Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by companyWhen?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2023 | 1 | – |
| 2024 | 0 | – |
| 2025 | 1 | €582,573 |
| 2026 | 3 | €140,080 |
5 cases
25 Mar 2026 RENAULT COMMERCIAL ROUMANIE S.R.L.Cyber attack via service provider – Renault Commercial Roumanie pays 125,000 EUR €125,083
In an attack on an application operated by a processor, data of a very large number of persons (including personal identification numbers, driving licence and identity card numbers, vehicle identification numbers) were stolen and published. The Romanian data protection authority (ANSPDCP) criticised the lack of security measures and effectiveness testing as well as the selection of a service provider without sufficient guarantees and imposed 637,262.50 lei (125,000 EUR).
Responsibility for customer data does not end with the service provider – check its security guarantees in advance and monitor them continuously.
- Authority / court
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Area of law
- Data protection · Data processors
- Legal basis
- Art. 32 Abs. 1 lit. b und d, Abs. 2 i. V. m. Art. 28 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Automotive
- Published
- 25 Mar 2026
Original amount 637,262.5 RON, converted at the ECB reference rate of 25 Mar 2026.
- ANSPDCP – Comunicat de presă 25.03.2026 (RENAULT COMMERCIAL ROUMANIE S.R.L.) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Jan 2026 Continental Automotive Products SRLExcel list with sick notes circulated internally – Continental Automotive pays 15,000 EUR €14,997
An Excel file containing data from medical certificates of current and former employees was repeatedly circulated within the company; the company reported the incident itself. The Romanian data protection authority (ANSPDCP) imposed 25,455 lei (5,000 EUR) for breach of data minimisation and accountability and 50,911 lei (10,000 EUR) for insufficient security measures and ordered a monitoring and control procedure. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.
Employees’ health data do not belong in freely forwarded Excel lists – HR departments need fixed access limits.
Handling employees’ health data, e-mail distribution lists
- Authority / court
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 5 Abs. 1 lit. c und Abs. 2, Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Automotive
- Published
- 19 Jan 2026
Original amount 76,366 RON, converted at the ECB reference rate of 19 Jan 2026.
- ANSPDCP – Comunicat de presă 19.01.2026 (Continental Automotive Products SRL) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
13 Jan 2026 General Motors LLC, General Motors Holdings LLC und OnStar, LLCGeneral Motors/OnStar: FTC order after sale of location and driving data Order
The FTC finalised its order against General Motors and OnStar. According to the authority, GM used a misleading enrolment process to sign customers up for the OnStar service and the Smart Driver feature, collected precise location and driving behaviour data from millions of vehicles and sold it to third parties, including consumer reporting agencies, without clear notice and affirmative consent. GM may not disclose this data to consumer reporting agencies for five years and, for the 20-year term of the order, must obtain affirmative consent before collecting, using or sharing connected vehicle data, allow access and deletion, and offer a way to disable location collection; the order does not provide for any payment. The authority allegedly made the findings set out here; this account is not based on a final judgment.
Data from connected products may only be passed to third parties after clear notice and affirmative consent – a tick box in the enrolment process is no substitute.
Consent for connected products; sharing of location and usage data
- Authority / court
- Federal Trade Commission (FTC)
- Area of law
- Data protection · Marketing and consent
- Legal basis
- Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)
- Action
- Order
- Status of proceedings
- final
- Sector
- Automotive
- Employees
- 10,000 or more
- Published
- 14 Jan 2026
- FTC, In the Matter of General Motors LLC et al., Docket No. C-4828, Decision and Order (issued 13.01.2026) Decision of an authority
- FTC-Pressemitteilung: FTC Finalizes Order Settling Allegations that GM and OnStar Collected and Sold Geolocation Data Without Consumers' Informed Consent (14.01.2026) Press release of an authority
- FTC, In the Matter of General Motors LLC et al., Docket No. C-4828, Complaint Decision of an authority
Checked against the official source on 3 Oct 2026 · Direct link
Report an error
7 Mar 2025 American Honda Motor Co., Inc.CPPA: $632,500 against Honda over obstructed privacy requests €582,573
Honda required excessive information for opt-out requests, used a cookie tool without equivalent choices, made it harder to appoint authorised agents and passed data on to ad-tech firms without the required contracts. The order of the California Privacy Protection Agency (CPPA) requires, among other things, a simplified procedure and training for employees.
Do not undermine data subject rights through form hurdles or asymmetric consent dialogues.
- Authority / court
- California Privacy Protection Agency (CPPA)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- California Consumer Privacy Act (CCPA)
- Action
- Fine
- Status of proceedings
- final
- Sector
- Automotive
- Employees
- 10,000 or more
- Published
- 12 Mar 2025
Original amount 632,500 USD, converted at the ECB reference rate of 7 Mar 2025.
- CPPA: Enforcement action against American Honda Motor Co. Press release of an authority
- CPPA Order of Decision: American Honda Motor Co., Inc. (ENF23-V-HO-2) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
12 Jul 2023 a Japanese carmakerCarmaker: data protection authority guidance after vehicle data was exposed for ten years Reprimand or warning
Because of a misconfigured cloud environment at an affiliated contractor within the group, servers for two of the carmaker's connected-vehicle services were accessible from outside for around ten years; data of about 2.3 million people were affected, including in-vehicle device IDs, vehicle identification numbers and location data. The carmaker had not recognised these data as personal data, as the staff responsible had not been adequately trained, and had not checked the contractor’s access controls. The authority gave the company guidance (shidō) under Art. 147 APPI to improve training, access control and supervision of the contractor and to implement its own remedial measures.
Vehicle identification numbers and locations are personal data too: anyone configuring cloud storage must know this, and contractors’ access settings must be checked.
Secure cloud configuration and recognising personal data
Missing or inadequate training played a role in the decision.
- Authority / court
- Personal Information Protection Commission (PPC, 個人情報保護委員会)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 147 i. V. m. Art. 23 und Art. 25
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Automotive
- Employees
- 10,000 or more
- Published
- 12 Jul 2023
Checked against the official source on 8 Oct 2026 · Company name anonymised since 12 Jul 2025 · Direct link