Who was sanctioned, and for what?

Using credentials stolen elsewhere, attackers logged in en masse on the websites of GS SHOP (June 2024 to February 2025) and GS25 (December 2024 to January 2025) and obtained data on 1,581,025 and 79,128 people respectively; GS Retail Co., Ltd. detected neither the bursts of login attempts from the same IP addresses nor the rising number of failed attempts, and after the first discovery at GS25 did not stop the parallel attack on GS SHOP. The authority also found an inadequate data protection organisation and that 1,599 further people were notified more than 72 hours late, imposed a penalty surcharge of 12,836,000,000 KRW and an administrative fine of 3,000,000 KRW (12,839,000,000 KRW in total) and ordered detection measures and a review of the data protection organisation.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 34(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and 40% for cooperation, remediation and protective efforts (ISMS-P certification, self-regulation, privacy impact assessment); increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to deploy dedicated data protection staff and to define the powers and responsibility of its chief privacy officer (CPO) clearly.

Published

31 Aug 2026

Original amount 12,839,000,000 KRW, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined the online dietary supplement retailer Lab Pharma AS NOK 205,000 for breaching its duty to cooperate with the supervisory authority (Art. 31 GDPR): the company had threatened case handlers with police reports and lawsuits in order to end the investigation of a complaint, and submitted requested documents late. The authority also ordered the company to delete the name and images of a former advertising partner (an influencer) from all its websites and to stop using her data for marketing until it can demonstrate a legal basis, as the underlying contract had already expired in March 2017.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 31, Art. 58 Abs. 2 lit. f, g und i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Liability of senior managers

Datatilsynet attributed the intentional conduct of the company's management to the company.

Published

17 Aug 2026

Original amount 205,000 NOK, converted at the ECB reference rate of 12 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The ICO fined Elderly Aids Limited, a seller of call-blocking devices, £190,000 and also issued an enforcement notice. The ICO found that the company had made 758,053 unsolicited direct marketing calls to numbers registered with the TPS/CTPS whose subscribers had not agreed to such calls, leading to 20 complaints. The legal basis is regulations 21 and 24 of PECR. Under the notice, payment by 7 September 2026 reduces the amount by 20% to £152,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998 (Geldbuße), section 40 DPA 1998 (Anordnung)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Original amount 190,000 GBP, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In a targeted inspection of cookies on company websites, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) found fault with the site 4mebeles.lv. After a reprimand in February 2026, the company claimed that the deficiencies had been remedied, which a further inspection disproved; further requests for information went unanswered. The DVI imposed 1,000 EUR for failure to cooperate and requested the missing information by 3 August 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

The online retailer had not set a retention period for customer accounts and kept data until customers requested deletion; purchases were only possible with an account. The sanctions board of the Finnish Data Protection Ombudsman imposed 856,000 EUR in 2024, the administrative court reduced the fine to 792,639 EUR on the basis of current turnover, and the Supreme Administrative Court (Korkein hallinto-oikeus, KHO) confirmed this on 12 June 2026.

Authority / court

Korkein hallinto-oikeus (KHO); Sanktionsgremium des Datenschutzbeauftragten

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Retail and e-commerce

Published

18 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

A data subject complained about the disclosure of footage from the supermarket chain’s video surveillance and about the inadequate response to his access request. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that Market In had passed the video footage to the judicial authorities without informing the data subject beforehand, processed more data than necessary, failed to comply with the right of access and failed to cooperate with the authority, and by Decision 10/2026 imposed a total of 95,000 EUR (50,000 EUR for lawfulness/transparency, 20,000 EUR each for data minimisation and the right of access, 5,000 EUR for failure to cooperate); in the same proceedings, ΜΕΔΕ ΑΕ received 65,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, Art. 5 Abs. 2, Art. 12, 13, 15, 31 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Checked against the official source on 25 Sep 2026 · Direct link

A former employee used authentication signing keys that had been accessible to him in plain text during his employment and were neither renewed nor destroyed after he left to create forged tokens and, from April to November 2025, retrieve data on around 33.22 million customers and delivery data on around 4.33 million other people. For inadequate security measures the authority imposed a penalty surcharge of 423,575,000,000 KRW on Coupang Corp. and, for late notification and failure to delete, an administrative fine of 16,800,000 KRW (423,591,800,000 KRW in total) and criticised the exclusion of the chief privacy officer from the internal investigation. A separate decision on the same day imposed a further 201,106,000,000 KRW for collecting behavioural data on third-party websites and apps without consent.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 34(1), Art. 21(1), Art. 31(6), Art. 63(2); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Reduction of 30% because no benefit was derived and 50% for remediation, compensation, certification and proportionality; increases of 25% (duration of the infringement), 30% (at least two previous penalties) and 10% (obstruction of the investigation).

Liability of senior managers

The chief privacy officer (CPO) was excluded from the internal investigation and publication; the company was ordered to set up governance that secures the CPO’s independent work and access to information in incidents.

Published

11 Jun 2026

Original amount 423,591,800,000 KRW, converted at the ECB reference rate of 10 Jun 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined Elkjøp Nordic AS and Elkjøp Norge AS NOK 20,000,000. Following an on-site inspection in June 2022, the authority found that consent for the customer club was neither informed nor specific nor freely given, that club data had been reused without a legal basis for the 'kundematch' (customer match) tool, that the lawfulness of so-called offline conversions had not been assessed and documented, and that rectification requests had not been handled within the deadlines. The decision was adopted under the cooperation mechanism with the supervisory authorities of Sweden, Iceland, Finland and Denmark; more than six million club members across the Nordic countries were affected.

Authority / court

Datatilsynet

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 i. V. m. Art. 4 Nr. 11, Art. 6 Abs. 4, Art. 5 Abs. 2 i. V. m. Art. 5 Abs. 1 lit. a, Art. 12 Abs. 3 DSGVO; Art. 58 Abs. 2 lit. i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Improvements made after the inspection, Datatilsynet's long case-handling time and the lack of evidence that sensitive data were processed; the amount is well below the starting point in the EDPB guidelines (0.4–0.8% of group turnover).

Published

4 Jun 2026

Original amount 20,000,000 NOK, converted at the ECB reference rate of 1 Jun 2026.

Checked against the official source on 28 Sep 2026 · Direct link

Both companies continued to use e-mail addresses and telephone numbers from online purchases for advertising, although data subjects had objected – in some cases after deletion had been confirmed. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) ordered the processing for advertising to cease and the data to be deleted on request.

Authority / court

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)

Area of law

Data protection · Marketing and consent

Legal basis

DSG Art. 6, Art. 30 Abs. 2 lit. b, Art. 31

Action

Order

Status of proceedings

final

Sector

Retail and e-commerce

Published

26 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

In 2021, the Luxembourg data protection authority (CNPD) had imposed 746 million EUR and an order to bring processing into compliance on account of behavioural online advertising; the Administrative Tribunal (Tribunal administratif) confirmed this on 18 March 2025. On 12 March 2026, the Administrative Court (Cour administrative) confirmed that legitimate interest was not a sound legal basis and that the information was insufficient, but annulled the fine on the basis of more recent CJEU case law on the requirement of culpability; the CNPD is re-examining the sanction.

Authority / court

Cour administrative (Luxemburg); Verfahren der CNPD

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. f, Art. 12 ff. DSGVO

Action

Order

Status of proceedings

overturned

Sector

Retail and e-commerce

Employees

10,000 or more

Mitigating circumstances

Amazon had implemented the compliance order before the hearing.

Checked against the official source on 25 Sep 2026 · Direct link

During a wave of boycotts in 2024, Loblaw did not process deletion requests in time and retained purchase and usage data from the loyalty programme (more than 17 million members) even after accounts were closed, without demonstrating effective anonymisation. Loblaw undertook to the Office of the Privacy Commissioner of Canada (OPC) to have the anonymisation independently reviewed and to carry out annual deletions.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

PIPEDA

Action

Other

Status of proceedings

unknown

Sector

Retail and e-commerce

Employees

10,000 or more

Published

5 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined an unnamed retail chain EUR 3,500,000 (EUR 2,500,000 under Art. 6(1)(a), 13, 32 and 35 GDPR and EUR 1,000,000 under Art. 82 of the Loi Informatique et Libertés, the French Data Protection Act). Since 2018 the company had transferred e-mail addresses and telephone numbers of members of its loyalty programme to a social network without valid consent in order to show them targeted advertising there; more than 10.5 million people were affected. In addition, there was inadequate information, weak password rules with SHA-256 hashing, no data protection impact assessment, and cookies that were set before any choice and continued to be read after a refusal.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. a, 13, 32 und 35 DSGVO; Art. 82 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Published

22 Jan 2026

Checked against the official source on 2 Oct 2026 · Direct link

Following a cyber attack involving unauthorised access to data, which according to the decision may have affected up to around 6.38 million people (including around 4.67 million customers in Spain as well as employees and former employees), the AEPD as lead authority found inadequate security measures (Art. 5(1)(f) GDPR). The sanction of 2,600,000 EUR was reduced by 40% to 1,560,000 EUR because liability was acknowledged and payment made voluntarily; remedial measures were also ordered.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f DSGVO

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Employees

1,000 to 9,999

Mitigating circumstances

40% reduction for acknowledgement of liability and voluntary payment (Art. 85 LPACAP).

Published

19 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

In 2022, during a large data migration project, the online wine retailer suffered unauthorised access to a database holding data on around 928,760 customers and members (identity, contact and financial information). The Privacy Commissioner found that Vinomofo had not taken reasonable steps to protect the data, although it had been aware of deficiencies in its security governance at least two years before the incident, and ordered it not to repeat these practices, together with specified remedial steps.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

APP 11.1 (Privacy Act 1988 (Cth))

Action

Order

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

29 Oct 2025

Checked against the official source on 3 Oct 2026 · Direct link

A retail company (name not published) had advertising letters sent via service providers and, in several cases, failed for an extended period to respond in time to the data subject rights that recipients then asserted. The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) imposed a fine of 195,000 EUR; the measure was published in the interim report of 30 September 2025 (exact date of the decision not stated).

Authority / court

Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (HmbBfDI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO (Betroffenenrechte)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

30 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

The rural retail giant inadequately informed consumers and job applicants about their rights, offered no effective means of opting out of the sale and sharing of data (including no Global Privacy Control) and passed data on to third parties without the required contracts. An officer must certify compliance annually for four years, as required by the California Privacy Protection Agency (CPPA).

Authority / court

California Privacy Protection Agency (CPPA)

Area of law

Data protection · Data subject rights and transparency

Legal basis

California Consumer Privacy Act (CCPA)

Action

Fine

Status of proceedings

final

Sector

Retail and e-commerce

Employees

10,000 or more

Published

30 Sep 2025

Original amount 1,350,000 USD, converted at the ECB reference rate of 26 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined Samaritaine SAS, operator of the Paris department store of the same name, EUR 100,000 because in August 2023, in response to thefts of goods, it had installed cameras disguised as smoke detectors and capable of recording sound in two stockrooms, which employees discovered a few weeks later. The CNIL objected to the lack of any prior assessment and documentation of the covert deployment, intended to be only temporary, the excessive recording of employees' conversations, the late involvement of the data protection officer, and the failure to notify and document a personal data breach after employees kept the memory cards containing the recordings when the cameras were removed (Art. 33(1) and (5) GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 5 Abs. 2, Art. 5 Abs. 1 lit. c, Art. 33 Abs. 1 und 5, Art. 38 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Employees

250 to 999

Culpability

negligent

Published

23 Sep 2025

Checked against the official source on 2 Oct 2026 · Direct link

The furniture retailer had stored data of around 385,000 customers in a legacy system without retention periods. The district court had imposed 100,000 DKK; following a referral to the CJEU on whether the fine is to be calculated on the basis of the turnover of the entire group, the High Court increased the fine to 1.5 million DKK.

Authority / court

Vestre Landsret (auf Anzeige der Datatilsynet)

Area of law

Data protection

Legal basis

DSGVO Art. 5 Abs. 1 lit. e, Art. 83

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Original amount 1,500,000 DKK, converted at the ECB reference rate of 2 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

On shein.com, advertising cookies were placed without consent as soon as the site was accessed; in addition to an incomplete cookie banner, there was an advertising pop-up without an option to reject. After clicking ‘Reject all’ or withdrawing consent, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 150 million EUR.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés (Umsetzung von Art. 5 Abs. 3 ePrivacy-Richtlinie)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

From June 2020 to July 2022, Kmart Australia used facial recognition in 28 stores to record the face of every person who came in and of every customer at the returns counters, with the aim of uncovering refund fraud, without informing them or obtaining their consent. The Privacy Commissioner rejected the exception for addressing unlawful activity, because the indiscriminate collection of sensitive biometric information was disproportionate given less intrusive alternatives and its limited benefit, and ordered that the conduct must not be continued or repeated. The decision is currently under review before the Administrative Review Tribunal; hearings are scheduled for early 2027. The decision is not final.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Video surveillance

Legal basis

Privacy Act 1988 (Cth), APP 1.3, 1.4, 3.3, 3.4, 5.1, 5.2

Action

Order

Status of proceedings

under appeal

Sector

Retail and e-commerce

Mitigating circumstances

Kmart stopped using the system in July 2022 when the investigation began and cooperated with the regulator throughout.

Published

18 Sep 2025

Checked against the official source on 3 Oct 2026 · Direct link