Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

DACHData protection Clear all filters
43cases from 3 jurisdictions
€65.2mTotal of monetary amounts (34 cases with an amount)
€45mLargest single case: Vodafone GmbH
€171,500Median per case with an amount

Click a bar to drill down one level.

by amountby number of cases

Where?

by country
  1. Germany €50.6m 78 % · 28 cases
  2. Austria €14.6m 22 % · 10 cases
  3. Switzerland – 0 % · 5 cases

What for?

by topic
  1. Data processors €45m 69 % · 3 cases
  2. Marketing and consent €16m 25 % · 19 cases
  3. Video surveillance €1.52m 2 % · 2 cases
  4. no topic €1.44m 2 % · 4 cases
  5. Data subject rights and transparency €1.03m 2 % · 10 cases
  6. Employee data €215,000 0 % · 1 case
  7. Cookies and tracking €6,200 0 % · 1 case
  8. Data breaches and data security €5,900 0 % · 3 cases

Who?

by sector

All sectors

  1. Telecoms, IT and software €45.1m 69 % · 4 cases
  2. Other €14.6m 22 % · 12 cases
  3. Retail and e-commerce €2.42m 4 % · 5 cases
  4. Financial services and insurance €1.75m 3 % · 8 cases
  5. Energy and utilities €1.15m 2 % · 6 cases
  6. Construction and real estate €65,000 0 % · 3 cases
  7. Food and agriculture €20,000 0 % · 1 case
  8. Media and online platforms €6,200 0 % · 2 cases
  9. Healthcare €5,000 0 % · 1 case
  10. Transport, logistics and shipping – 0 % · 1 case

When?

per year, by date of decision
Trend
PeriodCasesTotal
20225€1m
202310€1.69m
202410€3.16m
202510€46.2m
20268€13.1m

43 cases

Newest firstHighest amounts
24 Jul 2026 Callcenter (anonymisiert)BNetzA: €34,327 fine on call centre, including for incomplete records of consent GermanyMarketing and consent €34,327

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 34,327 EUR on a call centre that mainly marketed telecoms products: 32,000 EUR for unlawful telephone advertising and 2,327 EUR because consents to sales calls had not been fully documented. The campaign continued despite the gaps and requests to stop calling were sometimes ignored; the company has appealed.

What organisations can take from it

Consents to telephone marketing must be fully documented – if the proof is missing, the campaign must not continue.

Relevance to training and awareness

Consent and proof of consent for telephone marketing

Authority / court
Bundesnetzagentur (BNetzA)
Area of law
Data protection · Marketing and consent
Legal basis
UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; § 7a UWG (Dokumentation und Aufbewahrung von Einwilligungen)
Action
Fine
Status of proceedings
under appeal
Sector
Other
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

24 Jun 2026 Ö Aktiengesellschaft (in der Entscheidung abgekürzt; Adressverlag und Direktwerbeunternehmen)VwGH sets data protection fine for party affinities definitively at 13 million EUR AustriaMarketing and consent €13m

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

What organisations can take from it

Calculated characteristics such as political leanings are themselves special categories – companies that derive them for advertising need explicit consent.

Authority / court
Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)
Area of law
Data protection · Marketing and consent
Legal basis
DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)
Action
Fine
Status of proceedings
reduced
Sector
Other
Culpability
negligent
Mitigating circumstances
Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).
Published
16 Jul 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

22 Jun 2026 Inkasso-Team AGFederal Administrative Court upholds FDPIC: Inkasso-Team was not allowed to publish debtor data SwitzerlandData subject rights and transparency Order

The debt collection company posted personal data of alleged debtors on the internet, some of it particularly sensitive, in order to obtain information on their whereabouts and to warn third parties. The Swiss Federal Administrative Court (Bundesverwaltungsgericht, A-3891/2025) upheld the ruling of the Federal Data Protection and Information Commissioner (EDÖB) of 28 April 2025, according to which this constitutes an unjustified violation of privacy.

What organisations can take from it

Publicly naming and shaming debtors cannot be justified under data protection law – debt collection must use less intrusive means.

Authority / court
Bundesverwaltungsgericht (A-3891/2025) auf Verfügung des EDÖB vom 28.04.2025
Area of law
Data protection · Data subject rights and transparency
Legal basis
DSG Art. 6, Art. 19, Art. 31
Action
Order
Status of proceedings
final
Sector
Financial services and insurance
Published
20 Aug 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

9 Jun 2026 Deutsche Wohnen SELG Berlin I confirms GDPR infringement by Deutsche Wohnen through tenant archive without deletion function GermanyData breaches and data security Fine

In 2019, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) had imposed 14.5 million EUR on the housing group because tenant data such as salary statements, bank statements and social security data were held in an archive system with no means of deletion. Following the 2023 CJEU judgment on direct corporate liability, the Berlin Regional Court (Landgericht Berlin I) confirmed on 9 June 2026 infringements of data minimisation and storage limitation; the press release does not state the amount of the fine set by the court.

What organisations can take from it

Ensure that archive and filing systems can technically implement deletion periods from the outset – ‘privacy by design’ is subject to fines.

Authority / court
Landgericht Berlin I (Bußgeldbehörde: Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Area of law
Data protection · Data breaches and data security
Legal basis
Art. 5, Art. 25 Abs. 1 DSGVO
Action
Fine
Status of proceedings
unknown
Sector
Construction and real estate
Liability of senior managers
According to the CJEU (C-807/21), a breach of duty by a person in a management position need not be proven for the corporate fine.
Published
10 Jun 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

4 May 2026 Berliner Verkehrsbetriebe (BVG) AöRBlnBDI reprimands BVG: deletion at service provider not checked, data breach reported too late GermanyData processors Reprimand or warning

A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.

What organisations can take from it

Have service providers prove deletion after the end of the contract, and have an internal procedure that immediately turns indications of a breach into a 72-hour notification.

Relevance to training and awareness

Reporting process for data breaches and management of service providers

Authority / court
Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Area of law
Data protection · Data processors
Legal basis
Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO
Action
Reprimand or warning
Status of proceedings
unknown
Sector
Transport, logistics and shipping
Mitigating circumstances
BVG has announced measures against similar incidents.
Published
4 May 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

17 Apr 2026 Cream della Cream Switzerland GmbH und Philipp Plein International AGFDPIC ruling: Philipp Plein and Cream della Cream ignored objections to advertising SwitzerlandMarketing and consent Order

Both companies continued to use e-mail addresses and telephone numbers from online purchases for advertising, although data subjects had objected – in some cases after deletion had been confirmed. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) ordered the processing for advertising to cease and the data to be deleted on request.

What organisations can take from it

An objection to advertising must take effect across all systems – a confirmed deletion followed by further advertising violates the principle of good faith.

Relevance to training and awareness

Handling objections to advertising and deletion requests

Authority / court
Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law
Data protection · Marketing and consent
Legal basis
DSG Art. 6, Art. 30 Abs. 2 lit. b, Art. 31
Action
Order
Status of proceedings
final
Sector
Retail and e-commerce
Published
26 Jun 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

9 Mar 2026 Werbendes Unternehmen aus dem Sektor Finanz- und Versicherungsprodukte (anonymisiert)BNetzA: €50,000 fine on financial products seller posing as an advice centre on the phone GermanyMarketing and consent €50,000

The Bundesnetzagentur (Federal Network Agency) fined a company marketing financial and insurance products 50,000 EUR for unlawful telephone advertising. The calls were particularly intrusive, callers falsely claimed to be an independent advice centre and presented sales calls as service calls; the company has appealed.

What organisations can take from it

Anyone marketing by phone must not disguise either their own identity or the promotional purpose of the call.

Relevance to training and awareness

Consent and proof of consent for telephone marketing

Authority / court
Bundesnetzagentur (BNetzA)
Area of law
Data protection · Marketing and consent
Legal basis
UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern
Action
Fine
Status of proceedings
under appeal
Sector
Financial services and insurance
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

19 Jan 2026 D*** GmbH (Digitalmarketing- und Recruitingagentur, anonymisiert)Recruitment agency: 25,500 EUR for secretly recorded calls with applicants AustriaData subject rights and transparency €25,500

The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).

What organisations can take from it

Call recordings in recruitment need a genuine legal basis and clear information about who is actually responsible.

Relevance to training and awareness

Recording of telephone calls and applicant data

Authority / court
Datenschutzbehörde
Area of law
Data protection · Data subject rights and transparency
Legal basis
DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13
Action
Fine
Status of proceedings
under appeal
Sector
Other
Employees
Under 50
Mitigating circumstances
No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

18 Dec 2025 Werbendes Unternehmen aus dem Energiesektor (anonymisiert)BNetzA: €210,000 fine on energy company over contracts foisted on consumers by phone GermanyMarketing and consent €210,000

The Bundesnetzagentur (Federal Network Agency) fined an energy company 210,000 EUR for unlawful telephone advertising. Callers often posed as the consumer's energy supplier, and in many cases contracts were foisted on the people called; the company has appealed.

What organisations can take from it

Anyone marketing by phone needs verifiable prior consent and must not pose as the existing supplier of the people called.

Relevance to training and awareness

Consent and proof of consent for telephone marketing

Authority / court
Bundesnetzagentur (BNetzA)
Area of law
Data protection · Marketing and consent
Legal basis
UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern
Action
Fine
Status of proceedings
under appeal
Sector
Energy and utilities
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

18 Dec 2025 Werbendes Unternehmen aus dem Sektor Photovoltaik (anonymisiert)BNetzA: €100,500 fine on solar panel seller over disguised sales calls GermanyMarketing and consent €100,500

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 100,500 EUR on a solar photovoltaic company: 66,000 EUR for unlawful telephone advertising and 34,500 EUR for withholding caller numbers on sales calls. Callers concealed who the calls were really for and in some cases falsely presented sales calls as mere advisory calls.

What organisations can take from it

Even a business that merely commissions sales calls can itself be fined – consent of the people called should be checked before a campaign starts.

Relevance to training and awareness

Consent and proof of consent for telephone marketing

Authority / court
Bundesnetzagentur (BNetzA)
Area of law
Data protection · Marketing and consent
Legal basis
UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; Verbot der Rufnummernunterdrückung bei Werbeanrufen
Action
Fine
Status of proceedings
unknown
Sector
Energy and utilities
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

18 Nov 2025 Callcenter mit Tätigkeitsschwerpunkt im Energiesektor (anonymisiert)BNetzA: €104,400 fine on call centre that posed as the customer's energy supplier GermanyMarketing and consent €104,400

The Bundesnetzagentur (Federal Network Agency) fined a call centre focused on energy marketing 104,400 EUR for unlawful telephone advertising. Callers frequently posed falsely as the local energy provider or as the person's own supplier and tried to disguise the promotional nature of the calls.

What organisations can take from it

Call centres need verifiable consent for every number they dial and must honour requests to stop calling immediately.

Relevance to training and awareness

Consent and proof of consent for telephone marketing

Authority / court
Bundesnetzagentur (BNetzA)
Area of law
Data protection · Marketing and consent
Legal basis
UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern
Action
Fine
Status of proceedings
unknown
Sector
Other
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

13 Nov 2025 Werbendes Unternehmen aus dem Energiesektor (anonymisiert)BNetzA: €130,000 fine on energy company over sales calls with withheld numbers GermanyMarketing and consent €130,000

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 130,000 EUR on an energy company for its sales calls: 105,000 EUR for unlawful telephone advertising to consumers and 25,000 EUR for withholding caller numbers on sales calls. Callers frequently concealed their identity, so that people called were often signed up to contracts they had not wanted; the company has appealed.

What organisations can take from it

Withholding the caller number or disguising one's identity on sales calls risks additional fines on top of the ban on unsolicited calls.

Relevance to training and awareness

Consent and proof of consent for telephone marketing

Authority / court
Bundesnetzagentur (BNetzA)
Area of law
Data protection · Marketing and consent
Legal basis
UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; Verbot der Rufnummernunterdrückung bei Werbeanrufen
Action
Fine
Status of proceedings
under appeal
Sector
Energy and utilities
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

30 Sep 2025 Unternehmen der Finanzwirtschaft (anonymisiert)HmbBfDI: €492,000 over opaque automated rejection of credit card applications GermanyData subject rights and transparency €492,000

A financial services company had rejected several customers' credit card applications by automated means without human involvement despite good creditworthiness, and when asked it did not adequately provide the legally required information and access about the decision. The HmbBfDI (Hamburg data protection authority) imposed 492,000 EUR; substantial process improvements and cooperation were given considerable weight in mitigation, and the company accepted the decision.

What organisations can take from it

Anyone who rejects applications by automated means must be able to show the people affected, on request and in understandable terms, why the decision was taken and what logic it followed.

Relevance to training and awareness

Transparency in automated decision-making

Authority / court
Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (HmbBfDI)
Area of law
Data protection · Data subject rights and transparency
Legal basis
DSGVO – Informations- und Auskunftspflichten bei automatisierten Entscheidungen im Einzelfall
Action
Fine
Status of proceedings
final
Sector
Financial services and insurance
Mitigating circumstances
Substantial improvement of the process for data subject rights in automated decisions; full cooperation with the authority.
Published
30 Sep 2025
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

30 Sep 2025 HmbBfDI: 195,000 EUR against retailer over ignored data subject requests GermanyData subject rights and transparency €195,000

A retail company (name not published) had advertising letters sent via service providers and, in several cases, failed for an extended period to respond in time to the data subject rights that recipients then asserted. The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) imposed a fine of 195,000 EUR; the measure was published in the interim report of 30 September 2025 (exact date of the decision not stated).

What organisations can take from it

Companies that send advertising must have a working process for access and objection requests – even if the mailing is outsourced.

Relevance to training and awareness

Timely handling of access requests

Authority / court
Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (HmbBfDI)
Area of law
Data protection · Data subject rights and transparency
Legal basis
DSGVO (Betroffenenrechte)
Action
Fine
Status of proceedings
unknown
Sector
Retail and e-commerce
Published
30 Sep 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

6 Aug 2025 DSB: fine against news portal that ignored instruction on cookie banner AustriaCookies and tracking €6,200

In 2023, the Austrian data protection authority (Datenschutzbehörde, DSB) had ordered a local news portal (a media GmbH & Co KG, name pseudonymised) by decision to offer, on the first layer of the cookie banner, an equivalent option to close it without consent. Because the company did not implement this from October 2024 until at least March 2025, the DSB imposed 6,200 EUR for failure to comply with an instruction; the penalty decision is final.

What organisations can take from it

Implement orders of the supervisory authority on time – ignoring them risks a separate fine in addition to the original infringement.

Authority / court
Datenschutzbehörde (DSB)
Area of law
Data protection · Cookies and tracking
Legal basis
Art. 58 Abs. 2 lit. d i. V. m. Art. 83 Abs. 6 DSGVO; Art. 7 DSGVO
Action
Fine
Status of proceedings
final
Sector
Media and online platforms
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

3 Jun 2025 Vodafone GmbHBfDI: 45 million EUR against Vodafone over fraud in partner agencies and authentication gaps GermanyData processors €45m

Malicious employees in partner agencies that broker contracts for Vodafone had created fictitious contracts and contract changes to the detriment of customers. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) imposed 15 million EUR for inadequate vetting and monitoring of the partner agencies (Art. 28) and 30 million EUR for authentication deficiencies in ‘MeinVodafone’ in combination with the hotline, through which unauthorised persons were able, among other things, to retrieve eSIM profiles; in addition, a reprimand was issued under Art. 32.

What organisations can take from it

Companies that outsource sales to partner agencies must audit how those agencies handle customer data and make misuse technically harder.

Relevance to training and awareness

Insider threats and oversight of sales partners

Authority / court
Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
Area of law
Data protection · Data processors
Legal basis
Art. 28 Abs. 1 S. 1, Art. 32 Abs. 1 DSGVO
Action
Fine
Status of proceedings
final
Sector
Telecoms, IT and software
Mitigating circumstances
Full cooperation including self-incrimination, modernisation of systems, separation from fraudulent partners; fines accepted and paid, plus donations amounting to millions.
Published
3 Jun 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

16 May 2025 PostFinance AGEDÖB orders PostFinance to obtain explicit consent for voice recognition SwitzerlandData subject rights and transparency Order

PostFinance AG created voiceprints of its customers for authentication by voice recognition without obtaining their active consent; customers who did not want this had to object themselves. The Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB, Federal Data Protection and Information Commissioner) considered this processing of biometric data disproportionate and, by ruling of 16 May 2025, ordered PostFinance to obtain explicit consent in future and to delete voiceprints for which no such consent exists. PostFinance has appealed to the Federal Administrative Court.

What organisations can take from it

Biometric procedures need an active opt-in from the individuals concerned; a mere right to object is not enough.

Relevance to training and awareness

Biometric authentication and consent (opt-in instead of opt-out)

Authority / court
Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law
Data protection · Data subject rights and transparency
Legal basis
Bundesgesetz über den Datenschutz (DSG): Grundsatz der Verhältnismässigkeit; biometrische Daten als besonders schützenswerte Personendaten, ausdrückliche Einwilligung
Action
Order
Status of proceedings
under appeal
Sector
Financial services and insurance
Published
7 Aug 2025
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

29 Jan 2025 Cembra Money Bank AGFDPIC ruling: Cembra Money Bank answered access requests too late and in generic terms SwitzerlandData subject rights and transparency Order

From December 2023 to September 2024, Cembra answered 9 of 13 access requests after the 30-day deadline had expired, and responded to all 13 people only with standard letters instead of the data actually processed about them. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) required the bank to provide the data subsequently.

What organisations can take from it

Access requests need a process with resources and deadline monitoring – boilerplate text is no substitute for genuine disclosure of data.

Relevance to training and awareness

Handling access requests

Authority / court
Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Area of law
Data protection · Data subject rights and transparency
Legal basis
DSG Art. 25 Abs. 2 lit. b, Art. 25 Abs. 7
Action
Order
Status of proceedings
final
Sector
Financial services and insurance
Published
1 Jul 2025
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

27 Dec 2024 Callcenter (anonymisiert)BNetzA: €225,000 fine on call centre over sales calls for electricity and gas contracts GermanyMarketing and consent €225,000

The Bundesnetzagentur (Federal Network Agency) fined a call centre marketing electricity and gas supply contracts 225,000 EUR for unlawful telephone advertising. According to the agency, the share of complaints about energy sales calls fell in 2024, partly because of its large-scale proceedings in the energy sector.

What organisations can take from it

Call centres need verifiable consent for every number they dial and must honour requests to stop calling immediately.

Relevance to training and awareness

Consent and proof of consent for telephone marketing

Authority / court
Bundesnetzagentur (BNetzA)
Area of law
Data protection · Marketing and consent
Legal basis
UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern
Action
Fine
Status of proceedings
unknown
Sector
Other
Sources

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

19 Dec 2024 Worldcoin FoundationBayLDA: reprimand and erasure orders against Worldcoin over iris codes GermanyData subject rights and transparency Order

Following an investigation of the iris-scanning service begun in 2023, the BayLDA (Bavarian data protection authority for the private sector) issued a decision agreed at European level against the Worldcoin Foundation: a reprimand because iris codes had for a time been stored in plain text, and orders to erase certain iris codes and SMPC shares collected without an adequate legal basis, to provide a GDPR-compliant erasure procedure and to obtain explicit consent. The company has challenged the decision in court; a fine is to be decided separately.

What organisations can take from it

Biometric features cannot be reset – processing them requires explicit consent, secure storage and a working erasure procedure.

Relevance to training and awareness

Biometric data: consent, erasure and security

Authority / court
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Area of law
Data protection · Data subject rights and transparency
Legal basis
Art. 58 Abs. 2 lit. b, d, f, g DSGVO i. V. m. Art. 5 Abs. 1 lit. a, Art. 9 Abs. 1, Art. 17 Abs. 1 und Art. 32 DSGVO
Action
Order
Status of proceedings
under appeal
Sector
Telecoms, IT and software
Published
19 Dec 2024
Sources

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

Anonymous: we store only your text, no contact details and no IP address.

Load 20 more of 23

Ready for training that actually lands?

Try the combination for free: automated administration for you, learning formats that fit your team, with no minimum or credit card.

Start 14-day free trial