art. 6Violation of purpose limitation principle, and insufficient legal basis for data processing

• Candidate in local elections

  Belgium·2019-11-25

  5,000 EUR
  Art. 5Art. 6Violation of purpose limitation principle, and insufficient legal basis for data processing

• Bulgarian Commission for Personal Data Protection

  Bulgaria·2019

  5,000 BGN
  Art. 5Incompliance with the requirement to ensure that personal data is accurate (infringement of the "accuracy" principle)

• Public service company - employer

  Czech Republic·2019-05-06

  5,000 CZK
  Art. 15Insufficient fulfilment of data subjects rights

• CNTAR TAROM SA

  Romania

  5,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Lands Authority

  Malta·2019-02-18

  5,000 EUR
  Art. 5Art. 32Insufficient technical and organisational measures to ensure information security

• Sigma Live Ltd

  Cyprus·2019-04-12

  5,000 EUR
  Art. 6Sigma Live Ltd had published and processed the complainant's personal data without their prior consent.

• State Hospital

  Cyprus·2019-03-01

  5,000 EUR
  Art. 15Non-compliance with subjects' rights protection safeguards

• VODAFONE ESPANA, S.A.U.

  Spain

  5,000 EUR
  Art. 5Failure to comply the general data processing principles

• Entirely Shipping&Trading S.R.L.

  Romania·2020-01-16

  5,000 EUR
  Art. 5Breach of the controller's obligation to inform data subjects Breach of the principles governing the processing of personal data Lack of legal basis for the processing of data Failure to comply with the conditions for consent

• Small shipping company

  Germany·2019-01-23

  5,000 EUR
  Art. 28Violation of Art. 28 GDPR

• PUBLIC POWER COMPANY S.A. HELLAS (DEI)

  Greece·2020-02-21

  5,000 EUR
  Art. 12Art. 15Violation of right to access

• NEW YORK COLLEGE S.A.

  Greece·2020-06-29

  5,000 EUR
  Art. 5Violation of right to be informed

• Banca Comerciala Romana SA

  Romania·2020-05-05

  5,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• DADA CREATION S.R.L.

  Romania

  5,000 EUR
  Art. 32Art. 33Lack of organisational and technical measures, Failure to notify the data breach to the supervisory authority

• S.C. TIP TOP FOOD INDUSTRY S.R.L.

  Romania

  5,000 EUR
  Art. 5Art. 6Art. 7Infringement of purpose limitation and accuracy principles regarding the processing of personal data, Lack of legal basis for data processing, Non-observance of the conditions for consent

• Vodafone România S.A.

  Romania

  5,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Sports betting company

  Austria·2018-09-12

  4,800 EUR
  Art. 5Art. 6Monetary fine becuase of lack of insufficient legal basis for data processing, lack of video surveillance indication and excessive storage duration

• Altius Insurance Ltd

  Cyprus·2019-03-13

  4,000 EUR
  Art. 6Unauthorised SMS advertising material sent to non-customers.

• The municipality of Horné Plachtince

  Slovakia·2019-08-09

  4,000 EUR
  Art. 5Without the existence of a legal basis, the controller published the birth number of the two data subjects on the website www.horne-plachtince.eu

• Enel Energie Muntenia SA

  Romania·2020-06-18

  4,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Vodafone România S.A.

  Romania

  4,000 EUR
  Non-observance of the data subject's right of access and right to erasure, Failure of the controller to prove that it has responded within the legal deadline to the request of data subject

• Kaufland SR v.o.s.

  Slovakia·2020-07-07

  3,500 EUR
  Art. 12Art. 5Breach of the principle of transparency

• Skroutz.com.cy

  Cyprus·2019-03-28

  3,400 EUR
  Unauthorised promotional material e-mailed to material sent to individuals.

• Aukčný Dom, s.r.o.

  Slovakia·2019-11-04

  3,000 EUR
  Art. 5Aukčný Dom, s.r.o., in the processing of personal data of proposers, violated the principle of legality by publishing photographs of pictorial portraits

• ING Bank N.V. Amsterdam - Bucharest Subsidiary

  Romania

  3,000 EUR
  Art. 5Art. 6Infringement of transparency, purpose limitation, data minimisation and accuracy principles, Lack of legal basis for data processing

• Democratic Party

  Cyprus·2019

  3,000 EUR
  Unauthorised use of direct phone calls to individuals.

• Megareduceri TV SRL

  Romania·2020-10-01

  3,000 EUR
  Art. 83Failure to implement the corrective measure

• Enel Energie S.A.

  Romania·2020-01-14

  3,000 EUR
  Art. 5Art. 21Infrigement of data accuracy principle Lack of legal basis for data processing Non-observance of the data subject's right to object

• Modern Barber S.R.L.

  Romania·2019-12-13

  3,000 EUR
  Art. 83Art. 58Lack of cooperation with Romanian Data Protection Authority

• LEGAL COMPANY & TAX HUB S.R.L.

  Romania·2019-07-12

  3,000 EUR
  Art. 32Lack of suitable organisational and technical measures

• General Confederation of Labour ('CGT')

  Spain·2019-11-13

  3,000 EUR
  Art. 6Inadequate legal basis for data processing

• Vodafone Romania S.A.

  Romania·2020-03-18

  3,000 EUR
  Art. 5Art. 32Infringement of data accuracy and confidentiality principles

• Dante International S.A. (owner of e-MAG.ro)

  Romania·2020-03-25

  3,000 EUR
  Art. 6Art. 21Non-compliance with lawful basis for data processing, non-observance of the data subject's right to object

• Estee Lauder Romania SRL

  Romania·2020-06-11

  3,000 EUR
  Lack of legals basis for data processing

• Telekom Romania Communications SA

  Romania·2020-06-11

  3,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Megareduceri TV S.R.L.

  Romania

  3,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• S.C. Marsorom S.R.L.

  Romania

  3,000 EUR
  Insufficient organisational and technical measures

• BeMi real estate agency, s.r.o. as the controller, processor of BeMi real estate agency, s.r.o.

  Slovakia·2020-01-27

  2,580 EUR
  Art. 5Art. 33The processor has violated the principle of data confidentiality and the controller has breached the obligation under Art. 33 GDPR to report the breach of personal data.

• The town of Tesáre

  Slovakia·2020-01-07

  2,500 EUR
  Art. 5The controller published the birth number without the existence of a legal basis in the minutes of the regular meeting of the Municipal Council in Tesáry

• Royal President S.R.L.

  Romania·2019-11-29

  2,500 EUR
  Art. 12Art. 15Art. 5Art. 32Lack of adeqaute organisational and technical measures

• UTTIS INDUSTRIES S.R.L.

  Romania·2019-08-06

  2,500 EUR
  Art. 12Art. 5Art. 6failure to comply with the obligation to provide transparent information and the principle of data minimisation

• Private person

  Germany·2019-02-05

  2,500 EUR
  Art. 6Art. 5Insufficient legal basis for data processing

• City Council of Nelas

  Portugal

  2,500 EUR
  Disclousure of personal data regarding the health of two citizens on social media.

• Private person. - Owner of a residential unit in an apartment building.

  Austria·2018-12-20

  2,200 EUR
  Art. 5Art. 6Art. 13Monetary fine because of lack of insufficient legal basis for data processing

• Mayor

  Belgium·2019-05-28

  2,000 EUR
  Art. 5Art. 6Violation of purpose limitation principle, and insufficient legal basis for data processing

• Auctioneer

  Cyprus·2019-09-12

  2,000 EUR
  Breach of personal data by auctioneer

• BNP Paribas Personal Finance SA Paris Bucharest Subsidiary (CETELEM IFN S.A.)

  Romania·2019-10-22

  2,000 EUR
  Art. 12Failure to comply with the deadline for responding to the request of data subject

• S.C. C&V Water Control S.A.

  Romania

  2,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• Private Entity

  Portugal·2019-03-25

  2,000 EUR
  Art. 13Insufficient fulfilment of information obligations

• Private Entity

  Portugal·2019-03-19

  2,000 EUR
  Art. 13Inadequate fulfilment of information obligations

• Anonymous individuals

  Cyprus·2019

  2,000 EUR
  Unauthorised processing of personal data for purposes other than those originally intended. Unauthorised sending of messages to individuals.

• Globus Score S.R.L.

  Romania·2019-12-16

  2,000 EUR
  Art. 83Art. 58Lack of cooperation with Romanian Data Protection Authority

• Nicola Medical Team 17 S.R.L.

  Romania·2019-12-13

  2,000 EUR
  Art. 83Art. 58Lack of cooperation with Romanian Data Protection Authority

• "SOS Infertilitatea" Association

  Romania·2020-03-25

  2,000 EUR
  Art. 58Non-cooperation with supervisory authority

• Compania Nationala Posta Romana

  Romania·2020-07-30

  2,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Sanatatea Press Group SRL

  Romania·2020-09-08

  2,000 EUR
  Art. 1Breach of the security measures imposed by GDPR

• Owners associations Militari R

  ·2020-10-01

  2,000 EUR
  Art. 83Failure to implement the corrective measure

• AMERICAN COLLEGE OF GREECE (ACG)

  Greece·2020-10-29

  2,000 EUR
  Art. 12Delayed and incomplete response to rights of access and deletion

• S.C. Viva Credit IFN S.A.

  Romania

  2,000 EUR
  Art. 12Art. 17Failure to respond within the legal deadline to the request of data subject regarding the right "to be forgotten"

• Romanian Post National Company

  Romania

  2,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• Sanatatea Press Group S.R.L.

  Romania

  2,000 EUR
  Art. 5Art. 32Infringement of data integrity and confidentiality principle, Insufficient organisational and technical measures

• Association of apartment owners Militari R, Chiajna village

  Romania

  2,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• Globus Score SRL

  Romania

  2,000 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• S.C. Medicover S.R.L.

  Romania

  2,000 EUR
  Art. 32Lack of appropriate organisational and technical measures

• World Class România S.A.

  Romania

  2,000 EUR
  Art. 32Insufficient organisational and technical measures

• Telekom Romania Communications S.A.

  Romania

  2,000 EUR
  Art. 6Art. 21Lack of legal basis for data processing, Non-observance of the right to object of data subject

• Banca Comercială Română S.A.

  Romania

  2,000 EUR
  Art. 5Art. 6Non-observance of the transparency and accuracy principles regarding data processing, Lack of legal basis for data processing

• SC Dreamtime Call S.R.L.

  Romania

  2,000 EUR
  Art. 83Non-cooperation with the supervisory authority

• Kebab restaurant

  Austria·2019-11-25

  1,800 EUR
  Art. 5Art. 6Monetary fine because of lack of insufficient legal basis for data processing, lack of video surveillance indication and excessive storage duration

• Cerrajero Online

  Spain·2019-06-11

  1,500 EUR
  Art. 13Information obligation non-compliance

• Cerrajero Online

  Spain·2019-11-06

  1,500 EUR
  Art. 13Insufficient fulfilment of information obligations

• Lugera & Makler Broker S.R.L.

  Romania

  1,500 EUR
  Art. 29Art. 32Insufficient organisational and technical measures

• Police Officer

  Germany·2019-05-09

  1,400 EUR
  Art. 6Insufficient legal basis for data processing

• SENECA TOURS s.r.o.

  Slovakia·2020-10-13

  1,300 EUR
  Art. 13Art. 5Art. 4breach of the principle of transparency, Insufficient legal basis for data processing

• A.G. QUICKSPA LIMITED

  Cyprus·2019

  1,200 EUR
  Art. 6Sending SMS marketing messages without consent.

• ING Bank N.V. Amsterdam - Bucharest Subsidiary

  Romania

  1,000 EUR
  Art. 29Art. 32Insufficient organisational and technical measures

• City Councilor of Aglantzia Municipality

  Cyprus·2019-09-25

  1,000 EUR
  Unauthorised processing of personal data by City Councilor

• Dopravný podnik Bratislava, joint stock company

  Slovakia·2019-02-06

  1,000 EUR
  Art. 15Art. 12Failed to comply with the proposer's request to apply the proposer's right of access to his personal data processed through audiovisual recording media and to provide a copy thereof

• M.L. PRO.FIT SOLUTIONS LTD

  Cyprus·2019

  1,000 EUR
  Art. 6Sending SMS marketing messages without consent.

• Grand Ideas Ltd

  Cyprus·2020

  1,000 EUR
  Art. 6Sending unauthorised marketing email without consent

• obec Mojtín

  Slovakia

  1,000 EUR
  Art. 87Unlawful processing of personal identification number.

• Qualitance QBS SA

  Romania

  1,000 EUR
  Art. 32Insufficient organisational and technical measures

• TODOTECNICOS24H S.L.

  Spain·2019-07-11

  900 EUR
  Art. 13Information obligation non-compliance

• Grammar school Nové Zámky

  Slovakia·2020-11-24

  700 EUR
  Art. 5Insufficient legal basis for data processing

• Private Person - Doctor

  Austria·2020-10-19

  600 EUR
  Art. 4Art. 5Art. 9Art. 83Monetary fine; Lack of legal basis for data processing

• Association of apartment owners

  Romania

  500 EUR
  Art. 83Art. 58Non-cooperation with the supervisory authority

• Homeowners Association

  Romania·2019-12-23

  500 EUR
  Art. 32Lack of adeqaute organisational and technical measures

• Owners association Navodari

  Romania·2020-09-01

  500 EUR
  Art. 5Art. 6Art. 83Illegal processing of personal data

• QUALITA s.r.o.

  Slovakia·2020-09-09

  500 EUR
  Art. 12Insufficient legal basis for data processing, unathorized processing of perdonal data , breach of the principle of transparency

• Association of apartment owners - FC5 Building, Navodari city, Constanta county

  Romania

  500 EUR
  Art. 5Art. 6Art. 25Art. 83Non-observance of data processing principles and of the data subject's right to information on his/her personal data processed by the controller, Non-compliance with lawful basis for data processing

• Natural person acting as a General Secretary for a political party in Bucharest

  Romania

  500 EUR
  Art. 32Art. 58Lack of appropriate organisational and technical measures

• Natural person

  Slovakia·2020-10-29

  300 EUR
  Art. 5Insufficient legal basis for data processing, breach of the principle of transparency

• Private car owner

  Austria·2018-09-27

  300 EUR
  Art. 5Art. 6Monetary fine because of lack of insufficient legal basis for data processing, lack of video surveillance indication

• Natural person

  Romania

  200 EUR
  Art. 5Art. 6Art. 13Art. 32Non-observance of the transparency and purpose limitation principles regarding data processing

• Private person

  Austria·2020-10-19

  150 EUR
  Art. 4Art. 5Art. 6Art. 83Monetary fine; Lack of legal basis for data processing

• VODAFONE ESPAÑA, S.A.U.,

  Spain·2019-06-03

  40 EUR
  Art. 6Insufficient legal basis for data processing

• Huge rental company

  Germany·2019-10-01

  15 EUR
  Art. 5Art. 25Non-compliance with the principles of data processing

• POP Akadémia - Pokora Odvaha Pokoj

  Slovakia·2019-06-17

  0 EUR
  Art. 5The controller has not provide necessary information in the scope of Art. The operator continued to publish the photo after withdrawing the proposer's consent to the publication of the photograph.13 GDPR in obtaining the personal data.

• Stavebné bytové družstvo Trenčín

  Slovakia·2020-01-10

  0 EUR
  Art. 5Without a legal basis, the controller enabled the proposer's surname in connection with the information "returned stamps for action and refunded court fee", which was subsequently delivered by the controller to 32 owners of flats and non - residential pre

• O2 Slovakia, s.r.o.

  Slovakia·2019-09-05

  0 EUR
  Art. 6Controller was creating the orders via the controller's website by pre-filling the consents to send the marketing offers.

• Odborné učilište

  Slovakia·2019-09-24

  0 EUR
  Art. 5Art. 9The controller published the proposer's personal data in the scope of name, surname and address. The controller did not designate or disclose the contact details of the data protection officer, nor did he notify them to the Authority.

• Tik Tok

  Italy·2021-03-25

  Temporary limitation of the processing of personal data
  Art. 25Failure to comply with the principle of accountability and privacy by design and by default.

• A mobile network operator company

  Turkey·2019-10-01

  NON
  Art. 11NON

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Failure to implement sufficient measures to ensure information security

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 4Non-compliance with the principle of data minimization

• FERPLAST SLOVAKIA, Limited Liability Company

  Slovakia·2019-04-29

  the personal data proceedings have been suspended
  Art. 5The company suspected that as an employer of an xy employee, it had violated the protection of the employee's personal health data.

• Ministry of Interior of the Slovak Republic

  Slovakia·2019-04-17

  The Authority did not impose a measure to remedy the identified deficiencies
  Art. 5The Office for the Protection of Personal Data dealt with a complaint against the Ministry of the Interior of the Slovak Republic for an alleged violation of the legislation on the protection of personal data.

• Municipality Veľká Lomnica

  Slovakia·2019-02-11

  The Authority did not impose a measure to remedy the identified deficiencies
  Art. 10The municipality of Veľká Lomnica violated the proposer's right to protection against unauthorized disclosure of information about the proposer by publishing a statement containing the proposer's personal information.

• Municipality Bratislava - Ruzinov district

  Slovakia·2019-05-02

  The Authority did not impose a measure to remedy the identified deficiencies
  Art. 5Bratislava Ruzinov City District delivered the decision to the applicant, while the applicant was not an authorized entity to deliver the decision.

• NON

  Turkey·2019-07-23

  NON
  Art. 4NON

• Mimar Sinan Üniversitesi

  Turkey·2019-07-01

  NON
  Art. 15Failure to comply with duties related to ensuring information security + Insufficient legal basis for sensitive data processing

• Unknown

  Turkey·2019-05-31

  NON
  Art. 9Crossborder Data Transfer Requirements

• A gym owner company

  Turkey·2019-05-31

  Unknown
  Art. 6Art. 4Insufficient technical and organisational measures to ensure information security + Insufficient legal basis for data processing

• T.C. Ziraat Bankası A.Ş

  Turkey·2019-05-02

  NON
  Art. 5Non-compliance with the notification obligation + Insufficient legal basis for data processing

• An energy company

  Turkey·2019-03-25

  NON
  Art. 4Explanation of legitimate interest for as a legal basis for Data Processing

• A supermarket (Full name dislosed)

  Turkey·2019-03-25

  NON
  Art. 13Insufficient legal basis for data processing

• Unknown

  Turkey

  NON
  NON

• Unknown

  Turkey·2018-12-24

  NON
  Art. 17Criminal Proceeding Conditions

• Pharmacy

  Turkey·2018-12-05

  Unknown
  Art. 6Non-compliance with general data processing principles

• A bank

  Turkey·2018-12-05

  NON
  Art. 4Maximum data storage time limits

• A legal entity

  Turkey·2018-11-19

  NON
  Art. 2Scope of the Law

• Public Institution

  Turkey·2018-10-16

  Instructed the Data Controller
  Art. 11Insufficient fulfilment of data subjects rights

• Unknown

  Turkey·2018-09-13

  N/A
  Art. 3Definition of Data Controller

• Unknown

  Turkey·2018-08-02

  NON
  Art. 28Unknown

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Non-compliance with the right of consent

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Insufficient fulfilment of information obligations

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 4Insufficient technical and organisational measures to ensure information security

• Unknown

  Turkey·2018-08-02

  Instructed the Data Controller
  Art. 11Non-compliance with information obligations

• Unknown

  Turkey·2018-08-02

  Instructed the Data Controller
  Art. 4Insufficient fulfilment of data subjects rights

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 12Insufficient technical and organisational measures to ensure information security

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 4Non-compliance with general data processing principles

• Unknown

  Turkey·2018-08-02

  Unknown
  Art. 5Failure to implement sufficient measures to ensure information security

• Ready-wear Company

  Turkey

  Unknown, also Instructed the Data Controller
  Insufficient technical and organisational measures to ensure information security

• Unknown

  Turkey·2018-07-26

  Instructed the Data Controller
  Art. 7Non-compliance with the right of consent, and information obligations

• Public Institution

  Turkey·2018-06-28

  N/A
  Art. 7Insufficient technical and organisational measures to ensure information security

• Online Advertising Company Description

  France·2018-10-30

  missing
  Formal Notice

• Toy Manufacturer

  France·2017-11-20

  missing
  Formal Notice

• Slovak Fishermen's Association, Municipal Organization of Žilina

  Slovakia·2020-01-24

  The Authority did not impose a measure to remedy the identified deficiencies The Authority did not impose a fine, instead reprimanded the controller for the breach of the principle of legality
  Art. 5The controller published personal data of the proposer without given consent of the proposer

• Administrative-Territorial Unit 4th District of Bucharest

  Romania

  N/A
  Art. 5Art. 6Infringement of lawfulness, fairness and transparency principle, Lack of legal ground for data processing

• Cluj-Napoca Municipality

  Romania

  N/A
  Art. 5Art. 6Infringement of lawfulness, fairness and transparency principle, Lack of legal ground for data processing