Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topicWho?
by company- Anonymised companies €6.27m 46 % · 50 cases
- France Travail €5m 36 % · 1 case
- Health Service Executive (HSE) €645,000 5 % · 1 case
- Department of Social Protection (DSP) €550,000 4 % · 1 case
- Ελληνική Εταιρεία Τοπικής Ανάπτυξης και Αυτοδιοίκησης Α.Ε. (EETAA) und Υπουργείο Κοινωνικής Συνοχής και Οικογένειας €350,000 3 % · 1 case
- Gemeenten Delft, Ede, Eindhoven u. a. (10 Gemeinden) €250,000 2 % · 1 case
- Stichting Hogeschool van Arnhem en Nijmegen (HAN University of Applied Sciences) €175,000 1 % · 1 case
- National Court Administration (법원행정처) €141,669 1 % · 1 case
- University of Limerick €98,000 1 % · 1 case
- Police Service of Scotland €75,282 1 % · 1 case
- 24 more€148,452
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 12 | €4.5m |
| 2023 | 22 | €590,663 |
| 2024 | 21 | €1.2m |
| 2025 | 17 | €1.09m |
| 2026 | 12 | €6.33m |
84 cases
3 Sep 2026 ASIS – Azienda Speciale per la gestione degli Impianti Sportivi (Trento)Garante: 8,000 EUR for cameras in swimming pool changing rooms of a Trentino sports operator €8,000
Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.
Changing rooms and comparably intimate areas are off limits for video surveillance – even when theft prevention is the motive.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 11 Sep 2026
- Newsletter del 11 settembre 2026 – Garante privacy Press release of an authority
- Garante – Provvedimento n. 619 del 3 settembre 2026 [10294255] (ASIS Trento) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
25 Aug 2026 Health Service Executive (HSE)Irish health service HSE: 645,000 EUR for neglected paper patient records €645,000
In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.
Data protection also applies to paper archives in disused buildings – retention requires an inventory, erasure periods and physical security.
Physical security and retention of paper records
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1
- Action
- Fine
- Status of proceedings
- final
- Sector
- Public sector
- Employees
- 10,000 or more
- Published
- 2 Sep 2026
- Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) Press release of an authority
- EDPB – DPC announces Final Decision following Inquiry into the HSE Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
7 Aug 2026 ACRO Criminal Records OfficeICO: reprimand for ACRO Criminal Records Office after cyber incident Reprimand or warning
The UK Information Commissioner's Office (ICO) issued a reprimand to ACRO Criminal Records Office. According to the ICO, it followed a cyber incident that may have affected the personal data of around 10,000 people in the UK. The ICO found infringements of the duty to implement appropriate technical and organisational security measures under Article 32 UK GDPR. No fine was imposed.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO Enforcement: ACRO Criminal Records Office. Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Reprimand: ACRO Criminal Records Office (7 August 2026) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
28 Jul 2026 Ελληνική Εταιρεία Τοπικής Ανάπτυξης και Αυτοδιοίκησης Α.Ε. (EETAA) und Υπουργείο Κοινωνικής Συνοχής και ΟικογένειαςCyber attack on EETAA systems: EUR 350,000 against social affairs ministry and operator €350,000
A large-scale breach affected EETAA information systems used to implement programmes of the Ministry of Social Cohesion and Family; identification, contact, financial and health data of a large number of people were affected. The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) attributed the success of the attack to outdated systems and inadequate security measures and criticised the absence of a data processing agreement. In Decision 15/2026 it imposed a total of EUR 350,000 (ministry EUR 150,000 under Art. 5(1)(f)/Art. 32 and EUR 50,000 under Art. 28(3) GDPR; EETAA EUR 100,000 under Art. 32 and EUR 50,000 under Art. 28(3) GDPR) and ordered the agreement to be concluded and the planned security measures implemented within one month.
Running legacy systems despite known risks and leaving controller and processor roles without a contract creates liability on both sides.
Outdated IT systems and missing data processing agreements in the public sector
- Authority / court
- Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5 Abs. 1 lit. f, Art. 28 Abs. 3, Art. 32 Abs. 1, Art. 58 Abs. 2 lit. d und i DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Mitigating circumstances
- According to the authority, the ministry met its breach notification and communication obligations.
- ΑΠΟΦΑΣΗ 15/2026 (Αθήνα, 28 Ιουλίου 2026) Decision of an authority
- Αρχή Προστασίας Δεδομένων – Πράξεις της Αρχής: Απόφαση για περιστατικό παραβίασης προσωπικών δεδομένων ΕΕΤΑΑ (Ημερομηνία 28/07/2026) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
27 Jul 2026 Metropolitan Police ServiceICO: order and reprimand against London's Met Police after disclosure of sensitive data Order
The Metropolitan Police handed a defendant unredacted documents containing the new address and telephone number of a stalking victim, and in a circular e-mail disclosed 18 people with a parliamentary connection in an open recipient list. The UK Information Commissioner's Office (ICO) ordered improvements within 3 and 12 months, including in data protection training completion rates.
Policies are not enough if mandatory training goes uncompleted for years – monitor and enforce training completion rates.
Redacting documents, e-mail distribution lists (BCC), data protection training
Missing or inadequate training played a role in the decision.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Data Protection Act 2018, Section 40
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Public sector
- Employees
- 10,000 or more
- Culpability
- negligent
- Published
- 5 Aug 2026
- Metropolitan Police Service issued with enforcement notice and reprimand following data protection failures Press release of an authority
- ICO Enforcement notice: Metropolitan Police Service Enforcement database of an authority
- ICO Reprimand: Metropolitan Police Service Enforcement database of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
22 May 2026 Central Johannesburg TVET College (CJC)Central Johannesburg TVET College: order after staff vetting reports were mis-sent Order
In September 2022 the public TVET college mistakenly emailed reports verifying the qualifications and criminal records of three employees to other staff, informed neither the regulator nor those affected, and had not registered an information officer. Departing from the view of its Enforcement Committee, the regulator also treated this as impermissible further processing and found breaches of accountability, purpose limitation, security safeguards and the notification duty; on 22 May 2026 it ordered, among other things, registration, notification of the breach, a written apology, a compliance framework and POPIA training for all staff.
Sensitive personnel records should be filed separately – and even an internal misdirected email is a notifiable security compromise.
Misdirected emails and handling of personnel records
Missing or inadequate training played a role in the decision.
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Employee data
- Legal basis
- Sections 8, 15(1), 19(1) und 22(1) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Public sector
- Mitigating circumstances
- The college recalled the email two days later, informed staff of the error and took action against those responsible; according to the regulator, this did not relieve it of the duty to notify.
- Published
- 2 Jun 2026
- Information Regulator: Enforcement Notice (Section 95 POPIA) – Central Johannesburg TVET College, dated 22 May 2026 (redacted) Decision of an authority
- Information Regulator Media Statement, 02 June 2026: Information Regulator issues enforcement notices for the contraventions of POPIA and PAIA by public and private bodies Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
7 May 2026 Canada Revenue Agency (CRA)Privacy Commissioner: Canada's tax authority CRA must strengthen protection against account takeovers Other
Since 2020, the Canada Revenue Agency (CRA) has experienced more than 42,000 individual breaches in which unauthorised persons accessed tax accounts or changed data in order to redirect benefits. In a special report to Parliament, the Privacy Commissioner of Canada criticised, among other things, the delayed introduction of mandatory MFA and incomplete incident recording, and made nine recommendations, eight of which were accepted in full and one in part.
Online accounts with payment functions need mandatory strong authentication and complete recording of incidents.
- Authority / court
- Office of the Privacy Commissioner of Canada (OPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Privacy Act (Kanada)
- Action
- Other
- Status of proceedings
- unknown
- Sector
- Public sector
- Employees
- 10,000 or more
- Published
- 7 May 2026
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Mar 2026 Region SyddanmarkRegion Syddanmark: GDPR fine over exposed research database halved on appeal €66,919
In December 2024 the Kolding City Court fined the Region Syddanmark (Region of Southern Denmark) 1,000,000 DKK for two breaches of the duty to ensure appropriate data security. On 23 March 2026 the Vestre Landsret (Western High Court) upheld only the first charge – in a research and clinical database, logged-in users could access PDF documents of more than 23,000 registered persons, including health data of minors in psychiatric care, by changing the URL – and reduced the fine to 500,000 DKK; it acquitted the region of the charge concerning patient data in a presentation on its website.
Access rights must be checked server-side for every document; an editable URL is not access control.
Access control in web applications (manipulable URLs)
- Authority / court
- Retten i Kolding; Vestre Landsret (auf Anzeige der Datatilsynet)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 32 Abs. 1, Art. 83 Abs. 4 lit. a und Abs. 9 DSGVO; databeskyttelseslovens § 41 stk. 1 nr. 1, stk. 3 og 6
- Action
- Fine
- Status of proceedings
- reduced
- Sector
- Public sector
- Culpability
- negligent
- Repeat case
- yes
Original amount 500,000 DKK, converted at the ECB reference rate of 23 Mar 2026.
- Datatilsynet: Region Syddanmark indstilles til bøde (2021, mit Update zu Byret und Landsret) Press release of an authority
- Retten i Kolding, dom 23.12.2024, SS-5399/2023-KOL (Domsdatabasen) Court decision
- Vestre Landsret, dom 23.03.2026, SS-113/2025-VLR (Domsdatabasen, ECLI:DK:VLR:2026:SS0000000101) Court decision
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
20 Feb 2026 The Commissioner of Police for the City of London (City of London Police)ICO: reprimand for City of London Police over late subject access responses Reprimand or warning
The ICO issued a reprimand to the City of London Police. The ICO found that between 1 April 2023 and 31 July 2025 the police force had failed to answer subject access requests within the statutory deadline. The ICO found this breached Article 12(3) UK GDPR and section 45(3) of the Data Protection Act 2018.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 12(3) UK GDPR; section 45(3) DPA 2018; Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO Enforcement: The Commissioner of Police for the City of London. Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Reprimand: City of London Police (20 February 2026) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
3 Feb 2026 Gemeenten Delft, Ede, Eindhoven u. a. (10 Gemeinden)AP: €25,000 each for ten municipalities over analyses of Muslim communities €250,000
Ten municipalities (Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal and Zoetermeer) had received, stored and used analyses of the local Islamic community prepared by an external research firm (mostly so-called power-field analyses, in Haarlemmermeer a quick scan), which also contained information on the religion and other sensitive characteristics of individuals. On 3 February 2026 the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed 25,000 EUR on each board in separate decisions (250,000 EUR in total); for seven municipalities it also restricted further processing of the analyses to handling data subject rights and court proceedings.
Anyone taking over externally prepared reports containing information on religion or belief is themselves processing special category data and needs their own exemption for doing so.
Special category personal data in security analyses
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection
- Legal basis
- Art. 5 Abs. 1 lit. a i. V. m. Art. 6 Abs. 1 und Art. 9 Abs. 1 DSGVO (AVG); Verarbeitungsbeschränkung nach Art. 58 Abs. 2 DSGVO (sieben Bescheide)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 5 Feb 2026
- AP – Boetebesluiten tien gemeenten voor illegaal verwerken van informatie islamitische mensen (Dokumentseite) Decision of an authority
- AP – Boetebesluiten 10 Nederlandse gemeenten (Sammel-PDF), 3 februari 2026 Decision of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
22 Jan 2026 France TravailCNIL: 5 million EUR against France Travail after social engineering attack €5m
In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.
Accounts of external partners with extensive data access need strong authentication, narrow rights and anomaly detection – and their users need training against social engineering.
Social engineering and account takeover
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 32 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Employees
- 10,000 or more
- Published
- 29 Jan 2026
- Violation de données : sanction de 5 millions d'euros à l'encontre de FRANCE TRAVAIL Press release of an authority
- CNIL – Les sanctions prononcées par la CNIL (Eintrag 22/01/2026) Enforcement database of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
8 Jan 2026 Αρχηγείο Πυροσβεστικού Σώματος (Hauptquartier der griechischen Feuerwehr)Greece: 10,000 EUR against Fire Service Headquarters over health data in duty log €10,000
In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.
Employees’ health information never belongs in generally accessible official records – the reason for an absence generally does not need to be disclosed.
Confidential handling of employees’ health data
- Authority / court
- Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 5 Abs. 1 lit. a und c DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Απόφαση 1/2026 της Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
15 Dec 2025 Stichting Hogeschool van Arnhem en Nijmegen (HAN University of Applied Sciences)Netherlands: 175,000 EUR against HAN university over inadequate security after hack €175,000
In 2021, a hacker gained access via a web form to a web server and a database server of the university, obtained, among other things, names with passwords and citizen service numbers of students and staff, and unsuccessfully demanded a ransom. According to the Dutch data protection authority (Autoriteit Persoonsgegevens, AP), security was not aligned with the risks, and the rights of a database account were not restricted.
Give database accounts of web applications minimal rights so that a single vulnerability does not expose the entire data set.
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- DSGVO Art. 32
- Action
- Fine
- Status of proceedings
- final
- Sector
- Public sector
- Culpability
- negligent
- Mitigating circumstances
- Settlement without objection; active damage limitation, strengthened resilience and sharing of lessons learned with other organisations.
- Published
- 17 Dec 2025
- HAN krijgt boete van 175.000 euro voor onvoldoende beveiliging van persoonsgegevens Press release of an authority
- Boete HAN Decision of an authority
- AP: Besluit tot oplegging van een bestuurlijke boete aan Stichting Hogeschool van Arnhem en Nijmegen Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
12 Dec 2025 Police Service of ScotlandICO: £66,000 fine and reprimand for Police Scotland over handling of sensitive data €75,282
The ICO fined the Police Service of Scotland £66,000 and also issued a reprimand. The ICO found that, during a criminal investigation, the police carried out a bulk download of data from the mobile phone of an employee who had made a complaint, without ensuring that this was lawful, fair and limited to what was necessary; it found infringements for the period 18 January to 5 April 2021. For this the ICO issued the reprimand under sections 35 and 37 DPA 2018 (Part 3). The ICO also found that the Professional Standards Department later disclosed this data without authorisation to the person accused, in an internal misconduct investigation. Appropriate technical and organisational measures for compiling such misconduct packs were missing, and the breach was only reported to the ICO on 30 June 2022, although the police had known of it since 17 June 2022. For these infringements the ICO imposed the fine. The combined notice relies, among other provisions, on Articles 5(1)(f) and 32(1) UK GDPR (security of processing), Articles 5(1)(c) and 25 UK GDPR (data minimisation, data protection by design) and Article 33(1) UK GDPR (breach notification).
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5(1)(c), 5(1)(f), 25(1)-(2), 32(1) und 33(1) UK GDPR; section 155 DPA 2018 (Geldbuße); sections 35 und 37 DPA 2018 (Part 3), Verwarnung nach Schedule 13 para 2(c) DPA 2018
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
Original amount 66,000 GBP, converted at the ECB reference rate of 12 Dec 2025.
- ICO Enforcement: Police Service of Scotland. Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Reprimand and Penalty Notice: Police Service of Scotland (12 December 2025) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
10 Dec 2025 University of LimerickDPC: €98,000 fine against University of Limerick after phishing of staff mailboxes €98,000
Between 2018 and 2020 the university notified twelve personal data breaches, six of which involved unauthorised persons gaining access to staff email accounts through phishing and in some cases setting up forwarding rules. The DPC found infringements of Art. 5(1)(f), 30(1), 32(1), 33(1) and 34(1) GDPR, issued a reprimand and imposed fines of €45,000, €3,000, €35,000 and €15,000, totalling €98,000.
Phishing protection for mailboxes and clear internal reporting channels determine whether data breaches are reported to the authority and affected persons on time.
Recognising phishing and reporting data breaches within 72 hours
Missing or inadequate training played a role in the decision.
- Authority / court
- Data Protection Commission (DPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5(1)(f), 30(1), 32(1), 33(1), 34(1) DSGVO; ss. 110–111 Data Protection Act 2018
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Mitigating circumstances
- The university accepted most of the findings, acknowledged responsibility and improved its systems, training and policies; the fines are well below those in the draft and no remedial order was made.
- DPC: Inquiry concerning the University of Limerick (IN-19-7-1) Decision of an authority
Checked against the official source on 2 Oct 2026 · Direct link
Report an error
13 Nov 2025 Blouberg Local MunicipalityInformation Regulator: ZAR 500,000 against Blouberg municipality over personnel data online €25,309
The municipality had processed personal information of a former employee which was exposed on the internet; the Information Regulator treated this as a gross violation of privacy and issued an enforcement notice. Because the municipality did not implement the corrective instructions, an administrative fine of ZAR 500,000 followed; as it did not pay, the Regulator has initiated court proceedings to recover the amount.
Personnel data remains protected after employees leave; ignoring regulatory orders risks a heavy fine and recovery proceedings.
Protecting personnel data of former employees
- Authority / court
- Information Regulator (South Africa)
- Area of law
- Data protection · Employee data
- Legal basis
- Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 13 Nov 2025
Original amount 500,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.
- Information Regulator: Media briefing – high-level cases on POPIA and PAIA (13.11.2025) Press release of an authority
Checked against the official source on 4 Oct 2026 · Direct link
Report an error
23 Oct 2025 Comune di CurtaroloMunicipality of Curtarolo: 15,000 EUR for video surveillance of streets and employees €15,000
The municipality in the province of Padua monitored public streets and work areas without a sound legal basis, without adequate information and without a data protection impact assessment; recordings were used for disciplinary purposes, and an employee was secretly filmed while on sick leave. Italy's data protection authority (Garante per la protezione dei dati personali) imposed a fine of 15,000 EUR (5,000 EUR for public surveillance, 10,000 EUR for workplace surveillance).
Do not repurpose video recordings for disciplinary proceedings; specific employment law protections apply to employees.
Purpose limitation in video surveillance and employee data
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Data protection · Video surveillance
- Legal basis
- DSGVO Art. 5, 6, 12, 13, 35, 88
- Action
- Fine
- Status of proceedings
- final
- Sector
- Public sector
- Provvedimento del 23 ottobre 2025 [10196164] Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
9 Oct 2025 South Wales PoliceICO: enforcement notice against South Wales Police over subject access backlog Order
The ICO issued an enforcement notice to South Wales Police over serious delays in handling subject access requests. The ICO found that from April 2023 to March 2024 the force answered only 29% of requests on time; in August 2025, 352 requests were overdue, one of them by almost two years. The ICO ordered the force to clear the backlog by June 2026. The legal basis is Articles 12(3), 15(1) and 15(3) UK GDPR and section 45 of the Data Protection Act 2018. According to the notice, the force employs almost 3,000 police officers and over 2,200 other staff.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 12(3), 15(1) und 15(3) UK GDPR; section 45 DPA 2018; section 149 DPA 2018
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Public sector
- Employees
- 1,000 to 9,999
- ICO Enforcement: South Wales Police. Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Enforcement Notice: South Wales Police (9 October 2025) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
4 Sep 2025 Einheitlicher Abwicklungsausschuss (Single Resolution Board, SRB)CJEU: pseudonymised data in disclosure to Deloitte – EDPS v SRB –
The Single Resolution Board (SRB) passed on pseudonymised comments from former Banco Popular shareholders to Deloitte without informing the data subjects; the European Data Protection Supervisor (EDPS) considered this an infringement of the duty to inform. The Court of Justice of the European Union (Case C-413/23 P) set aside the judgment of the General Court and clarified that the duty to inform is to be assessed from the controller's perspective at the time of collection; the case was referred back to the General Court.
Pseudonymisation does not release the controller from informing data subjects about the recipients of their data.
- Authority / court
- Gerichtshof der Europäischen Union, Rs. C-413/23 P
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Verordnung (EU) 2018/1725 (Informationspflicht)
- Status of proceedings
- under appeal
- Sector
- Public sector
- Published
- 4 Sep 2025
- Press Release No 107/25: Judgment of the Court in Case C-413/23 P EDPS v SRB Court press release
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
27 Aug 2025 Bristol City CouncilICO: enforcement notice against Bristol City Council over unanswered subject access requests Order
The ICO issued an enforcement notice to Bristol City Council because it found that the council had not responded to subject access requests as required by law. The notice relies on Articles 12(3), 15(1) and 15(3) UK GDPR and examines, among other things, the period from 1 April 2023 to 31 March 2024.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- Art. 12(3), 15(1) und 15(3) UK GDPR; section 149 DPA 2018
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Public sector
- ICO Enforcement: Bristol City Council. Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Enforcement Notice: Bristol City Council (27 August 2025) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link