Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by topic- International data transfers €390m 89 % · 2 cases
- Employee data €20.4m 5 % · 8 cases
- no topic €10.3m 2 % · 4 cases
- Data subject rights and transparency €10m 2 % · 2 cases
- Data breaches and data security €3.73m 1 % · 5 cases
- Data processors €2.72m 1 % · 3 cases
- Marketing and consent €312,576 0 % · 1 case
- Video surveillance €129,266 0 % · 1 case
Who?
by company- Anonymised companies €303.8m 69 % · 10 cases
- MLU B.V. (Rechtsnachfolgerin der Ridetech International B.V., Anbieterin der Yango-App) €100m 23 % · 1 case
- Amazon France Logistique SAS €15m 3 % · 1 case
- AENA, S.M.E., S.A. €10m 2 % · 1 case
- Foodinho S.r.l. (Glovo-Gruppe) €5m 1 % · 1 case
- DPD Polska sp. z o.o. €2.72m 1 % · 1 case
- Iberia Líneas Aéreas de España, S.A. Operadora €650,000 0 % · 1 case
- Poczta Polska S.A. €232,208 0 % · 1 case
- MÁV Személyszállítási Zrt. (Rechtsnachfolgerin der MÁV-HÉV Zrt.) €129,266 0 % · 1 case
- Taxa 4x35 €33,492 0 % · 1 case
- 7 more€31,801
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2022 | 1 | €230,000 |
| 2023 | 5 | €10.5m |
| 2024 | 6 | €298.1m |
| 2025 | 7 | €25.2m |
| 2026 | 7 | €103.6m |
26 cases
7 Jul 2026 Unternehmen mit drei Dienstfahrzeugen (in der Mitteilung nicht namentlich genannt)Administrative Court upholds ban on continuous GPS tracking of three company vehicles Order
The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.
Employee consent rarely supports monitoring – and never when it is bundled with other declarations in the form.
Consent and proportionality in employee monitoring
- Authority / court
- Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Published
- 7 Jul 2026
- Upravno sodišče znova potrdilo prakso IP: sistematično GPS sledenje zaposlenim ni dopustno brez tehtnega razloga Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
4 May 2026 Berliner Verkehrsbetriebe (BVG) AöRBlnBDI reprimands BVG: deletion at service provider not checked, data breach reported too late Reprimand or warning
A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.
Have service providers prove deletion after the end of the contract, and have an internal procedure that immediately turns indications of a breach into a 72-hour notification.
Reporting process for data breaches and management of service providers
- Authority / court
- Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
- Area of law
- Data protection · Data processors
- Legal basis
- Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Mitigating circumstances
- BVG has announced measures against similar incidents.
- Published
- 4 May 2026
- Datenschutzbeauftragte verwarnt BVG Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
1 Apr 2026 MLU B.V. (Rechtsnachfolgerin der Ridetech International B.V., Anbieterin der Yango-App)Yango taxi app: 100 million EUR for transferring data to Russia €100m
Amsterdam-based Ridetech offered the ride-hailing app Yango in Finland and Norway and transferred data of drivers and customers to the group companies Yandex.Taxi LLC and Yandex LLC in Russia without demonstrating appropriate safeguards. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 100 million EUR on the legal successor and prohibited further transfers to Russia.
Transfers to states without legal protection against access by authorities can hardly be safeguarded – group structures with such locations need data localisation in the EU.
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44, Art. 46 iVm Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Mar 2026 Iberia Líneas Aéreas de España, S.A. OperadoraAEPD: €650,000 fine for Iberia after unauthorised access at service provider €650,000
In February 2023 there was external, unauthorised access to a system operated by a processor containing data on users and employees. As lead authority, the AEPD imposed 650,000 EUR for breaching Art. 5(1)(f) GDPR, dropped the charges under Art. 32 and 34 and ordered appropriate security measures within six months. The amount and the facts have not been confirmed against the primary source.
Even where a service provider runs the system, the company remains responsible for the confidentiality of the data and must ensure adequate security.
- Authority / court
- Agencia Española de Protección de Datos (AEPD)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5 Abs. 1 lit. f DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- AEPD, Resolución PS/00437/2024 (EXP202309769), Iberia Líneas Aéreas de España Decision of an authority
Checked against the official source on 7 Oct 2026 · Version 2 · Direct link
Report an error
24 Feb 2026 Amazon Italia Logistica S.r.l.Garante halts records on illness and strikes at Amazon Italia Logistica Order
During an inspection at the Passo Corese logistics centre (around 1,800 employees), the Garante (Italian data protection authority) found that, after return-to-work interviews, information on illnesses, participation in strikes, trade union activities and family circumstances of employees – irrelevant to their professional aptitude – was recorded in free-text fields of a platform linked to time recording and accessible to many managers. With immediate effect it ordered the definitive restriction of processing of these entries – also at all other sites using the platform – and of four cameras at the entrances to toilets and break areas; the investigation was continuing.
Notes from staff interviews may only contain job-relevant information – health, strike participation and private life do not belong in HR systems.
Documenting staff interviews and sensitive employee data
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 5 Abs. 1 lit. a, c und e, Art. 6, 9 und 88 DSGVO; Art. 113 Codice privacy (D.Lgs. 196/2003); Maßnahme nach Art. 58 Abs. 2 lit. f DSGVO
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Employees
- 10,000 or more
- Published
- 24 Feb 2026
- Garante, Provvedimento n. 107 del 24 febbraio 2026 (Amazon Italia Logistica s.r.l.), doc. web n. 10224096 Decision of an authority
- Garante, Comunicato stampa 24 febbraio 2026: Garante privacy ad Amazon, stop alla schedatura dei lavoratori Press release of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
5 Feb 2026 DPD Polska sp. z o.o.DPD Polska: PLN 11.46m in fines, including for missing data processing agreements €2.72m
The UODO (Urząd Ochrony Danych Osobowych, Polish data protection authority) fined the parcel carrier DPD Polska sp. z o.o. a total of PLN 11,461,030. PLN 6,251,471 relates to the company using external hauliers for shipments between its depots without a data processing agreement under Art. 28(3) GDPR, although they had access to the address labels during loading and unloading; PLN 5,209,559 relates to staff not being given effective authorisations to process data and the company's own data protection policy not being implemented (Art. 24, 29, 32 GDPR). The authority classed both infringements as intentional and treated earlier reprimands against the company as aggravating. The decision is not final.
Even pure transport providers can be processors if they have access to personal data such as address labels – an Art. 28 GDPR contract is then mandatory.
Recognising data processing by logistics and transport providers
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Data protection · Data processors
- Legal basis
- Art. 28 Abs. 3 i. V. m. Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO; Art. 24 Abs. 1 und 2, Art. 29, Art. 32 Abs. 1 und 4 i. V. m. Art. 5 Abs. 1 lit. f und Abs. 2 DSGVO; Art. 83 Abs. 4 lit. a und Abs. 5 lit. a DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Culpability
- intentional
- Repeat case
- yes
- Mitigating circumstances
- It was treated as mitigating that, after the proceedings were opened, DPD amended its contracts with the hauliers to include data processing terms and changed its procedure for granting authorisations.
- Liability of senior managers
- No personal liability was established.
- Published
- 23 Feb 2026
Original amount 11,461,030 PLN, converted at the ECB reference rate of 5 Feb 2026.
- UODO: Naruszenie przepisów RODO przez firmę kurierską (23.02.2026) Press release of an authority
- Decyzja Prezesa UODO DKN.5112.1.2023 vom 5. Februar 2026 (Portal Orzeczeń UODO) Decision of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
2 Jan 2026 Poczta Polska S.A.Poczta Polska: 978,128 PLN because the data protection officer was not independent €232,208
The function of data protection officer was performed by a manager who was at the same time responsible for security and protection of classified information and thus monitored their own activities; there was no conflict analysis. Poland’s data protection authority (UODO) imposed 978,128 PLN and referred to numerous previous reprimands and orders against the company.
Data protection officers must not be responsible for the processes they monitor – check dual roles for conflicts of interest in advance.
- Authority / court
- Prezes Urzędu Ochrony Danych Osobowych (UODO)
- Area of law
- Data protection
- Legal basis
- Art. 38 Abs. 3 und 6 DSGVO (DKN.5131.4.2025)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Employees
- 10,000 or more
- Repeat case
- yes
- Mitigating circumstances
- During the proceedings the function was made independent and placed directly under the management board.
- Published
- 26 Jan 2026
Original amount 978,128 PLN, converted at the ECB reference rate of 2 Jan 2026.
- Kara dla Poczty Polskiej za brak zapewnienia niezależności sprawowania funkcji IOD Press release of an authority
- Decyzja DKN.5131.4.2025 z 2 stycznia 2026 Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Dec 2025 Amazon France Logistique SASConseil d'État reduces CNIL fine against Amazon France Logistique to 15 million EUR €15m
In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.
Store employee performance metrics only for as long and in as much detail as their specific purpose requires.
- Authority / court
- Conseil d'État
- Area of law
- Data protection · Employee data
- Legal basis
- Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO
- Action
- Fine
- Status of proceedings
- reduced
- Sector
- Transport, logistics and shipping
- Employees
- 10,000 or more
- Conseil d'État, décision n° 492830 du 23 décembre 2025 Court decision
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Dec 2025 MÁV Személyszállítási Zrt. (Rechtsnachfolgerin der MÁV-HÉV Zrt.)MÁV: HUF 50m for audio recording by cameras at HÉV stations €129,266
For years the cameras at stations and stops of the Budapest suburban railway HÉV also recorded sound; the NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, Hungarian data protection authority) found breaches of transparency, data minimisation, lawfulness, storage limitation and the duty to carry out a data protection impact assessment. It imposed HUF 50,000,000 on the operator's legal successor and at the same time warned it against future audio recording without demonstrated necessity.
Audio recording in video surveillance is a separate and serious intrusion that needs its own necessity assessment, including an impact assessment.
Audio recording in video surveillance of public spaces
- Authority / court
- Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. a, c, e, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13 Abs. 1 lit. e, Art. 35 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Culpability
- negligent
- Published
- 19 Dec 2025
Original amount 50,000,000 HUF, converted at the ECB reference rate of 19 Dec 2025.
- NAIH, Határozat NAIH-1589-19/2025 Decision of an authority
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
2 Dec 2025 Post Office LimitedICO: reprimand for Post Office over publication of unredacted settlement deed Reprimand or warning
On 2 December 2025 the ICO issued a reprimand to Post Office Limited. The ICO found that on 25 April 2024 the company put the unredacted version of a settlement deed on its corporate website instead of the intended redacted one, exposing personal data of 502 postmasters who had taken part in the 2017 group litigation linked to the Horizon IT scandal. The ICO concluded that appropriate technical and organisational measures were lacking, in breach of Articles 5(1)(f), 32(1) and 32(2) UK GDPR. No fine was imposed.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5(1)(f), 32(1) und 32(2) UK GDPR; Art. 58(2)(b) UK GDPR
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- ICO Enforcement: Post Office Limited. Enthält Informationen des Information Commissioner's Office, lizenziert unter der Open Government Licence v3.0. Enforcement database of an authority
- Reprimand: Post Office Limited (2 December 2025) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
24 Nov 2025 SIA "EUROPARK LATVIA"Europark Latvia pays 25,000 EUR for payment reminders sent to outdated addresses €25,000
Following several complaints, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) examined how the parking operator collects contractual penalties: invoices were sent to previous rather than current registered addresses, claims were handed over to debt collection services and entered in the database of Kredītinformācijas Birojs. The authority found breaches of the principles of lawfulness, data minimisation and confidentiality and of the accountability obligation and imposed 25,000 EUR (previous year’s turnover according to the decision: 8,323,178 EUR).
Anyone collecting debts or reporting them to credit agencies must first ensure that address data are up to date.
Data quality in receivables management
- Authority / court
- Datu valsts inspekcija (DVI)
- Area of law
- Data protection
- Legal basis
- Art. 5 Abs. 1 lit. a, c, f und Abs. 2, Art. 83 Abs. 5 lit. a DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Culpability
- intentional
- Mitigating circumstances
- Practice changed after the proceedings began; contracts concluded with the population and vehicle registers (PMLP, CSDD)
- DVI Lēmums Nr. 01630000100425-3 Par soda piemērošanu (SIA „EUROPARK LATVIA“), 24.11.2025 Decision of an authority
- Datu valsts inspekcija – Lēmumi (Liste der veröffentlichten Entscheidungen) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
6 Nov 2025 AENA, S.M.E., S.A.AEPD: €10m fine for AENA over airport facial recognition without a valid DPIA €10m
The airport operator AENA used a biometric facial recognition system for access, transit and boarding at several airports without presenting a data protection impact assessment meeting the legal requirements. The AEPD imposed 10,043,002 EUR for breaching Art. 35 GDPR and confirmed the provisional suspension of all biometric processing until a proper impact assessment is in place.
Anyone introducing biometric identification needs a sound impact assessment beforehand that genuinely tests necessity and proportionality.
Data protection impact assessment before introducing biometric systems
- Authority / court
- Agencia Española de Protección de Datos (AEPD)
- Area of law
- Data protection
- Legal basis
- Art. 35 DSGVO (Art. 83 Abs. 4 lit. a DSGVO)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Employees
- 1,000 to 9,999
- Published
- 20 Mar 2026
- AEPD, Resolución PS/00431/2024 (EXP202304532), AENA Decision of an authority
- BOE: Resolución de 4 de marzo de 2026 der AEPD, Sanktionen über 1 Mio. Euro Official register or notice
- AEPD, Memoria 2025 (Tabelle der 2025 unterzeichneten Bußgelder über 1 Mio. Euro) Official register or notice
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
18 Jun 2025 Waxholms Ångfartygs AktiebolagWaxholmsbolaget: fine for processing a captain’s breathalyser test results €6,801
The shipping company processed results of on-board breath alcohol tests that could be attributed to a complainant employed as a captain. The Swedish Authority for Privacy Protection (IMY) regarded this as processing without a legal basis and as unlawful processing of health data and imposed 75,000 SEK.
Monitoring data such as alcohol test results are employees’ health data – access, storage and legal basis must be settled before such tests are introduced.
Employee health data (alcohol tests)
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · Employee data
- Legal basis
- DSGVO Art. 6, Art. 9
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Published
- 18 Jun 2025
Original amount 75,000 SEK, converted at the ECB reference rate of 18 Jun 2025.
- IMY – Tillsyn Waxholms Ångfartygs AB (WÅAB) Decision of an authority
- IMY – Beslut efter tillsyn, IMY-2024-1520 (18.06.2025) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
28 Apr 2025 Taxa 4x35Taxa 4x35: appeal court raises GDPR fine to DKK 250,000 for excessive retention €33,492
The Østre Landsret (Eastern High Court) raised the fine of 100,000 DKK imposed by the Frederiksberg City Court in January 2023 to 250,000 DKK. The taxi company had kept customers' telephone numbers together with pick-up locations for five years instead of the necessary two; the Datatilsynet (Danish Data Protection Agency) had proposed 1.2 million DKK in its first GDPR fine recommendation and cited around 8.9 million affected trips. The court found the infringement negligent and reduced the amount because the proceedings had lasted about six years.
Retention periods must cover every identifier – deleting only the name while keeping the phone number is not anonymisation.
Retention periods and genuine anonymisation
- Authority / court
- Østre Landsret (auf Anzeige der Datatilsynet)
- Area of law
- Data protection
- Legal basis
- Art. 5 Abs. 1 lit. e, Art. 83 Abs. 5 lit. a DSGVO; databeskyttelseslovens § 41 stk. 1 nr. 4, stk. 3 og 6
- Action
- Fine
- Status of proceedings
- final
- Sector
- Transport, logistics and shipping
- Culpability
- negligent
- Mitigating circumstances
- Negligence, first offence, no particularly sensitive data, secure storage, prompt remediation after the report; long duration of the proceedings.
Original amount 250,000 DKK, converted at the ECB reference rate of 28 Apr 2025.
- Datatilsynet: Datatilsynet indstiller taxaselskab til bøde på 1,2 mio. kr. (25.03.2019, mit Update zu Byret und Landsret) Press release of an authority
- Østre Landsret, dom 28.04.2025, S-185-23 (Domsdatabasen, ECLI:DK:OLR:2025:SS0000000378) Court decision
- Retten på Frederiksberg, dom 06.01.2023, SS-5405/2020-FRB (Domsdatabasen) Court decision
Checked against the official source on 28 Sep 2026 · Direct link
Report an error
13 Nov 2024 Foodinho S.r.l. (Glovo-Gruppe)Garante: 5 million EUR against Glovo subsidiary Foodinho over monitoring of riders €5m
The delivery platform unlawfully processed data on more than 35,000 riders: facial recognition for identity verification, location tracking even outside working hours and automated assessments without human review. Foodinho had already been sanctioned with 2.6 million EUR in 2021; in addition to 5 million EUR, the Italian data protection authority (Garante per la protezione dei dati personali) prohibited the biometric processing.
Algorithmic management of workers requires transparency and human review, and must not include tracking outside working hours.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Data protection · Employee data
- Legal basis
- DSGVO (u. a. Transparenz, biometrische Daten, automatisierte Entscheidungen)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Repeat case
- yes
- Published
- 22 Nov 2024
- Rider, Garante privacy: no all'algoritmo incontestabile dai lavoratori Press release of an authority
- Garante – Rider: Sanzione di 2,6 milioni di euro a una piattaforma del gruppo Glovo (2021) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 2 · Direct link
Report an error
13 Nov 2024 Posti Jakelu OyPosti: 2.4 million EUR for automatically created e-mailboxes – court annuls fine overturned
Customers who ordered, for example, mail forwarding automatically received an electronic OmaPosti mailbox that could not be deselected separately; they were also informed insufficiently and in part incorrectly about the activation. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found no contractual legal basis for this bundling and imposed 2.4 million EUR together with a reprimand and an order to rectify the situation. On 3 November 2025 the Helsinki Administrative Court upheld the reprimand and the order on account of the insufficient information but annulled the fine, as it considered the processing necessary for the contract on Posti’s electronic services.
Do not sell add-on services on the back of the contractual legal basis – anything not necessary for the main contract requires a separate choice.
- Authority / court
- Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)
- Area of law
- Data protection · Data subject rights and transparency
- Legal basis
- DSGVO Art. 6 Abs. 1 lit. b, Art. 13, Art. 25
- Action
- Fine
- Status of proceedings
- overturned
- Sector
- Transport, logistics and shipping
- Published
- 15 Nov 2024
Amount in EUR; no ECB reference rate is available for this currency.
- Tietosuojavaltuutettu – Postille seuraamusmaksu OmaPosti-palvelun tietosuojapuutteista (15.11.2024) Press release of an authority
- Finlex – Tietosuojavaltuutettu 13.11.2024 (sähköinen postilaatikko) Decision of an authority
- Helsingin hallinto-oikeus – kumosi Posti Jakelu Oy:lle määrätyn 2,4 miljoonan euron seuraamusmaksun (03.11.2025) Court press release
Checked against the official source on 28 Sep 2026 · Version 3 · Direct link
Report an error
22 Jul 2024 a US ride-hailing company and its Dutch subsidiaryRide-hailing company: 290 million EUR – driver data sent to the USA for two years without a transfer tool €290m
The company stored sensitive data of European drivers – including location, payment and identity document data, and in some cases criminal and health data – on servers in the USA and from August 2021 no longer used any transfer tool. Following complaints from more than 170 French drivers, the Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 290 million EUR; it was the AP’s third fine against the company.
Intra-group transfers to headquarters are third-country transfers – anyone who lets a transfer tool lapse transfers data without a legal basis.
- Authority / court
- Autoriteit Persoonsgegevens (AP)
- Area of law
- Data protection · International data transfers
- Legal basis
- Art. 44 DSGVO
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Transport, logistics and shipping
- Employees
- 10,000 or more
- Repeat case
- yes
- Published
- 26 Aug 2024
- Autoriteit Persoonsgegevens, Bußgelder und Sanktionen (Übersicht) (Entscheidung 2024) Press release of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 Jul 2026 · Direct link
Report an error
14 May 2024 a Singaporean companyCompany: 120,000 SGD over undeleted data on server of a former group company €82,141
During a cloud migration in 2020 and a restructuring in 2022, the company failed to have data on employees, former employees, directors and shareholders deleted from a shared server belonging to the subsidiary; in September 2022 an attacker gained access to that server through the compromised account of one of the former subsidiary's vendors. Numerous individuals were put at risk, and data on some of them – in some cases images of identity documents, signatures, bank accounts and salaries – may have been exfiltrated. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) treated the failure to delete for more than two years, without clear instructions to or supervision of staff, as a negligent breach of the Protection Obligation and, in view of the duration, the type of data and deterrence, imposed 120,000 SGD; it accepted a voluntary undertaking from the former subsidiary.
In migrations and restructurings, the deletion of legacy personal data must be expressly instructed, checked and tracked in the data inventory.
Verifiably delete data after migrations and maintain a data inventory
Missing or inadequate training played a role in the decision.
- Authority / court
- Personal Data Protection Commission (PDPC)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Culpability
- negligent
- Mitigating circumstances
- Prompt action once alerted to the incident, admission under the Expedited Decision Procedure and cooperation.
- Published
- 2 Aug 2024
Original amount 120,000 SGD, converted at the ECB reference rate of 14 May 2024.
- PDPC, Enforcement Decisions (Übersicht) (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 May 2026 · Direct link
Report an error
5 Mar 2024 an English port authorityICO: reprimand for port authority over a police messaging app group Reprimand or warning
The ICO issued a reprimand to an English port authority, the employer of the port's police force. According to the ICO's findings, a port police officer set up a distribution group in a messaging app on his personal mobile phone (later moved to another app), which several UK police forces and international law enforcement agencies used to tackle vehicle crime, without organisational oversight or compliance with data protection law. The ICO considered the period from May 2018 to February 2021 and found infringements of section 35(1) DPA 2018 (lawful and fair processing) and section 40 DPA 2018 (security). The reprimand is dated 5 March 2024; the ICO case page lists the case under 15 March 2024.
- Authority / court
- Information Commissioner's Office (ICO)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Section 35(1) und section 40 DPA 2018; Verwarnung nach Art. 58(2)(b) UK GDPR/Schedule 13(2)(c) DPA 2018
- Action
- Reprimand or warning
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- ICO, Übersicht der Durchsetzungsmaßnahmen (Entscheidung 2024) Enforcement database of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Mar 2026 · Direct link
Report an error
28 Feb 2024 a Greek postal companyGreece: almost 3 million EUR against postal company after ransomware attack €3m
In a cyber attack in 2022, attackers obtained administrator access, disabled protective software, encrypted files and later published stolen data on the darknet. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that the postal company had not implemented the necessary technical and organisational measures or its own security policy and imposed 2,995,140 EUR.
A security policy on paper offers no protection – what is examined is whether it has actually been implemented.
Cyber defence, handling of administrator accounts
- Authority / court
- Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Art. 5 Abs. 1 lit. f, Art. 32 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Transport, logistics and shipping
- Hellenic DPA, Entscheidungen (Übersicht) (Entscheidung 2024) Decision of an authority
Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 28 Feb 2026 · Direct link