Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe and North America: 718 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

EUAustriaData protection Clear all filters
6cases from 1 jurisdiction
€14.6mTotal of monetary amounts
€13mLargest single case: Ö Aktiengesellschaft (in der Entscheidung abgekürzt; Adressverlag und Direktwerbeunternehmen)
€22,750Median per case with an amount

Click a bar to drill down one level.

by amountby number of cases

Where?

by authority
  1. Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde) €13m 89 % · 1 case
  2. Datenschutzbehörde (DSB) €1.53m 11 % · 4 cases
  3. Datenschutzbehörde €25,500 0 % · 1 case

What for?

by topic
  1. Marketing and consent €13m 89 % · 1 case
  2. Video surveillance €1.52m 10 % · 2 cases
  3. Data subject rights and transparency €25,500 0 % · 1 case
  4. Cookies and tracking €6,200 0 % · 1 case
  5. no topic €5,000 0 % · 1 case

Who?

by sector

All sectors

  1. Other €13m 89 % · 2 cases
  2. Retail and e-commerce €1.5m 10 % · 1 case
  3. Food and agriculture €20,000 0 % · 1 case
  4. Media and online platforms €6,200 0 % · 1 case
  5. Healthcare €5,000 0 % · 1 case

When?

per quarter, by date of decision
Trend
PeriodCasesTotal
Q3 20230—
Q4 20231€20,000
Q1 20240—
Q2 20240—
Q3 20241€1.5m
Q4 20241€5,000
Q1 20250—
Q2 20250—
Q3 20251€6,200
Q4 20250—
Q1 20261€25,500
Q2 20261€13m
Q3 20260—

6 cases

Newest firstHighest amounts
24 Jun 2026 Ö Aktiengesellschaft (in der Entscheidung abgekürzt; Adressverlag und Direktwerbeunternehmen)VwGH sets data protection fine for party affinities definitively at 13 million EUR AustriaMarketing and consent €13m

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

What organisations can take from it

Calculated characteristics such as political leanings are themselves special categories – companies that derive them for advertising need explicit consent.

Authority / court
Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)
Area of law
Data protection · Marketing and consent
Legal basis
DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)
Action
Fine
Status of proceedings
reduced
Sector
Other
Culpability
negligent
Mitigating circumstances
Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).
Published
16 Jul 2026
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

19 Jan 2026 D*** GmbH (Digitalmarketing- und Recruitingagentur, anonymisiert)Recruitment agency: 25,500 EUR for secretly recorded calls with applicants AustriaData subject rights and transparency €25,500

The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).

What organisations can take from it

Call recordings in recruitment need a genuine legal basis and clear information about who is actually responsible.

Relevance to training and awareness

Recording of telephone calls and applicant data

Authority / court
Datenschutzbehörde
Area of law
Data protection · Data subject rights and transparency
Legal basis
DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13
Action
Fine
Status of proceedings
under appeal
Sector
Other
Employees
Under 50
Mitigating circumstances
No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

6 Aug 2025 DSB: fine against news portal that ignored instruction on cookie banner AustriaCookies and tracking €6,200

In 2023, the Austrian data protection authority (Datenschutzbehörde, DSB) had ordered a local news portal (a media GmbH & Co KG, name pseudonymised) by decision to offer, on the first layer of the cookie banner, an equivalent option to close it without consent. Because the company did not implement this from October 2024 until at least March 2025, the DSB imposed 6,200 EUR for failure to comply with an instruction; the penalty decision is final.

What organisations can take from it

Implement orders of the supervisory authority on time – ignoring them risks a separate fine in addition to the original infringement.

Authority / court
Datenschutzbehörde (DSB)
Area of law
Data protection · Cookies and tracking
Legal basis
Art. 58 Abs. 2 lit. d i. V. m. Art. 83 Abs. 6 DSGVO; Art. 7 DSGVO
Action
Fine
Status of proceedings
final
Sector
Media and online platforms
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

16 Oct 2024 DSB: 5,000 EUR against Covid laboratory with managing director as data protection officer AustriaData protection €5,000

A limited company operating a diagnostic laboratory (name pseudonymised), which during the pandemic carried out up to 45,000 PCR analyses a day with around 200 employees, had appointed its managing director as data protection officer at the same time. Because of the resulting conflict of interest, the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 5,000 EUR; the penalty decision is final.

What organisations can take from it

Whoever decides on the purposes and means of processing cannot monitor themselves as data protection officer.

Authority / court
Datenschutzbehörde (DSB)
Area of law
Data protection
Legal basis
Art. 37, Art. 38 Abs. 6 DSGVO
Action
Fine
Status of proceedings
final
Sector
Healthcare
Employees
50 to 249
Liability of senior managers
The managing director was also appointed as data protection officer – an impermissible conflict of interest.
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

16 Aug 2024 DSB: 1.5 million EUR against retail chain over cameras on self-checkouts, PIN pad and surroundings AustriaVideo surveillance €1.5m

In 2022, a retail company (name pseudonymised) used nine cameras in one branch to film, among other things, the self-service checkouts including the keypad of the card payment terminal, as well as public areas, bus stops and neighbouring properties. The Austrian data protection authority (Datenschutzbehörde, DSB) imposed 1.5 million EUR for lack of a legal basis and infringement of data minimisation; the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) confirmed the amount on 25 July 2025, and an appeal on points of law is pending.

What organisations can take from it

Align cameras in retail closely with their protective purpose – PIN entries, public spaces and neighbouring properties must not be in the frame.

Authority / court
Datenschutzbehörde (DSB)
Area of law
Data protection · Video surveillance
Legal basis
Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1 DSGVO
Action
Fine
Status of proceedings
under appeal
Sector
Retail and e-commerce
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

7 Dec 2023 DSB: 20,000 EUR against restaurant business over constant surveillance of kitchen and pick-up area AustriaVideo surveillance €20,000

A restaurant company with a delivery and pick-up service (name pseudonymised) recorded workstations in the kitchen and pick-up area without interruption, even outside opening hours, and stored the recordings for 14 days. In addition, there had been no record of processing activities since 2018; the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 20,000 EUR, and the penalty decision is final.

What organisations can take from it

Even small businesses may not film employees permanently – and they need a record of their processing activities.

Authority / court
Datenschutzbehörde (DSB)
Area of law
Data protection · Video surveillance
Legal basis
Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1, Art. 30 Abs. 1 DSGVO
Action
Fine
Status of proceedings
final
Sector
Food and agriculture
Sources

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Anonymous: we store only your text — no contact details and no IP address.

Ready for training that sticks?

Try it free for 14 days — from 1 user, no credit card, ends automatically.

Start free trial