Who was sanctioned, and for what?

In 2019, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) had imposed 14.5 million EUR on the housing group because tenant data such as salary statements, bank statements and social security data were held in an archive system with no means of deletion. Following the 2023 CJEU judgment on direct corporate liability, the Berlin Regional Court (Landgericht Berlin I) confirmed on 9 June 2026 infringements of data minimisation and storage limitation; the press release does not state the amount of the fine set by the court.

Authority / court

Landgericht Berlin I (Bußgeldbehörde: Berliner Beauftragte für Datenschutz und Informationsfreiheit)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5, Art. 25 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Liability of senior managers

According to the CJEU (C-807/21), a breach of duty by a person in a management position need not be proven for the corporate fine.

Published

10 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and issued an enforcement notice. After executing a search warrant in April 2025, the regulator found that between October 2024 and March 2025 the company had instigated 575,062 unsolicited marketing calls to numbers that had been on the TPS register for more than 28 days. There were 132 complaints. The legal basis is regulations 21 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 240,000 GBP, converted at the ECB reference rate of 28 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The management corporation of the Riverfront Residences condominium had not designated a data protection officer until March 2025, had no data protection policies of its own and had given its managing agent, which acted for it as a data intermediary, no instructions on handling personal data; in April 2025 an employee of the managing agent mistakenly sent the names, addresses and maintenance fee details of two owners to another owner. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found breaches of the Accountability Obligation and the Protection Obligation; by contrast, it found no breach in the circulation of a requisition for an extraordinary general meeting bearing the names and signatures of 303 owners, because strata management law prevailed. It directed the corporation to introduce, within 90 days, policies and procedures for the processing of data by the managing agent and to communicate them to it; the managing agent itself had given a voluntary undertaking.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Sections 11(3) und 12(a) PDPA 2012 (Accountability Obligation); Section 24 i. V. m. Section 4(3) PDPA (Protection Obligation bei Einsatz eines Data Intermediary)

Action

Order

Status of proceedings

unknown

Sector

Construction and real estate

Published

7 May 2026

Checked against the official source on 4 Oct 2026 · Direct link

An estate agency (name not published) kept 11,887 brokerage contracts from 2010 to 2019, together with 914 copies of identity cards, passports and bank cards, without a legal basis, although the managing director stated that no card copies were collected. The Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) also criticised irregular and inadequate data protection training for employees and imposed 100,000 EUR (date of publication; exact date of the decision not stated).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. c und e, Art. 6 Abs. 1, Art. 32 Abs. 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Culpability

negligent

Mitigating circumstances

No damage to data subjects was found.

Published

19 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined Home Improvement Marketing Ltd £300,000 and issued an enforcement notice. After executing a search warrant in March 2024, it found that between 31 May and 31 August 2023 the company had instigated 2,449,380 automated marketing calls without prior consent; 274 complaints were received. According to the ICO, the software responded to recipients' answers and offered no way to opt out of further calls. The legal basis is regulations 19 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 19 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 300,000 GBP, converted at the ECB reference rate of 28 Aug 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Green Spark Energy Ltd £250,000 and issued an enforcement notice. After executing a search warrant in March 2024, the regulator found that from May 2023 to May 2024 the company had instigated 9,587,050 automated calls carrying recorded marketing messages; 497 complaints were received. According to the ICO, the recordings contained misleading statements designed to pressure homeowners, for example about supposed risks of their existing loft insulation. The legal basis is regulations 19 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 19 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 250,000 GBP, converted at the ECB reference rate of 28 Aug 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A person involved in a traffic accident next to the condominium requested access to the CCTV footage in April 2024; the security company could not save it for lack of administrator access, the system overwrote it after 17 days, and the management corporation then refused the request, citing other individuals' data and strata management law. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) held that a blanket refusal was not justified (other individuals could have been masked) but, as the footage no longer existed, made no finding on the access obligation, and found a negligent breach of the Accountability Obligation: no data protection officer, no data protection policy of its own (only the managing agent's) and no instructions to the managing agent and security company on handling access requests. It directed the corporation to introduce, within 60 days, policies and a procedure for access requests concerning CCTV footage and to pass them on to the managing agent and contractors.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Sections 11(3) und 12 PDPA 2012 (Accountability Obligation); geprüft auch Sections 21 und 22A PDPA (Auskunft, Aufbewahrung bei Ablehnung)

Action

Order

Status of proceedings

unknown

Sector

Construction and real estate

Culpability

negligent

Mitigating circumstances

The management corporation appointed a data protection officer after the incident.

Published

7 Aug 2025

Checked against the official source on 4 Oct 2026 · Direct link

Because of vandalism, the operator of the City2 shopping centre had installed cameras in toilet areas; one camera in the men’s toilets also captured the area in front of the urinal despite a black masking, and there were no signs. The court followed the Danish Data Protection Agency (Datatilsynet) and the public prosecutor and imposed 350,000 DKK for breach of the data minimisation principle.

Authority / court

Retten i Glostrup (auf Anzeige der Datatilsynet)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 5 Abs. 1 lit. c; databeskyttelsesloven § 41; tv-overvågningsloven

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 350,000 DKK, converted at the ECB reference rate of 19 Dec 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

An estate agency (name redacted in the publication) continuously filmed workstations and break areas with image and sound, accessible via a smartphone app, and used the software Time Doctor to record keyboard and mouse activity as well as screenshots of the computers; several people accessed this data via the administrator account of one of them. The French data protection authority (CNIL) found infringements of data minimisation, legal basis, information, security and the obligation to carry out an impact assessment, and imposed 40,000 EUR.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. c, Art. 6, 12, 13, 32, 35 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Checked against the official source on 25 Sep 2026 · Direct link

The landlord monitored a multi-family building in Malmö around the clock with cameras at entrances, lifts, flat doors, in the stairwell, the basement and the refuse room, without any legal basis for doing so; the signs did not name the controller. The Swedish Authority for Privacy Protection (IMY) imposed 200,000 SEK and ordered the landlord to stop the surveillance except in the garage and to supplement the signs.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1, Art. 13

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

12 Dec 2024

Original amount 200,000 SEK, converted at the ECB reference rate of 11 Dec 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

On 15 August 2024 the ICO fined a UK windows and conservatories company GBP 40,000 and served an enforcement notice on the same day. According to the ICO's findings, between 1 January and 1 June 2023 the company made 18,280 unsolicited marketing calls to lines that had been on the TPS or CTPS opt-out registers for at least 28 days, without the subscribers having agreed to such calls; eight complaints resulted. The ICO treated this as a breach of regulation 21(1)(b) of PECR. Under the notice, payment by 16 September 2024 reduced the fine to GBP 32,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 21(1)(b) PECR; section 55A DPA 1998 (Geldbuße); section 40 DPA 1998 (Enforcement Notice)

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 40,000 GBP, converted at the ECB reference rate of 15 Aug 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 15 Aug 2026 · Direct link

The ICO issued a reprimand to a Scottish charitable social landlord with around 4,700 properties. According to the ICO's findings, a new customer portal went live on 14 July 2022 with a configuration error that gave residents with an ongoing anti-social behaviour case access to other residents' documents. 139 people were affected, 62 of whom the association considered at high risk; the data remained visible for five days because a first report from a resident was not escalated. According to the association, testing before launch had only checked functionality, not data protection. The ICO found this breached Article 5(1)(f) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Construction and real estate

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 Apr 2026 · Direct link

On 11 January 2024 the ICO fined the company GBP 100,000 and served an enforcement notice on the same day. According to the ICO's findings, between 2 March and 31 May 2022 the company instigated 614,342 unsolicited marketing calls to numbers that had been registered with the TPS for more than 28 days; complainants said the calls promoted energy grants for resin driveways. The people called were also not given the caller information required by law. The ICO treated this as a breach of regulations 21 and 24 of PECR. Under the notice, payment by 13 February 2024 reduced the fine to GBP 80,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 21 und 24 PECR; section 55A DPA 1998 (Geldbuße); section 40 DPA 1998 (Enforcement Notice)

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 100,000 GBP, converted at the ECB reference rate of 11 Jan 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 11 Jan 2026 · Direct link

The DSB (Datenschutzbehörde, Austrian data protection authority) fined a non-profit housing company limited by shares 10,000 EUR because it left several requests for comments in a complaint procedure between November 2021 and June 2022 unanswered, thereby breaching its duty to cooperate with the supervisory authority. The cause was internal failings in forwarding official letters; the DSB found conditional intent. Mitigating factors were the confession, the absence of previous infringements and a new control system for official mail together with staff training.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection

Legal basis

Art. 31 iVm Art. 58 Abs. 1 lit. a und e DSGVO; Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

final

Sector

Construction and real estate

Culpability

intentional

Repeat case

no

Mitigating circumstances

No previous infringements; cooperation, insight and confession; new control system for official documents and internal data protection training.

Checked against the official source on 2 Oct 2026 · Company name anonymised since 7 Dec 2025 · Direct link

On 18 May 2023 the ICO fined the company GBP 130,000 and served an enforcement notice on the same day. According to the ICO, the case formed part of Operation Tinago, which analysed complaints in the energy and home improvement sector. According to the ICO's findings, between 4 January and 11 November 2021 the company made 503,445 unsolicited marketing calls to numbers registered with the TPS, among other things about double glazing and free energy checks, resulting in 37 complaints. The ICO treated this as a breach of regulation 21 of PECR. Under the notice, early payment reduced the fine to GBP 104,000. The ICO published the case on 8 June 2023.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 21 PECR; section 55A DPA 1998 (Geldbuße); section 40 DPA 1998 (Enforcement Notice)

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 130,000 GBP, converted at the ECB reference rate of 18 May 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 May 2025 · Direct link

On 30 September 2022 the ICO fined a UK company offering insulation, roof upgrades, conservatories and extensions GBP 40,000 and served an enforcement notice on the same day. According to the ICO's findings, during 2020 the company made 11,825 unsolicited marketing calls to numbers registered with the TPS or CTPS; different trading names were used on the calls, and according to the ICO the company had bought at least 425,214 records. The ICO treated this as a breach of regulations 21 and 24 of PECR. Under the notice, early payment reduced the fine to GBP 32,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998 (Geldbuße); section 40 DPA 1998 (Enforcement Notice)

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 40,000 GBP, converted at the ECB reference rate of 30 Sep 2022.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Sep 2024 · Direct link

On 29 September 2022 the ICO fined a UK supplier of windows, doors and conservatories GBP 150,000. According to the ICO's findings, between 1 August 2020 and 30 April 2021 the company made 461,062 marketing calls to numbers that had been registered with the TPS for more than 28 days; 460,978 of those calls withheld the caller's number. Complaints referred, among other things, to calls about windows and government grants and to repeated calls after people had objected. The ICO treated this as a breach of regulation 21 of PECR. Under the notice, payment by 28 October 2022 reduced the fine to GBP 120,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 21 PECR; section 55A DPA 1998 (Geldbuße)

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 150,000 GBP, converted at the ECB reference rate of 29 Sep 2022.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 29 Sep 2024 · Direct link

A surveying engineer used the electronic land register to identify hundreds of landowners and passed the data on to a property development company, which wrote to the owners with purchase offers without informing them of the data source. The Baden-Württemberg data protection authority (LfDI BW) imposed 50,000 EUR on the property developer and 5,000 EUR on the surveyor (55,000 EUR in total); both decisions became final.

Authority / court

Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. f, Art. 14 DSGVO

Action

Fine

Status of proceedings

final

Sector

Construction and real estate

Published

21 Sep 2022

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Sep 2024 · Direct link