31 Oct 2025 Google LLCTexas: Google pays $1.375 billion over location, incognito and biometric data USA, TXCookies and tracking €1.19bn

Texas, represented by the Office of the Attorney General, had sued Google for unlawfully collecting location data, activity in incognito mode and biometric identifiers. Google signed a settlement of $1.375 billion, concluding two sets of proceedings.

What organisations can take from it

Settings such as location history or incognito mode must deliver what they promise users – otherwise billion-dollar risks loom, even at the level of individual US states.

Authority / court: Office of the Attorney General of Texas
Area of law: Data protection · Cookies and tracking
Action: Other
Status of proceedings: final
Sector: Telecoms, IT and software
Employees: 10,000 or more
Published: 31 Oct 2025

Original amount 1,375,000,000 USD, converted at the ECB reference rate of 31 Oct 2025.

Sources

Attorney General Ken Paxton Finalizes Historic Settlement with Google and Secures $1.375 Billion Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

22 Sep 2026 Miljödata i Karlskrona AktiebolagIMY: 1.8 million SEK against HR software provider Miljödata after data leak SwedenData breaches and data security €160,053

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

What organisations can take from it

Service providers hosting the health and personnel data of many employers need real-time attack detection, not just perimeter protection.

Authority / court: Integritetsskyddsmyndigheten (IMY)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 32 Abs. 1 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Culpability: negligent
Published: 22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Sources

IMY Tillsyn: Miljödata i Karlskrona AB Press release of an authority
Beslut efter tillsyn enligt dataskyddsförordningen – Miljödata i Karlskrona Aktiebolag (IMY-2025-21177) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

3 Sep 2026 Banco Bilbao Vizcaya Argentaria, S.A. – Niederlassung Italien (BBVA Italia)Garante: 5.5 million EUR against BBVA Italia over advertising despite objection ItalyMarketing and consent €5.51m

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

What organisations can take from it

An objection to advertising must take effect immediately and reliably across all channels – including app messages.

Authority / court: Garante per la protezione dei dati personali
Area of law: Data protection · Marketing and consent
Legal basis: Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Published: 11 Sep 2026

Sources

Newsletter del 11 settembre 2026 – Garante privacy Press release of an authority
Provvedimento n. 613 del 3 settembre 2026 (BBVA Italia) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

3 Sep 2026 Azienda Sanitaria Universitaria Friuli Centrale (ASUFC)Garante: Udine hospital group pays 24,000 EUR for viewing a colleague's patient record ItalyEmployee data €24,000

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

What organisations can take from it

Patient records may only be opened for treatment – include this in training and secure it technically through role-based rights and logging.

Relevance to training and awareness

Purpose limitation when accessing patient records

Authority / court: Garante per la protezione dei dati personali
Area of law: Data protection · Employee data
Legal basis: Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario
Action: Fine
Status of proceedings: unknown
Sector: Healthcare
Published: 11 Sep 2026

Sources

Newsletter del 11 settembre 2026 – Garante privacy Press release of an authority
Garante privacy, azienda sanitaria di Udine sanzionata per 24mila euro Press release of an authority
Garante – Provvedimento n. 616 del 3 settembre 2026 [10293994] (ASUFC) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

3 Sep 2026 ASIS – Azienda Speciale per la gestione degli Impianti Sportivi (Trento)Garante: 8,000 EUR for cameras in swimming pool changing rooms of a Trentino sports operator ItalyVideo surveillance €8,000

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

What organisations can take from it

Changing rooms and comparably intimate areas are off limits for video surveillance – even when theft prevention is the motive.

Authority / court: Garante per la protezione dei dati personali
Area of law: Data protection · Video surveillance
Legal basis: Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Published: 11 Sep 2026

Sources

Newsletter del 11 settembre 2026 – Garante privacy Press release of an authority
Garante – Provvedimento n. 619 del 3 settembre 2026 [10294255] (ASIS Trento) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

25 Aug 2026 Health Service Executive (HSE)Irish health service HSE: 645,000 EUR for neglected paper patient records IrelandData breaches and data security €645,000

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

What organisations can take from it

Data protection also applies to paper archives in disused buildings – retention requires an inventory, erasure periods and physical security.

Relevance to training and awareness

Physical security and retention of paper records

Authority / court: Data Protection Commission (DPC)
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1
Action: Fine
Status of proceedings: final
Sector: Public sector
Employees: 10,000 or more
Published: 2 Sep 2026

Sources

Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) Press release of an authority
EDPB – DPC announces Final Decision following Inquiry into the HSE Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

19 Aug 2026 Poliserv JG (PJG) SRLPhishing on admin account – Poliserv JG must pay 3,000 EUR RomaniaData breaches and data security €2,998

Attackers obtained the credentials of a user account with administrator rights through phishing and accessed customer data. The Romanian data protection authority (ANSPDCP) criticised the lack of technical and organisational measures and of regular effectiveness testing, imposed 15,728 lei (3,000 EUR) and ordered regular employee training, including on recognising phishing e-mails. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

What organisations can take from it

Admin accounts need MFA, and all employees must be able to recognise phishing – the supervisory authority now expressly orders training.

Relevance to training and awareness

Phishing recognition, protection of privileged accounts

Missing or inadequate training played a role in the decision.

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Other
Published: 19 Aug 2026

Original amount 15,728 RON, converted at the ECB reference rate of 19 Aug 2026.

Sources

ANSPDCP – Comunicat de presă 19.08.2026 (Poliserv JG (PJG) SRL) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

6 Aug 2026 AMATO BESTSELLER S.R.L.AMATO BESTSELLER: 45,000 EUR plus 50,000 lei for data access and robocalls RomaniaMarketing and consent €54,316

Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.

What organisations can take from it

Anyone giving employees access to sensitive customer data must train them and limit access on a need-to-know basis.

Relevance to training and awareness

Training employees in handling customer data; consent for advertising calls

Missing or inadequate training played a role in the decision.

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection · Marketing and consent
Legal basis: Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004
Action: Fine
Status of proceedings: unknown
Sector: Other
Published: 6 Aug 2026

Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.

Sources

ANSPDCP – Comunicat de presă 06.08.2026 (AMATO BESTSELLER S.R.L.) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

27 Jul 2026 Metropolitan Police ServiceICO: order and reprimand against London's Met Police after disclosure of sensitive data United KingdomData breaches and data security Order

The Metropolitan Police handed a defendant unredacted documents containing the new address and telephone number of a stalking victim, and in a circular e-mail disclosed 18 people with a parliamentary connection in an open recipient list. The UK Information Commissioner's Office (ICO) ordered improvements within 3 and 12 months, including in data protection training completion rates.

What organisations can take from it

Policies are not enough if mandatory training goes uncompleted for years – monitor and enforce training completion rates.

Relevance to training and awareness

Redacting documents, e-mail distribution lists (BCC), data protection training

Missing or inadequate training played a role in the decision.

Authority / court: Information Commissioner's Office (ICO)
Area of law: Data protection · Data breaches and data security
Legal basis: Data Protection Act 2018, Section 40
Action: Order
Status of proceedings: unknown
Sector: Public sector
Employees: 10,000 or more
Culpability: negligent
Published: 5 Aug 2026

Sources

Metropolitan Police Service issued with enforcement notice and reprimand following data protection failures Press release of an authority
ICO Enforcement notice: Metropolitan Police Service Enforcement database of an authority
ICO Reprimand: Metropolitan Police Service Enforcement database of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

21 Jul 2026 Hôpital Privé de la LoireHôpital Privé de la Loire: 500,000 EUR after data exfiltration affecting over 520,000 patients FranceData breaches and data security €500,000

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

What organisations can take from it

External access to patient records belongs behind multi-factor authentication and continuous monitoring for unusual access.

Relevance to training and awareness

Access security and attack detection in hospitals

Authority / court: Commission nationale de l'informatique et des libertés (CNIL)
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO Art. 32, Art. 34
Action: Fine
Status of proceedings: final
Sector: Healthcare
Published: 3 Sep 2026

Sources

Sanction : amende de 500 000 euros à l'encontre de l'Hôpital Privé de la Loire Press release of an authority
Délibération SAN-2026-009 du 21 juillet 2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

17 Jul 2026 Orange România SAOrange România pays 100,000 EUR after app errors and hacked ticketing system RomaniaData breaches and data security €99,969

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

What organisations can take from it

Never expose internal platforms to the internet without VPN/MFA; software changes to linked systems need testing before go-live.

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Published: 17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Sources

ANSPDCP – Comunicat de presă 17.07.2026 (Orange România SA) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

7 Jul 2026 Γενικό Νοσοκομείο Θεσσαλονίκης Γ. Γεννηματάς «Ο Άγιος Δημήτριος» (Allgemeines Krankenhaus Thessaloniki G. Gennimatas – Agios Dimitrios)Thessaloniki hospital: 25,000 EUR because surgery lists with diagnoses were online GreeceData breaches and data security €25,000

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

What organisations can take from it

Every publication on the website needs an approval step that reliably intercepts documents containing health data – and after a data breach, data subjects must be informed.

Relevance to training and awareness

Publication of documents containing health data

Authority / court: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)
Action: Fine
Status of proceedings: final
Sector: Healthcare

Sources

Επιβολή προστίμου σε νοσοκομείο (Απόφαση 13/2026) Decision of an authority
Απόφαση 13/2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

7 Jul 2026 Unternehmen mit drei Dienstfahrzeugen (in der Mitteilung nicht namentlich genannt)Administrative Court upholds ban on continuous GPS tracking of three company vehicles SloveniaEmployee data Order

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

What organisations can take from it

Employee consent rarely supports monitoring – and never when it is bundled with other declarations in the form.

Relevance to training and awareness

Consent and proportionality in employee monitoring

Authority / court: Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)
Area of law: Data protection · Employee data
Legal basis: Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO
Action: Order
Status of proceedings: unknown
Sector: Transport, logistics and shipping
Published: 7 Jul 2026

Sources

Upravno sodišče znova potrdilo prakso IP: sistematično GPS sledenje zaposlenim ni dopustno brez tehtnega razloga Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

2 Jul 2026 Banca Transilvania S.A.Employee retrieves account statements for a third party – Banca Transilvania pays 5,000 EUR RomaniaData breaches and data security €5,002

At the request of a third party and outside the scope of his duties, a bank employee retrieved account statements of a data subject (name, IBAN, transactions, balances). The Romanian data protection authority (ANSPDCP) found insufficient technical and organisational measures and imposed 26,172 lei (5,000 EUR); the bank has paid the fine. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

What organisations can take from it

Access logs and clear rules against ‘favour queries’ are a duty for every bank.

Relevance to training and awareness

Access to customer data for business purposes only; handling requests from third parties

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 32 Abs. 1, 2 und 4 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Published: 2 Jul 2026

Original amount 26,172 RON, converted at the ECB reference rate of 2 Jul 2026.

Sources

ANSPDCP – Comunicat de presă 02.07.2026 (Banca Transilvania S.A.) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

2 Jul 2026 SIA 4YOU MEBELESFurniture retailer 4YOU MEBELES ignores cookie inspection – first a reprimand, then 1,000 EUR LatviaCookies and tracking €1,000

In a targeted inspection of cookies on company websites, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) found fault with the site 4mebeles.lv. After a reprimand in February 2026, the company claimed that the deficiencies had been remedied, which a further inspection disproved; further requests for information went unanswered. The DVI imposed 1,000 EUR for failure to cooperate and requested the missing information by 3 August 2026.

What organisations can take from it

Assurances given to the supervisory authority are checked – false statements and silence aggravate the sanction.

Relevance to training and awareness

Cookie banners and cooperation with the supervisory authority

Authority / court: Datu valsts inspekcija (DVI)
Area of law: Data protection · Cookies and tracking
Legal basis: Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Retail and e-commerce
Culpability: intentional
Repeat case: yes

Sources

DVI Lēmums Par soda piemērošanu (SIA 4YOU MEBELES), 02.07.2026 Decision of an authority
Datu valsts inspekcija – Lēmumi (Liste der veröffentlichten Entscheidungen) Official register or notice

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

24 Jun 2026 Ö Aktiengesellschaft (in der Entscheidung abgekürzt; Adressverlag und Direktwerbeunternehmen)VwGH sets data protection fine for party affinities definitively at 13 million EUR AustriaMarketing and consent €13m

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

What organisations can take from it

Calculated characteristics such as political leanings are themselves special categories – companies that derive them for advertising need explicit consent.

Authority / court: Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)
Area of law: Data protection · Marketing and consent
Legal basis: DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)
Action: Fine
Status of proceedings: reduced
Sector: Other
Culpability: negligent
Mitigating circumstances: Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).
Published: 16 Jul 2026

Sources

VwGH 24.06.2026, Ro 2025/04/0007 Court decision
VwGH bestätigt unrechtmäßige Verarbeitung von Partei-Affinitäten und setzt Geldbuße mit EUR 13 Mio. fest Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

22 Jun 2026 Inkasso-Team AGFederal Administrative Court upholds FDPIC: Inkasso-Team was not allowed to publish debtor data SwitzerlandData subject rights and transparency Order

The debt collection company posted personal data of alleged debtors on the internet, some of it particularly sensitive, in order to obtain information on their whereabouts and to warn third parties. The Swiss Federal Administrative Court (Bundesverwaltungsgericht, A-3891/2025) upheld the ruling of the Federal Data Protection and Information Commissioner (EDÖB) of 28 April 2025, according to which this constitutes an unjustified violation of privacy.

What organisations can take from it

Publicly naming and shaming debtors cannot be justified under data protection law – debt collection must use less intrusive means.

Authority / court: Bundesverwaltungsgericht (A-3891/2025) auf Verfügung des EDÖB vom 28.04.2025
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSG Art. 6, Art. 19, Art. 31
Action: Order
Status of proceedings: final
Sector: Financial services and insurance
Published: 20 Aug 2026

Sources

Bundesverwaltungsgericht bestätigt Entscheid des EDÖB Press release of an authority
Urteil des Bundesverwaltungsgerichts A-3891/2025 vom 22. Juni 2026 Court decision

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

16 Jun 2026 Securitas Sverige AktiebolagSecuritas Sverige: reprimand over cameras in company vehicles without legal basis SwedenVideo surveillance Reprimand or warning

The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.

What organisations can take from it

Dashcams in company cars also need a verified legal basis and a balancing against the interests of employees and passers-by.

Relevance to training and awareness

Use of cameras in vehicles

Authority / court: Integritetsskyddsmyndigheten (IMY)
Area of law: Data protection · Video surveillance
Legal basis: DSGVO Art. 6 Abs. 1
Action: Reprimand or warning
Status of proceedings: final
Sector: Defence and security

Sources

IMY – Tillsyn Securitas Sverige Aktiebolag Decision of an authority
IMY – Beslut Securitas Sverige AB Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

15 Jun 2026 SSG SELECT SOLUTIONS S.R.L.Stranger in Kaufland CCTV room – service provider SSG Select Solutions pays 2,000 EUR RomaniaVideo surveillance €1,948

An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.

What organisations can take from it

Anyone with access to surveillance rooms must know: video footage is confidential, and third parties have no access there.

Relevance to training and awareness

Access to surveillance rooms; staff bound by instructions

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection · Video surveillance
Legal basis: Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Other
Published: 15 Jun 2026

Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.

Sources

ANSPDCP – Comunicat de presă 15.06.2026 (SSG SELECT SOLUTIONS S.R.L.) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

12 Jun 2026 Verkkokauppa.com OyjKHO confirms fine against Verkkokauppa.com over customer accounts without time limit FinlandData subject rights and transparency €792,639

The online retailer had not set a retention period for customer accounts and kept data until customers requested deletion; purchases were only possible with an account. The sanctions board of the Finnish Data Protection Ombudsman imposed 856,000 EUR in 2024, the administrative court reduced the fine to 792,639 EUR on the basis of current turnover, and the Supreme Administrative Court (Korkein hallinto-oikeus, KHO) confirmed this on 12 June 2026.

What organisations can take from it

Do not leave deletion to the customer – every online shop needs defined retention periods for accounts and order data.

Authority / court: Korkein hallinto-oikeus (KHO); Sanktionsgremium des Datenschutzbeauftragten
Area of law: Data protection · Data subject rights and transparency
Legal basis: Art. 5 Abs. 1 lit. e DSGVO
Action: Fine
Status of proceedings: reduced
Sector: Retail and e-commerce
Published: 18 Jun 2026

Sources

Supreme Administrative Court upholds the administrative fine imposed on Verkkokauppa.com Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

12 Jun 2026 Μάρκετ Ιν ΑΕΒΕ (Market In)Greece: 95,000 EUR against supermarket chain Market In over video footage GreeceVideo surveillance €95,000

A data subject complained about the disclosure of footage from the supermarket chain’s video surveillance and about the inadequate response to his access request. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that Market In had passed the video footage to the judicial authorities without informing the data subject beforehand, processed more data than necessary, failed to comply with the right of access and failed to cooperate with the authority, and by Decision 10/2026 imposed a total of 95,000 EUR (50,000 EUR for lawfulness/transparency, 20,000 EUR each for data minimisation and the right of access, 5,000 EUR for failure to cooperate); in the same proceedings, ΜΕΔΕ ΑΕ received 65,000 EUR.

What organisations can take from it

Release video footage only for a specific purpose – and anyone ignoring requests from the supervisory authority pays extra.

Relevance to training and awareness

Handling video footage and access requests

Authority / court: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
Area of law: Data protection · Video surveillance
Legal basis: Art. 5 Abs. 1 lit. a, c, Art. 5 Abs. 2, Art. 12, 13, 15, 31 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Retail and e-commerce

Sources

Απόφαση 10/2026 της Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

9 Jun 2026 Deutsche Wohnen SELG Berlin I confirms GDPR infringement by Deutsche Wohnen through tenant archive without deletion function GermanyData breaches and data security Fine

In 2019, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) had imposed 14.5 million EUR on the housing group because tenant data such as salary statements, bank statements and social security data were held in an archive system with no means of deletion. Following the 2023 CJEU judgment on direct corporate liability, the Berlin Regional Court (Landgericht Berlin I) confirmed on 9 June 2026 infringements of data minimisation and storage limitation; the press release does not state the amount of the fine set by the court.

What organisations can take from it

Ensure that archive and filing systems can technically implement deletion periods from the outset – ‘privacy by design’ is subject to fines.

Authority / court: Landgericht Berlin I (Bußgeldbehörde: Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 5, Art. 25 Abs. 1 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Construction and real estate
Liability of senior managers: According to the CJEU (C-807/21), a breach of duty by a person in a management position need not be proven for the corporate fine.
Published: 10 Jun 2026

Sources

Landgericht Berlin bestätigt Verstoß der Deutsche Wohnen SE gegen die DSGVO Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

5 Jun 2026 Εταιρεία Προμήθειας Αερίου Θεσσαλονίκης Θεσσαλίας Α.Ε. („ZeniΘ“) und Τράπεζα Πειραιώς Α.Ε. (Piraeus Bank)Greece: 110,000 EUR against energy supplier ZENITH and Piraeus Bank (right of access) GreeceData subject rights and transparency €110,000

Due to errors by a processor of the energy supplier, incorrect details of a direct debit mandate were recorded, so that three bills instead of one were debited from the customer's account; call recordings and the mandate form had not been retained. ZENITH responded inadequately to the access request and did not correct the data (100,000 EUR), while Piraeus Bank infringed the right of access (10,000 EUR and a reprimand); Decision No. 8/2026 of the Hellenic Data Protection Authority.

What organisations can take from it

Answer access requests in full and retain records of mandates – this also applies to data recorded by a service provider.

Authority / court: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)
Area of law: Data protection · Data subject rights and transparency
Legal basis: Art. 5 Abs. 1 lit. d, Art. 12 Abs. 3, Art. 15, Art. 28 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Energy and utilities

Sources

Επιβολή προστίμου σε πάροχο ηλεκτρικής ενέργειας και σε τράπεζα για παραβάσεις του ΓΚΠΔ (Απόφαση 8/2026) Decision of an authority
Αρχή Προστασίας Δεδομένων – Απόφαση 8/2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

5 Jun 2026 Illuminate Education Inc.FTC: final order against education software provider Illuminate after data leak affecting 10.1 million students USAData breaches and data security Order

According to the complaint by the US Federal Trade Commission (FTC), Illuminate promised schools data security but did not adequately protect its cloud databases, even though a service provider had pointed out vulnerabilities almost two years earlier; a hacker accessed data on 10.1 million students, including health information. The order requires an information security programme, data minimisation and a public deletion schedule, and prohibits misrepresentations about security and notification deadlines.

What organisations can take from it

Do not leave known vulnerabilities unaddressed for years – security promises to customers are measured as binding commitments.

Authority / court: Federal Trade Commission (FTC)
Area of law: Data protection · Data breaches and data security
Legal basis: FTC Act (Verbot unlauterer und irreführender Praktiken)
Action: Order
Status of proceedings: final
Sector: Telecoms, IT and software
Culpability: negligent
Published: 5 Jun 2026

Sources

FTC Gives Final Approval to Order Against Illuminate Settling Allegations It Failed to Secure Students' Personal Data Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

26 May 2026 Mediaworks Hungary Zrt.Mediaworks Hungary: 50 million HUF for links to leaked map of party supporters HungaryData protection €140,706

On 7 November 2025, the publisher's news portals Origo and Magyar Nemzet linked to a map, created by unknown persons, containing the names, addresses, telephone numbers, email addresses, geo-coordinates and political preferences of Tisza sympathisers; Ripost showed an image with the name of the map. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found intentional infringements of Art. 6 and 9 GDPR, prohibited further dissemination and imposed 50 million HUF.

What organisations can take from it

Linking to leaked data is itself a separate processing operation – editorial teams need a data protection review before publication.

Relevance to training and awareness

Handling leaked personal data in newsrooms

Authority / court: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Area of law: Data protection
Legal basis: DSGVO Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 58 Abs. 2 lit. b und f (NAIH/962-10/2026)
Action: Fine
Status of proceedings: final
Sector: Media and online platforms
Culpability: intentional
Published: 26 May 2026

Original amount 50,000,000 HUF, converted at the ECB reference rate of 26 May 2026.

Sources

NAIH/962-10/2026 – Határozat (Mediaworks Hungary Zrt.) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

14 May 2026 Wind Tre S.p.A.Garante: 1.7 million EUR against Wind Tre after data exfiltration via deceived shop staff ItalyData breaches and data security €1.72m

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

What organisations can take from it

Staff in branches and partner shops must verify alleged support calls before granting access.

Relevance to training and awareness

Social engineering / fake IT support

Authority / court: Garante per la protezione dei dati personali
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO (Integrität und Vertraulichkeit, Art. 32)
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Published: 16 Jul 2026

Sources

Newsletter del 16 luglio 2026 – Data breach, il Garante privacy sanziona Wind Tre per 1,7 milioni di euro Press release of an authority
Garante – Provvedimento del 14 maggio 2026 [10263796] (Wind Tre) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

12 May 2026 Société Wallonne des Eaux (SWDE)SWDE: 86,000 EUR for call recordings without sufficient transparency BelgiumData subject rights and transparency €86,000

The Walloon water utility recorded and listened in on customer calls for quality control and training purposes; the Litigation Chamber of the Autorité de protection des données (Belgian Data Protection Authority, APD/GBA) found infringements of transparency and fairness as well as in the engagement of a sub-processor. It imposed two fines totalling 86,000 EUR (85,000 + 1,000) after reducing the amounts in view of the situation of the public utility; an appeal against the decision has been lodged with the Market Court.

What organisations can take from it

Anyone recording customer calls must clearly communicate purpose, legal basis and the parties involved in advance and engage service providers under proper contracts.

Relevance to training and awareness

Recording of customer calls

Authority / court: Autorité de protection des données (APD/GBA) – Chambre Contentieuse
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13, Art. 28 Abs. 3
Action: Fine
Status of proceedings: under appeal
Sector: Energy and utilities

Sources

APD – Décision quant au fond n° 102/2026 du 12 mai 2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

8 May 2026 Permanent TSB plcDPC: 277,500 EUR against Permanent TSB after account takeovers via call centre calls IrelandData breaches and data security €277,500

Fraudsters in possession of customer data posed as customers at the bank's ‘Open24’ call centre, had account details changed and obtained further information because security protocols were not followed; those affected had to close accounts, and some suffered losses. Ireland's Data Protection Commission (DPC) imposed 250,000 EUR for inadequate security and 27,500 EUR for late breach notification (decision served in the week before the press release).

What organisations can take from it

Call centre staff must adhere to identity checks without exception – callers with ‘matching’ data are not automatically authorised.

Relevance to training and awareness

Identity verification by telephone (vishing)

Authority / court: Data Protection Commission (DPC)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Published: 8 May 2026

Sources

Data Protection Commission Publishes Final Decision Following Inquiry into Permanent TSB Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

7 May 2026 South Staffordshire Plc und South Staffordshire Water PlcICO: almost £1 million against water supplier South Staffordshire after cyber attack United KingdomData breaches and data security €1.12m

In 2020, malware entered the water supplier's network via a phishing e-mail and remained undetected for around 20 months; in 2022, attackers obtained administrator rights and stole data on 633,887 people, which ended up on the dark web. The UK Information Commissioner's Office (ICO) criticised, among other things, monitoring of only 5% of the IT environment, outdated software such as Windows Server 2003 and a lack of vulnerability and patch management.

What organisations can take from it

Utilities in critical infrastructure must also monitor their entire IT estate and replace legacy systems – an attack must not only come to light through performance problems.

Relevance to training and awareness

Recognising phishing

Authority / court: Information Commissioner's Office (ICO)
Area of law: Data protection · Data breaches and data security
Legal basis: UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1
Action: Fine
Status of proceedings: final
Sector: Energy and utilities
Culpability: negligent
Mitigating circumstances: 40% reduction for early admission of liability; payment agreed without appeal.
Published: 11 May 2026

Original amount 963,900 GBP, converted at the ECB reference rate of 7 May 2026.

Sources

Fine of nearly £1m issued against South Staffordshire Plc and South Staffordshire Water Plc following major cyber attack and data breach Press release of an authority
ICO Enforcement: South Staffordshire Plc and South Staffordshire Water Plc Enforcement database of an authority
ICO Monetary Penalty Notice: South Staffordshire Plc and South Staffordshire Water Plc Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

7 May 2026 Canada Revenue Agency (CRA)Privacy Commissioner: Canada's tax authority CRA must strengthen protection against account takeovers CanadaData breaches and data security Other

Since 2020, the Canada Revenue Agency (CRA) has experienced more than 42,000 individual breaches in which unauthorised persons accessed tax accounts or changed data in order to redirect benefits. In a special report to Parliament, the Privacy Commissioner of Canada criticised, among other things, the delayed introduction of mandatory MFA and incomplete incident recording, and made nine recommendations, eight of which were accepted in full and one in part.

What organisations can take from it

Online accounts with payment functions need mandatory strong authentication and complete recording of incidents.

Authority / court: Office of the Privacy Commissioner of Canada (OPC)
Area of law: Data protection · Data breaches and data security
Legal basis: Privacy Act (Kanada)
Action: Other
Status of proceedings: unknown
Sector: Public sector
Employees: 10,000 or more
Published: 7 May 2026

Sources

Privacy Commissioner of Canada investigation into breaches leads to Canada Revenue Agency commitment to improve security measures Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

4 May 2026 Malta: insurer reprimanded again and fined – marketing calls despite objection MaltaMarketing and consent €1,000

Although the Information and Data Protection Commissioner (IDPC) had already ruled in favour of a complainant, an insurance company (name redacted) again had him called for marketing purposes via a third-party company; his number remained on call lists. The IDPC criticised the lack of safeguards and inadequate contracts with processors, ordered remedial action within 20 days and imposed two fines totalling 1,000 EUR.

What organisations can take from it

An objection to marketing must also reach all call centres engaged – otherwise the next complaint follows.

Relevance to training and awareness

Passing marketing objections on to service providers (suppression lists)

Authority / court: Information and Data Protection Commissioner (IDPC)
Area of law: Data protection · Marketing and consent
Legal basis: Art. 5 Abs. 2, Art. 21 Abs. 2, Art. 24 Abs. 1, Art. 28 Abs. 3 i. V. m. Art. 58 Abs. 2 lit. b, d, i DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Financial services and insurance
Repeat case: yes

Sources

IDPC Commissioner's Decision (4. Mai 2026) Decision of an authority
Data Protection Decisions – IDPC Enforcement database of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

4 May 2026 Berliner Verkehrsbetriebe (BVG) AöRBlnBDI reprimands BVG: deletion at service provider not checked, data breach reported too late GermanyData processors Reprimand or warning

A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.

What organisations can take from it

Have service providers prove deletion after the end of the contract, and have an internal procedure that immediately turns indications of a breach into a 72-hour notification.

Relevance to training and awareness

Reporting process for data breaches and management of service providers

Authority / court: Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Area of law: Data protection · Data processors
Legal basis: Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO
Action: Reprimand or warning
Status of proceedings: unknown
Sector: Transport, logistics and shipping
Mitigating circumstances: BVG has announced measures against similar incidents.
Published: 4 May 2026

Sources

Datenschutzbeauftragte verwarnt BVG Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

17 Apr 2026 Cream della Cream Switzerland GmbH und Philipp Plein International AGFDPIC ruling: Philipp Plein and Cream della Cream ignored objections to advertising SwitzerlandMarketing and consent Order

Both companies continued to use e-mail addresses and telephone numbers from online purchases for advertising, although data subjects had objected – in some cases after deletion had been confirmed. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) ordered the processing for advertising to cease and the data to be deleted on request.

What organisations can take from it

An objection to advertising must take effect across all systems – a confirmed deletion followed by further advertising violates the principle of good faith.

Relevance to training and awareness

Handling objections to advertising and deletion requests

Authority / court: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law: Data protection · Marketing and consent
Legal basis: DSG Art. 6, Art. 30 Abs. 2 lit. b, Art. 31
Action: Order
Status of proceedings: final
Sector: Retail and e-commerce
Published: 26 Jun 2026

Sources

Verfügung des EDÖB gegen Cream della Cream Switzerland GmbH und Philipp Plein International AG Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

16 Apr 2026 Fullgevity OÜ (vormals OÜ Dr Mõttus Hambaravi)Fullgevity (dental clinic) must reorganise data processing in Invisalign treatment EstoniaData processors Order

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

What organisations can take from it

Anyone passing patient data on to manufacturers or platforms must clarify roles, contracts and consents properly in advance – and respond to supervisory requests on time.

Relevance to training and awareness

Consent and transparency for health data; cooperation with the supervisory authority

Authority / court: Andmekaitse Inspektsioon (AKI)
Area of law: Data protection · Data processors
Legal basis: § 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO
Action: Order
Status of proceedings: unknown
Sector: Healthcare

Sources

Ettekirjutus-hoiatus isikuandmete kaitse asjas nr 2.1-1/24/397-890-38 (Fullgevity OÜ), 16.04.2026 Decision of an authority
Andmekaitse Inspektsioon – veröffentlichte Ettekirjutused (Liste) Official register or notice

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

15 Apr 2026 Öffentliches Kommunalunternehmen (in der Mitteilung nicht namentlich genannt)Municipal company: 6,000 EUR for permanent GPS tracking of company vehicles SloveniaEmployee data €6,000

A provider of public utility services used GPS transmitters in company vehicles to record employees’ location data permanently and without cause, without defining a purpose, carrying out a balancing of interests or providing sufficient information. The Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP) imposed 6,000 EUR on the company and 600 EUR on the responsible person.

What organisations can take from it

GPS data are not suitable for performance monitoring – consider less intrusive means before introduction and inform employees in advance.

Relevance to training and awareness

GPS tracking and employee data protection

Authority / court: Informacijski pooblaščenec Republike Slovenije (IP)
Area of law: Data protection · Employee data
Legal basis: Art. 5 und Art. 6 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Energy and utilities
Liability of senior managers: Additional fine of 600 EUR on the responsible person.
Published: 15 Apr 2026

Sources

Nezakonito GPS sledenje zaposlenim: Informacijski pooblaščenec javnemu komunalnemu podjetju izrekel globo v višini 6.000 eur Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

14 Apr 2026 Gyldendal A/SGyldendal: fine for storing data of 685,000 former book club members for years DenmarkData protection Fine

The publisher kept data of around 685,000 former book club members in a ‘passive database’, in around 395,000 cases more than ten years after they had left, without any deletion rules. The Danish Data Protection Agency (Datatilsynet) had recommended a fine of 1 million DKK in 2022; the case was closed on 14 April 2026 with a fine notice whose amount is not stated in the source.

What organisations can take from it

‘Passive’ legacy data also needs a deletion concept – storage without a purpose is a separate infringement.

Authority / court: Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet
Area of law: Data protection
Legal basis: DSGVO Art. 5 Abs. 1 lit. e, Art. 5 Abs. 2
Action: Fine
Status of proceedings: final
Sector: Media and online platforms
Mitigating circumstances: Cooperative conduct; only two employees had access to the passive database; deletion after the supervisory visit.

Sources

Datatilsynet – Gyldendal indstilles til bøde (Opdatering: afgjort 14. april 2026) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

9 Apr 2026 Arbeitgeber (in der Mitteilung nicht namentlich genannt)Slovenia: 71,474 EUR for covert monitoring of employees using spyware SloveniaEmployee data €71,474

An employer installed the software Spyrix Employee Monitoring on the work computers of individual employees, which for months recorded screen content, audio and even private e-mails and conversations without informing the employees. The supervisory authority, the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP), imposed 71,474 EUR on the company and 4,000 EUR on the responsible person.

What organisations can take from it

Covert employee monitoring by software is practically never permissible – IT and managers must know this before tools are installed.

Relevance to training and awareness

Permissible monitoring of employees and IT use

Authority / court: Informacijski pooblaščenec Republike Slovenije (IP)
Area of law: Data protection · Employee data
Legal basis: Art. 5 und Art. 6 Abs. 1 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Other
Culpability: intentional
Liability of senior managers: Additional fine of 4,000 EUR on the responsible person.
Published: 9 Apr 2026

Sources

Delodajalcu, ki je prikrito nadzoroval vse aktivnosti zaposlenih na računalnikih, izrečena globa več kot 70.000 EUR Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

1 Apr 2026 MLU B.V. (Rechtsnachfolgerin der Ridetech International B.V., Anbieterin der Yango-App)Yango taxi app: 100 million EUR for transferring data to Russia NetherlandsInternational data transfers €100m

Amsterdam-based Ridetech offered the ride-hailing app Yango in Finland and Norway and transferred data of drivers and customers to the group companies Yandex.Taxi LLC and Yandex LLC in Russia without demonstrating appropriate safeguards. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 100 million EUR on the legal successor and prohibited further transfers to Russia.

What organisations can take from it

Transfers to states without legal protection against access by authorities can hardly be safeguarded – group structures with such locations need data localisation in the EU.

Authority / court: Autoriteit Persoonsgegevens (AP)
Area of law: Data protection · International data transfers
Legal basis: Art. 44, Art. 46 iVm Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Transport, logistics and shipping

Sources

AP, Besluit tot het opleggen van een bestuurlijke boete (MLU B.V./Ridetech) vom 01.04.2026, Kenmerk 2025-005323 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

25 Mar 2026 RENAULT COMMERCIAL ROUMANIE S.R.L.Cyber attack via service provider – Renault Commercial Roumanie pays 125,000 EUR RomaniaData processors €125,083

In an attack on an application operated by a processor, data of a very large number of persons (including personal identification numbers, driving licence and identity card numbers, vehicle identification numbers) were stolen and published. The Romanian data protection authority (ANSPDCP) criticised the lack of security measures and effectiveness testing as well as the selection of a service provider without sufficient guarantees and imposed 637,262.50 lei (125,000 EUR).

What organisations can take from it

Responsibility for customer data does not end with the service provider – check its security guarantees in advance and monitor them continuously.

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection · Data processors
Legal basis: Art. 32 Abs. 1 lit. b und d, Abs. 2 i. V. m. Art. 28 Abs. 1 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Automotive
Published: 25 Mar 2026

Original amount 637,262.5 RON, converted at the ECB reference rate of 25 Mar 2026.

Sources

ANSPDCP – Comunicat de presă 25.03.2026 (RENAULT COMMERCIAL ROUMANIE S.R.L.) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

24 Mar 2026 SIA "Fitsypro"Fitsypro fails to answer access request and DVI enquiries – 1,500 EUR LatviaData subject rights and transparency €1,500

A person complained that Fitsypro had not responded to their request for access, rectification and erasure of November 2023. Three requests for information from the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) between 2024 and 2026 went unanswered, and nobody attended the hearing. The DVI imposed 1,500 EUR and requested the information by 21 April 2026.

What organisations can take from it

Official mailboxes (eAdrese) and data protection e-mail addresses must be monitored – silence towards the supervisory authority costs money.

Relevance to training and awareness

Handling data subject requests and correspondence from authorities

Authority / court: Datu valsts inspekcija (DVI)
Area of law: Data protection · Data subject rights and transparency
Legal basis: Art. 58 Abs. 1 lit. e, Art. 83 Abs. 5 lit. e DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Other
Culpability: intentional

Sources

DVI Lēmums Par soda piemērošanu (SIA „Fitsypro“), 24.03.2026 Decision of an authority
Datu valsts inspekcija – Lēmumi (Liste der veröffentlichten Entscheidungen) Official register or notice

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

20 Mar 2026 Gesundheitsdienstleister (in der Entscheidung anonymisiert)Hungarian GP practice: 500,000 HUF for 47 EESZT queries without legal basis HungaryData subject rights and transparency €1,274

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

What organisations can take from it

Every access to electronic health records is logged and must be linked to treatment – even if it is triggered by practice staff.

Relevance to training and awareness

Access to health data and access requests

Authority / court: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1 (NAIH-273-7/2026)
Action: Fine
Status of proceedings: final
Sector: Healthcare
Published: 20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Sources

NAIH-273-7/2026 – Jogalap nélküli hozzáférés az EESZT rendszeréhez Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

12 Mar 2026 Amazon Europe Core S.à r.l.Luxembourg: Cour administrative annuls 746 million EUR fine against Amazon but confirms infringements LuxembourgMarketing and consent overturned

In 2021, the Luxembourg data protection authority (CNPD) had imposed 746 million EUR and an order to bring processing into compliance on account of behavioural online advertising; the Administrative Tribunal (Tribunal administratif) confirmed this on 18 March 2025. On 12 March 2026, the Administrative Court (Cour administrative) confirmed that legitimate interest was not a sound legal basis and that the information was insufficient, but annulled the fine on the basis of more recent CJEU case law on the requirement of culpability; the CNPD is re-examining the sanction.

What organisations can take from it

Personalised advertising cannot be based on legitimate interest – and courts now scrutinise culpability closely when it comes to fines.

Authority / court: Cour administrative (Luxemburg); Verfahren der CNPD
Area of law: Data protection · Marketing and consent
Legal basis: Art. 6 Abs. 1 lit. f, Art. 12 ff. DSGVO
Action: Order
Status of proceedings: overturned
Sector: Retail and e-commerce
Employees: 10,000 or more
Mitigating circumstances: Amazon had implemented the compliance order before the hearing.

Sources

La CNPD obtient la mise en conformité effective des traitements d'Amazon (Arrêt de la Cour administrative du 12 mars 2026) Press release of an authority
Décision concernant Amazon Europe Core S.À R.L. (Tribunal administratif, 18 mars 2025) Press release of an authority
Justice Luxembourg – Arrêt de la Cour administrative du 12 mars 2026 (n° 52757C du rôle), Amazon/CNPD Court press release
Justice Luxembourg – Jugement du tribunal administratif du 18 mars 2025, Amazon/CNPD Court press release

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

5 Mar 2026 Loblaw Companies LimitedOPC: Loblaw must change retention of PC Optimum data after account deletion CanadaData subject rights and transparency Other

During a wave of boycotts in 2024, Loblaw did not process deletion requests in time and retained purchase and usage data from the loyalty programme (more than 17 million members) even after accounts were closed, without demonstrating effective anonymisation. Loblaw undertook to the Office of the Privacy Commissioner of Canada (OPC) to have the anonymisation independently reviewed and to carry out annual deletions.

What organisations can take from it

Companies that continue to use data as anonymous after account deletion must be able to demonstrate the re-identification risk – IP addresses are often enough to link data to a person.

Authority / court: Office of the Privacy Commissioner of Canada (OPC)
Area of law: Data protection · Data subject rights and transparency
Legal basis: PIPEDA
Action: Other
Status of proceedings: unknown
Sector: Retail and e-commerce
Employees: 10,000 or more
Published: 5 Mar 2026

Sources

PIPEDA Findings #2026-001: Investigation into the personal information retention practices of Loblaw for the PC Optimum Loyalty Program Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

2 Mar 2026 Nordic Cleaning ApSNordic Cleaning: fine for leaving access request unanswered despite an order DenmarkData subject rights and transparency €8,031

Despite repeated follow-ups by the trade union, the cleaning company did not respond to a union member’s access request and also failed to comply with the order of the Danish Data Protection Agency (Datatilsynet) to decide on the request. Datatilsynet reported the company; the case was closed on 2 March 2026 with a fine notice of 60,000 DKK.

What organisations can take from it

Access requests and orders from authorities need a fixed intake channel and a responsible person – ignoring them leads straight to a criminal complaint.

Relevance to training and awareness

Handling access requests (Art. 15 GDPR)

Authority / court: Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSGVO Art. 15; Nichtbefolgung einer Anordnung der Datatilsynet; databeskyttelsesloven
Action: Fine
Status of proceedings: final
Sector: Other

Original amount 60,000 DKK, converted at the ECB reference rate of 2 Mar 2026.

Sources

Datatilsynet – Klein2 ApS og Nordic Cleaning ApS indstilles til bøde (Opdatering: afgjort 2. marts 2026) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

2 Mar 2026 Suomen Numerokeskus OySuomen Numerokeskus: 5,000 EUR – call recordings only played by phone instead of provided as a copy FinlandData subject rights and transparency €5,000

Following six complaints, the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found that the company did not provide a copy to customers who requested recordings of their sales calls in order to dispute invoices, offering only to let them listen via customer service, and in some cases deleted recordings. In addition to a reprimand, a fine of 5,000 EUR was imposed.

What organisations can take from it

Access means a copy: anyone who records calls must be able to provide the recording to data subjects in a suitable form.

Relevance to training and awareness

Right of access to call recordings

Authority / court: Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSGVO Art. 15 Abs. 1 und 3
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Published: 25 Mar 2026

Sources

Finlex – Tietosuojavaltuutettu 2.3.2026 (puhelutallenteet) Decision of an authority
Tietosuojavaltuutettu – Suomen Numerokeskukselle seuraamusmaksu puutteista puhelutallenteiden antamisessa (25.03.2026) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

20 Feb 2026 SC Hayat Dent SRLDental clinic Hayat Dent obstructs investigation of data leak – 2,000 EUR RomaniaData protection €1,999

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

What organisations can take from it

Offboarding processes must block data access immediately – and anyone reporting an incident must also support its investigation.

Relevance to training and awareness

Taking patient data when leaving; cooperation with the supervisory authority

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection
Legal basis: Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Healthcare
Published: 20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Sources

ANSPDCP – Comunicat de presă 20.02.2026 (SC Hayat Dent SRL) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

19 Feb 2026 Restaurant Partner Polska sp. z o.o. (Betreiberin der Plattform Glovo)Glovo Poland: 5.9 million PLN for copies of identity documents without legal basis PolandData subject rights and transparency €1.4m

Since 2019, the delivery platform had required scans or photos of its users’ identity cards and passports in cases of suspected fraud, relying on legitimate interests. The Prezes Urzędu Ochrony Danych Osobowych (President of Poland’s data protection authority, UODO) regarded this as processing without a legal basis and a breach of data minimisation, imposed 5,898,064 PLN and ordered the processing to stop and the data to be erased.

What organisations can take from it

Fraud prevention does not justify copies of identity documents – only those authorised by law may capture documents in full.

Relevance to training and awareness

Copying identity documents and data minimisation

Authority / court: Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law: Data protection · Data subject rights and transparency
Legal basis: Art. 5 Abs. 1 lit. a und c, Art. 5 Abs. 2, Art. 6 Abs. 1 DSGVO (DKN.5112.33.2022)
Action: Fine
Status of proceedings: final
Sector: Media and online platforms
Published: 16 Mar 2026

Original amount 5,898,064 PLN, converted at the ECB reference rate of 19 Feb 2026.

Sources

Nie można kopiować dokumentów bez podstawy prawnej - kara dla Glovo Press release of an authority
Decyzja DKN.5112.33.2022 z 19 lutego 2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

19 Feb 2026 AZOP: 100,000 EUR against estate agent over ID copies and old files CroatiaData subject rights and transparency €100,000

An estate agency (name not published) kept 11,887 brokerage contracts from 2010 to 2019, together with 914 copies of identity cards, passports and bank cards, without a legal basis, although the managing director stated that no card copies were collected. The Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) also criticised irregular and inadequate data protection training for employees and imposed 100,000 EUR (date of publication; exact date of the decision not stated).

What organisations can take from it

Make copies of identity documents and cards only with a legal basis, destroy old files on time and train employees regularly.

Relevance to training and awareness

Data minimisation for ID copies, retention periods

Missing or inadequate training played a role in the decision.

Authority / court: Agencija za zaštitu osobnih podataka (AZOP)
Area of law: Data protection · Data subject rights and transparency
Legal basis: Art. 5 Abs. 1 lit. c und e, Art. 6 Abs. 1, Art. 32 Abs. 4 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Construction and real estate
Culpability: negligent
Mitigating circumstances: No damage to data subjects was found.
Published: 19 Feb 2026

Sources

Agenciji za nekretnine izrečena kazna u iznosu od 100.000,00 eura Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

18 Feb 2026 Fraser Health Authority, Provincial Health Services Authority, Vancouver Coastal HealthBritish Columbia: 36 hospital staff accessed records of Lapu-Lapu Day victims without authorisation Canada, BCData breaches and data security Other

Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.

What organisations can take from it

Curiosity is no reason for access: monitor access to the records of high-profile cases in real time and sanction breaches noticeably.

Relevance to training and awareness

Unauthorised viewing of patient records (snooping)

Authority / court: Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)
Area of law: Data protection · Data breaches and data security
Legal basis: Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1
Action: Other
Status of proceedings: unknown
Sector: Healthcare
Culpability: intentional
Mitigating circumstances: Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.
Published: 18 Feb 2026

Sources

Investigation reveals 71 snooping incidents by 36 healthcare workers following Lapu Lapu Day tragedy Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

11 Feb 2026 Disney DTC, LLC und ABC Enterprises, Inc. (The Walt Disney Company)California: $2.75 million against Disney over incomplete opt-outs for streaming USA, CACookies and tracking €2.31m

Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.

What organisations can take from it

An opt-out must take effect across all services, devices and integrated third-party providers of an account.

Authority / court: Attorney General of California (California Department of Justice)
Area of law: Data protection · Cookies and tracking
Legal basis: California Consumer Privacy Act (CCPA)
Action: Fine
Status of proceedings: final
Sector: Media and online platforms
Employees: 10,000 or more
Published: 11 Feb 2026

Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.

Sources

California Won't Let It Go: Attorney General Bonta Announces $2.75 Million Settlement with Disney Press release of an authority
Final Judgment and Permanent Injunction, People v. Disney DTC, LLC et al., LA Superior Court 26STCV04425 Court decision

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

26 Jan 2026 Sportadmin i Skandinavien ABSportadmin: 6 million SEK after hacker attack on club management system holding children’s data SwedenData breaches and data security €564,626

The provider of management software and an app for sports clubs suffered a data exfiltration by an external attacker in January 2025. The Swedish Authority for Privacy Protection (IMY) found that no appropriate technical and organisational security measures were in place before and at the time of the incident, even though the data processed related predominantly to children and also included health information (allergies, disabilities), and imposed 6 million SEK; in setting the amount it took into account the 2024 group turnover of the Lime group (around 685.7 million SEK).

What organisations can take from it

Software providers that pool sensitive data from many customers must align their security level and attack surfaces with how sensitive the data is (children, health) – not only after an incident.

Authority / court: Integritetsskyddsmyndigheten (IMY)
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO Art. 32 Abs. 1
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Mitigating circumstances: Prompt and comprehensive information of the clubs and data subjects after the incident; support for around 1,700 clubs in filing their notifications within 72 hours.
Published: 26 Jan 2026

Original amount 6,000,000 SEK, converted at the ECB reference rate of 26 Jan 2026.

Sources

IMY – Tillsyn Sportadmin i Skandinavien AB Decision of an authority
IMY – Beslut efter tillsyn, IMY-2025-7801 (26.01.2026) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

22 Jan 2026 France TravailCNIL: 5 million EUR against France Travail after social engineering attack FranceData breaches and data security €5m

In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.

What organisations can take from it

Accounts of external partners with extensive data access need strong authentication, narrow rights and anomaly detection – and their users need training against social engineering.

Relevance to training and awareness

Social engineering and account takeover

Authority / court: Commission nationale de l'informatique et des libertés (CNIL)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 32 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Employees: 10,000 or more
Published: 29 Jan 2026

Sources

Violation de données : sanction de 5 millions d'euros à l'encontre de FRANCE TRAVAIL Press release of an authority
CNIL – Les sanctions prononcées par la CNIL (Eintrag 22/01/2026) Enforcement database of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

19 Jan 2026 D*** GmbH (Digitalmarketing- und Recruitingagentur, anonymisiert)Recruitment agency: 25,500 EUR for secretly recorded calls with applicants AustriaData subject rights and transparency €25,500

The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).

What organisations can take from it

Call recordings in recruitment need a genuine legal basis and clear information about who is actually responsible.

Relevance to training and awareness

Recording of telephone calls and applicant data

Authority / court: Datenschutzbehörde
Area of law: Data protection · Data subject rights and transparency
Legal basis: DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13
Action: Fine
Status of proceedings: under appeal
Sector: Other
Employees: Under 50
Mitigating circumstances: No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.

Sources

Datenschutzbehörde, Straferkenntnis 2025-1.049.138 vom 19.01.2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

19 Jan 2026 Continental Automotive Products SRLExcel list with sick notes circulated internally – Continental Automotive pays 15,000 EUR RomaniaEmployee data €14,997

An Excel file containing data from medical certificates of current and former employees was repeatedly circulated within the company; the company reported the incident itself. The Romanian data protection authority (ANSPDCP) imposed 25,455 lei (5,000 EUR) for breach of data minimisation and accountability and 50,911 lei (10,000 EUR) for insufficient security measures and ordered a monitoring and control procedure. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

What organisations can take from it

Employees’ health data do not belong in freely forwarded Excel lists – HR departments need fixed access limits.

Relevance to training and awareness

Handling employees’ health data, e-mail distribution lists

Authority / court: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Area of law: Data protection · Employee data
Legal basis: Art. 5 Abs. 1 lit. c und Abs. 2, Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Automotive
Published: 19 Jan 2026

Original amount 76,366 RON, converted at the ECB reference rate of 19 Jan 2026.

Sources

ANSPDCP – Comunicat de presă 19.01.2026 (Continental Automotive Products SRL) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

8 Jan 2026 Free Mobile SAS und Free SASCNIL: 42 million EUR against Free Mobile and Free after data leak affecting 24 million contracts FranceData breaches and data security €42m

Following an attack in October 2024 in which data relating to around 24 million customer contracts, including IBANs, was exfiltrated, the French data protection authority (CNIL) imposed 27 million EUR on Free Mobile and 15 million EUR on Free (42 million EUR in total). The authority objected to VPN access without adequate authentication, deficient detection of suspicious access, incomplete notification of data subjects and, at Free Mobile, excessively long retention of old contracts; orders with deadlines were also issued.

What organisations can take from it

Put remote access such as VPN behind multi-factor authentication, and consistently delete legacy data from terminated contracts.

Authority / court: Commission nationale de l'informatique et des libertés (CNIL)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 5 Abs. 1 lit. e, Art. 32, Art. 34 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Telecoms, IT and software
Mitigating circumstances: During the proceedings, the companies introduced multi-factor authentication, a Security Operations Centre and improved logging.
Published: 14 Jan 2026

Sources

Violation de données : sanction de 42 millions d'euros à l'encontre des sociétés FREE MOBILE et FREE Press release of an authority
Délibération SAN-2026-001 du 8 janvier 2026 (FREE MOBILE) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

8 Jan 2026 Αρχηγείο Πυροσβεστικού Σώματος (Hauptquartier der griechischen Feuerwehr)Greece: 10,000 EUR against Fire Service Headquarters over health data in duty log GreeceEmployee data €10,000

In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.

What organisations can take from it

Employees’ health information never belongs in generally accessible official records – the reason for an absence generally does not need to be disclosed.

Relevance to training and awareness

Confidential handling of employees’ health data

Authority / court: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
Area of law: Data protection · Employee data
Legal basis: Art. 5 Abs. 1 lit. a und c DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector

Sources

Απόφαση 1/2026 της Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

2 Jan 2026 Poczta Polska S.A.Poczta Polska: 978,128 PLN because the data protection officer was not independent PolandData protection €232,208

The function of data protection officer was performed by a manager who was at the same time responsible for security and protection of classified information and thus monitored their own activities; there was no conflict analysis. Poland’s data protection authority (UODO) imposed 978,128 PLN and referred to numerous previous reprimands and orders against the company.

What organisations can take from it

Data protection officers must not be responsible for the processes they monitor – check dual roles for conflicts of interest in advance.

Authority / court: Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law: Data protection
Legal basis: Art. 38 Abs. 3 und 6 DSGVO (DKN.5131.4.2025)
Action: Fine
Status of proceedings: unknown
Sector: Transport, logistics and shipping
Employees: 10,000 or more
Repeat case: yes
Mitigating circumstances: During the proceedings the function was made independent and placed directly under the management board.
Published: 26 Jan 2026

Original amount 978,128 PLN, converted at the ECB reference rate of 2 Jan 2026.

Sources

Kara dla Poczty Polskiej za brak zapewnienia niezależności sprawowania funkcji IOD Press release of an authority
Decyzja DKN.5131.4.2025 z 2 stycznia 2026 Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

31 Dec 2025 ONE WAY PRIVATE COMPANYGreece: 80,000 EUR against call centre One Way over marketing calls for gas supplier GreeceMarketing and consent €80,000

Following numerous complaints about marketing calls for the gas supplier ZENITH, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that the call centre engaged had insufficient security measures and called persons without valid consent. By Decision 44/2025, One Way received 40,000 EUR each as processor and as controller, together with an order to delete the data of persons without valid consent; ZENITH and two other service providers were also held liable (10,000, 10,000 and 5,000 EUR).

What organisations can take from it

Anyone outsourcing telemarketing must regularly carry out sample checks on call centres – and call centres are themselves liable for calls made without consent.

Relevance to training and awareness

Checking consent before telemarketing

Authority / court: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
Area of law: Data protection · Marketing and consent
Legal basis: Art. 5, 6, 7, 29, 32 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Other
Repeat case: yes

Sources

Απόφαση 44/2025 της Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

30 Dec 2025 Rickenbacher Data LLC (Datamasters)CPPA: $45,000 against data broker Datamasters over failure to register USA, CAMarketing and consent €38,275

Without registering as a data broker, the Texas reseller traded in the names and contact details of millions of people, sorted by illnesses such as Alzheimer's or addiction, by age, presumed ethnicity and political views. In addition to the fine, the California Privacy Protection Agency (CPPA) requires it to stop selling data on all Californians.

What organisations can take from it

Companies that buy or sell address lists for advertising must check registration obligations – health-related lists are particularly risky.

Authority / court: California Privacy Protection Agency (CPPA)
Area of law: Data protection · Marketing and consent
Legal basis: California Delete Act (Registrierungspflicht für Datenhändler)
Action: Fine
Status of proceedings: final
Sector: Other
Published: 8 Jan 2026

Original amount 45,000 USD, converted at the ECB reference rate of 30 Dec 2025.

Sources

CalPrivacy Data Broker Enforcement Strike Force: enforcement actions Press release of an authority
CPPA Order of Decision: Rickenbacher Data LLC d/b/a Datamasters (ENF25-172-D-DA) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

23 Dec 2025 Amazon France Logistique SASConseil d'État reduces CNIL fine against Amazon France Logistique to 15 million EUR FranceEmployee data €15m

In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.

What organisations can take from it

Store employee performance metrics only for as long and in as much detail as their specific purpose requires.

Authority / court: Conseil d'État
Area of law: Data protection · Employee data
Legal basis: Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO
Action: Fine
Status of proceedings: reduced
Sector: Transport, logistics and shipping
Employees: 10,000 or more

Sources

Conseil d'État, décision n° 492830 du 23 décembre 2025 Court decision

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Period	Cases	Total
Q3 2023	0	—
Q4 2023	3	€5.49m
Q1 2024	4	€82.3m
Q2 2024	4	€13.9m
Q3 2024	9	€386.9m
Q4 2024	18	€261.9m
Q1 2025	12	€4.6m
Q2 2025	16	€580.6m
Q3 2025	16	€480.4m
Q4 2025	22	€1.23bn
Q1 2026	19	€51.8m
Q2 2026	23	€117.4m
Q3 2026	14	€7.03m

Who was sanctioned, and for what?

Where?

What for?

Who?

When?

160 cases

Ready for training that sticks?