Who was sanctioned, and for what?

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Public sector

Employees

10,000 or more

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Attackers obtained the credentials of a user account with administrator rights through phishing and accessed customer data. The Romanian data protection authority (ANSPDCP) criticised the lack of technical and organisational measures and of regular effectiveness testing, imposed 15,728 lei (3,000 EUR) and ordered regular employee training, including on recognising phishing e-mails. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

19 Aug 2026

Original amount 15,728 RON, converted at the ECB reference rate of 19 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

6 Aug 2026

Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

Authority / court

Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)

Area of law

Data protection · Employee data

Legal basis

Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

7 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

At the request of a third party and outside the scope of his duties, a bank employee retrieved account statements of a data subject (name, IBAN, transactions, balances). The Romanian data protection authority (ANSPDCP) found insufficient technical and organisational measures and imposed 26,172 lei (5,000 EUR); the bank has paid the fine. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1, 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

2 Jul 2026

Original amount 26,172 RON, converted at the ECB reference rate of 2 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In a targeted inspection of cookies on company websites, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) found fault with the site 4mebeles.lv. After a reprimand in February 2026, the company claimed that the deficiencies had been remedied, which a further inspection disproved; further requests for information went unanswered. The DVI imposed 1,000 EUR for failure to cooperate and requested the missing information by 3 August 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

Authority / court

Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)

Action

Fine

Status of proceedings

reduced

Sector

Other

Culpability

negligent

Mitigating circumstances

Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1

Action

Reprimand or warning

Status of proceedings

final

Sector

Defence and security

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Video surveillance

Legal basis

Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

15 Jun 2026

Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The online retailer had not set a retention period for customer accounts and kept data until customers requested deletion; purchases were only possible with an account. The sanctions board of the Finnish Data Protection Ombudsman imposed 856,000 EUR in 2024, the administrative court reduced the fine to 792,639 EUR on the basis of current turnover, and the Supreme Administrative Court (Korkein hallinto-oikeus, KHO) confirmed this on 12 June 2026.

Authority / court

Korkein hallinto-oikeus (KHO); Sanktionsgremium des Datenschutzbeauftragten

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Retail and e-commerce

Published

18 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A data subject complained about the disclosure of footage from the supermarket chain’s video surveillance and about the inadequate response to his access request. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that Market In had passed the video footage to the judicial authorities without informing the data subject beforehand, processed more data than necessary, failed to comply with the right of access and failed to cooperate with the authority, and by Decision 10/2026 imposed a total of 95,000 EUR (50,000 EUR for lawfulness/transparency, 20,000 EUR each for data minimisation and the right of access, 5,000 EUR for failure to cooperate); in the same proceedings, ΜΕΔΕ ΑΕ received 65,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, Art. 5 Abs. 2, Art. 12, 13, 15, 31 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2019, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) had imposed 14.5 million EUR on the housing group because tenant data such as salary statements, bank statements and social security data were held in an archive system with no means of deletion. Following the 2023 CJEU judgment on direct corporate liability, the Berlin Regional Court (Landgericht Berlin I) confirmed on 9 June 2026 infringements of data minimisation and storage limitation; the press release does not state the amount of the fine set by the court.

Authority / court

Landgericht Berlin I (Bußgeldbehörde: Berliner Beauftragte für Datenschutz und Informationsfreiheit)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5, Art. 25 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Liability of senior managers

According to the CJEU (C-807/21), a breach of duty by a person in a management position need not be proven for the corporate fine.

Published

10 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Due to errors by a processor of the energy supplier, incorrect details of a direct debit mandate were recorded, so that three bills instead of one were debited from the customer's account; call recordings and the mandate form had not been retained. ZENITH responded inadequately to the access request and did not correct the data (100,000 EUR), while Piraeus Bank infringed the right of access (10,000 EUR and a reprimand); Decision No. 8/2026 of the Hellenic Data Protection Authority.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. d, Art. 12 Abs. 3, Art. 15, Art. 28 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On 7 November 2025, the publisher's news portals Origo and Magyar Nemzet linked to a map, created by unknown persons, containing the names, addresses, telephone numbers, email addresses, geo-coordinates and political preferences of Tisza sympathisers; Ripost showed an image with the name of the map. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found intentional infringements of Art. 6 and 9 GDPR, prohibited further dissemination and imposed 50 million HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection

Legal basis

DSGVO Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 58 Abs. 2 lit. b und f (NAIH/962-10/2026)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

intentional

Published

26 May 2026

Original amount 50,000,000 HUF, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO (Integrität und Vertraulichkeit, Art. 32)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Walloon water utility recorded and listened in on customer calls for quality control and training purposes; the Litigation Chamber of the Autorité de protection des données (Belgian Data Protection Authority, APD/GBA) found infringements of transparency and fairness as well as in the engagement of a sub-processor. It imposed two fines totalling 86,000 EUR (85,000 + 1,000) after reducing the amounts in view of the situation of the public utility; an appeal against the decision has been lodged with the Market Court.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13, Art. 28 Abs. 3

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Fraudsters in possession of customer data posed as customers at the bank's ‘Open24’ call centre, had account details changed and obtained further information because security protocols were not followed; those affected had to close accounts, and some suffered losses. Ireland's Data Protection Commission (DPC) imposed 250,000 EUR for inadequate security and 27,500 EUR for late breach notification (decision served in the week before the press release).

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

8 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Although the Information and Data Protection Commissioner (IDPC) had already ruled in favour of a complainant, an insurance company (name redacted) again had him called for marketing purposes via a third-party company; his number remained on call lists. The IDPC criticised the lack of safeguards and inadequate contracts with processors, ordered remedial action within 20 days and imposed two fines totalling 1,000 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 2, Art. 21 Abs. 2, Art. 24 Abs. 1, Art. 28 Abs. 3 i. V. m. Art. 58 Abs. 2 lit. b, d, i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.

Authority / court

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Mitigating circumstances

BVG has announced measures against similar incidents.

Published

4 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A provider of public utility services used GPS transmitters in company vehicles to record employees’ location data permanently and without cause, without defining a purpose, carrying out a balancing of interests or providing sufficient information. The Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP) imposed 6,000 EUR on the company and 600 EUR on the responsible person.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Liability of senior managers

Additional fine of 600 EUR on the responsible person.

Published

15 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The publisher kept data of around 685,000 former book club members in a ‘passive database’, in around 395,000 cases more than ten years after they had left, without any deletion rules. The Danish Data Protection Agency (Datatilsynet) had recommended a fine of 1 million DKK in 2022; the case was closed on 14 April 2026 with a fine notice whose amount is not stated in the source.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection

Legal basis

DSGVO Art. 5 Abs. 1 lit. e, Art. 5 Abs. 2

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Cooperative conduct; only two employees had access to the passive database; deletion after the supervisory visit.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employer installed the software Spyrix Employee Monitoring on the work computers of individual employees, which for months recorded screen content, audio and even private e-mails and conversations without informing the employees. The supervisory authority, the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP), imposed 71,474 EUR on the company and 4,000 EUR on the responsible person.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Liability of senior managers

Additional fine of 4,000 EUR on the responsible person.

Published

9 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Amsterdam-based Ridetech offered the ride-hailing app Yango in Finland and Norway and transferred data of drivers and customers to the group companies Yandex.Taxi LLC and Yandex LLC in Russia without demonstrating appropriate safeguards. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 100 million EUR on the legal successor and prohibited further transfers to Russia.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · International data transfers

Legal basis

Art. 44, Art. 46 iVm Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In an attack on an application operated by a processor, data of a very large number of persons (including personal identification numbers, driving licence and identity card numbers, vehicle identification numbers) were stolen and published. The Romanian data protection authority (ANSPDCP) criticised the lack of security measures and effectiveness testing as well as the selection of a service provider without sufficient guarantees and imposed 637,262.50 lei (125,000 EUR).

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data processors

Legal basis

Art. 32 Abs. 1 lit. b und d, Abs. 2 i. V. m. Art. 28 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Published

25 Mar 2026

Original amount 637,262.5 RON, converted at the ECB reference rate of 25 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A person complained that Fitsypro had not responded to their request for access, rectification and erasure of November 2023. Three requests for information from the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) between 2024 and 2026 went unanswered, and nobody attended the hearing. The DVI imposed 1,500 EUR and requested the information by 21 April 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 58 Abs. 1 lit. e, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1 (NAIH-273-7/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2021, the Luxembourg data protection authority (CNPD) had imposed 746 million EUR and an order to bring processing into compliance on account of behavioural online advertising; the Administrative Tribunal (Tribunal administratif) confirmed this on 18 March 2025. On 12 March 2026, the Administrative Court (Cour administrative) confirmed that legitimate interest was not a sound legal basis and that the information was insufficient, but annulled the fine on the basis of more recent CJEU case law on the requirement of culpability; the CNPD is re-examining the sanction.

Authority / court

Cour administrative (Luxemburg); Verfahren der CNPD

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. f, Art. 12 ff. DSGVO

Action

Order

Status of proceedings

overturned

Sector

Retail and e-commerce

Employees

10,000 or more

Mitigating circumstances

Amazon had implemented the compliance order before the hearing.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Despite repeated follow-ups by the trade union, the cleaning company did not respond to a union member’s access request and also failed to comply with the order of the Danish Data Protection Agency (Datatilsynet) to decide on the request. Datatilsynet reported the company; the case was closed on 2 March 2026 with a fine notice of 60,000 DKK.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15; Nichtbefolgung einer Anordnung der Datatilsynet; databeskyttelsesloven

Action

Fine

Status of proceedings

final

Sector

Other

Original amount 60,000 DKK, converted at the ECB reference rate of 2 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following six complaints, the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found that the company did not provide a copy to customers who requested recordings of their sales calls in order to dispute invoices, offering only to let them listen via customer service, and in some cases deleted recordings. In addition to a reprimand, a fine of 5,000 EUR was imposed.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15 Abs. 1 und 3

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

25 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Since 2019, the delivery platform had required scans or photos of its users’ identity cards and passports in cases of suspected fraud, relying on legitimate interests. The Prezes Urzędu Ochrony Danych Osobowych (President of Poland’s data protection authority, UODO) regarded this as processing without a legal basis and a breach of data minimisation, imposed 5,898,064 PLN and ordered the processing to stop and the data to be erased.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 5 Abs. 2, Art. 6 Abs. 1 DSGVO (DKN.5112.33.2022)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

16 Mar 2026

Original amount 5,898,064 PLN, converted at the ECB reference rate of 19 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An estate agency (name not published) kept 11,887 brokerage contracts from 2010 to 2019, together with 914 copies of identity cards, passports and bank cards, without a legal basis, although the managing director stated that no card copies were collected. The Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) also criticised irregular and inadequate data protection training for employees and imposed 100,000 EUR (date of publication; exact date of the decision not stated).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. c und e, Art. 6 Abs. 1, Art. 32 Abs. 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Culpability

negligent

Mitigating circumstances

No damage to data subjects was found.

Published

19 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The provider of management software and an app for sports clubs suffered a data exfiltration by an external attacker in January 2025. The Swedish Authority for Privacy Protection (IMY) found that no appropriate technical and organisational security measures were in place before and at the time of the incident, even though the data processed related predominantly to children and also included health information (allergies, disabilities), and imposed 6 million SEK; in setting the amount it took into account the 2024 group turnover of the Lime group (around 685.7 million SEK).

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Prompt and comprehensive information of the clubs and data subjects after the incident; support for around 1,700 clubs in filing their notifications within 72 hours.

Published

26 Jan 2026

Original amount 6,000,000 SEK, converted at the ECB reference rate of 26 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

29 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).

Authority / court

Datenschutzbehörde

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13

Action

Fine

Status of proceedings

under appeal

Sector

Other

Employees

Under 50

Mitigating circumstances

No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An Excel file containing data from medical certificates of current and former employees was repeatedly circulated within the company; the company reported the incident itself. The Romanian data protection authority (ANSPDCP) imposed 25,455 lei (5,000 EUR) for breach of data minimisation and accountability and 50,911 lei (10,000 EUR) for insufficient security measures and ordered a monitoring and control procedure. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c und Abs. 2, Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Published

19 Jan 2026

Original amount 76,366 RON, converted at the ECB reference rate of 19 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following an attack in October 2024 in which data relating to around 24 million customer contracts, including IBANs, was exfiltrated, the French data protection authority (CNIL) imposed 27 million EUR on Free Mobile and 15 million EUR on Free (42 million EUR in total). The authority objected to VPN access without adequate authentication, deficient detection of suspicious access, incomplete notification of data subjects and, at Free Mobile, excessively long retention of old contracts; orders with deadlines were also issued.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 32, Art. 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

During the proceedings, the companies introduced multi-factor authentication, a Security Operations Centre and improved logging.

Published

14 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The function of data protection officer was performed by a manager who was at the same time responsible for security and protection of classified information and thus monitored their own activities; there was no conflict analysis. Poland’s data protection authority (UODO) imposed 978,128 PLN and referred to numerous previous reprimands and orders against the company.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 3 und 6 DSGVO (DKN.5131.4.2025)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Repeat case

yes

Mitigating circumstances

During the proceedings the function was made independent and placed directly under the management board.

Published

26 Jan 2026

Original amount 978,128 PLN, converted at the ECB reference rate of 2 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following numerous complaints about marketing calls for the gas supplier ZENITH, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that the call centre engaged had insufficient security measures and called persons without valid consent. By Decision 44/2025, One Way received 40,000 EUR each as processor and as controller, together with an order to delete the data of persons without valid consent; ZENITH and two other service providers were also held liable (10,000, 10,000 and 5,000 EUR).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 29, 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.

Authority / court

Conseil d'État

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Transport, logistics and shipping

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

As a processor, Nexpublica developed and operated the case management software ‘Public CRM’ for the disability authority MDPH Nord. Following two data breaches in 2022, audits revealed critical vulnerabilities that had existed since 2021, such as outdated SHA-1 hashing; the French data protection authority (CNIL) imposed 1.7 million EUR directly on the service provider.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data processors

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employee of the customer service provider was serving two customers in chat at the same time and assigned one customer's e-mail address to the other; as a result, the complainant received the name, debts and billing data of a stranger. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) saw the cause in the process design, which allowed parallel chats, and imposed 500,000 EUR for lack of data protection by design; the request for reconsideration was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data processors

Legal basis

Art. 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The mobile banking app of a bank (name not published) scanned the list of all installed applications on the Android and Huawei devices of 433,922 customers and stored it centrally – without a legal basis, without transparent information and without a data-minimising design. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 1.5 million EUR; the decision is not final (date = publication).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1, Art. 12, 13, 25 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

18 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

At the instruction of a group company based in Switzerland, the seed company had telematics devices installed in company cars that also recorded private journeys and assigned employees scores for their driving behaviour. Italy's data protection authority (Garante per la protezione dei dati personali) found breaches of transparency, purpose limitation, data minimisation and employee protection rules, imposed 120,000 EUR and ordered the deletion of the data on private journeys.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

DSGVO Art. 5 Abs. 1 lit. a-c, 6 Abs. 1 lit. f, 13, 28, 88; Codice privacy Art. 2-quaterdecies, 113, 114

Action

Fine

Status of proceedings

final

Sector

Food and agriculture

Mitigating circumstances

Small number of data subjects (five employees), immediate suspension of the processing.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2021, a hacker gained access via a web form to a web server and a database server of the university, obtained, among other things, names with passwords and citizen service numbers of students and staff, and unsuccessfully demanded a ransom. According to the Dutch data protection authority (Autoriteit Persoonsgegevens, AP), security was not aligned with the risks, and the rights of a database account were not restricted.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Mitigating circumstances

Settlement without objection; active damage limitation, strengthened resilience and sharing of lessons learned with other organisations.

Published

17 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On the Romanian marketplace publi24.ro, a fake advert appeared with photos and the telephone number of a woman, claiming that she offered sexual services. The Court of Justice of the European Union (Grand Chamber, Case C-492/23) ruled that the operator is a controller within the meaning of the GDPR, must identify adverts containing sensitive data before publication and verify identity or consent, and cannot rely on the liability exemption of the E-Commerce Directive.

Authority / court

Gerichtshof der Europäischen Union (Große Kammer), Rs. C-492/23

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO (Verantwortlicher, Art. 9, Art. 32); Richtlinie 2000/31/EG

Status of proceedings

unknown

Sector

Media and online platforms

Published

2 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

When the website was accessed, eight non-exempt cookies were placed without any user action; after ‘Reject all’, three marketing cookies were nevertheless placed when switching to an affiliated domain, and after consent was withdrawn, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 1.5 million EUR for this and, in view of the rectification during the proceedings, refrained from issuing an order; it found an infringement of data minimisation in the recording of customer calls but did not sanction it.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés (Geldbuße); Verstoß gegen Art. 5 Abs. 1 lit. c DSGVO (Gesprächsaufzeichnungen) festgestellt, aber nicht sanktioniert

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Mitigating circumstances

Corrections during the proceedings, cooperation.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The address broker (formerly Kapitol) had passed on the complainant’s data via a media agency to an advertiser for direct marketing without being able to demonstrate valid consent. The Autorité de protection des données (Belgian Data Protection Authority, APD) imposed 40,000 EUR and ordered erasure and information of the recipients; on 3 June 2026 the Cour des marchés (Brussels Market Court) set aside these parts and itself set the fine at 5,000 EUR.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse; Cour des marchés

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 24

Action

Fine

Status of proceedings

reduced

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following several complaints, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) examined how the parking operator collects contractual penalties: invoices were sent to previous rather than current registered addresses, claims were handed over to debt collection services and entered in the database of Kredītinformācijas Birojs. The authority found breaches of the principles of lawfulness, data minimisation and confidentiality and of the accountability obligation and imposed 25,000 EUR (previous year’s turnover according to the decision: 8,323,178 EUR).

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection

Legal basis

Art. 5 Abs. 1 lit. a, c, f und Abs. 2, Art. 83 Abs. 5 lit. a DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

intentional

Mitigating circumstances

Practice changed after the proceedings began; contracts concluded with the population and vehicle registers (PMLP, CSDD)

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On vanityfair.fr, cookies requiring consent were set before any interaction with the banner, trackers were labelled as ‘strictly necessary’ and cookies continued to be placed even after ‘Reject all’. Following a complaint by noyb, the publisher had already received a formal notice in 2021; follow-up inspections in 2023 and 2025 by the French data protection authority (CNIL) showed continuing infringements.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Repeat case

yes

Published

27 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The telecommunications provider allowed a software service provider belonging to the group in Serbia to access the entire SAP CRM customer database with administrator rights, from the end of 2022 without standard contractual clauses and without clear information to customers. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) also sanctioned the copying of employees’ identity cards and criminal records certificates and the failure to vet a telemarketing service provider; 4.5 million EUR in total.

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · International data transfers

Legal basis

Art. 44, 46, 12 Abs. 1, 13 Abs. 1 lit. f, 5, 6 Abs. 1, 28 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

14 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a technical change to the bank’s strong electronic identification service, a disruption lasting around one hour occurred in January 2023 during which customers logging in with Aktia credentials to services such as OmaKanta, OmaKela, unemployment funds, insurers and healthcare providers saw data of other persons; around 350 people were affected. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) criticised the deficient planning, implementation and testing of the change and imposed 865,000 EUR in addition to a reprimand.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 25, Art. 32

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

28 Oct 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The municipality in the province of Padua monitored public streets and work areas without a sound legal basis, without adequate information and without a data protection impact assessment; recordings were used for disciplinary purposes, and an employee was secretly filmed while on sick leave. Italy's data protection authority (Garante per la protezione dei dati personali) imposed a fine of 15,000 EUR (5,000 EUR for public surveillance, 10,000 EUR for workplace surveillance).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 5, 6, 12, 13, 35, 88

Action

Fine

Status of proceedings

final

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The operator of a sports facility rented a Bluetooth system with which swimmers were located in the pool via tags and their training was recorded. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) imposed 8,000 EUR for the processing of special categories of data and – after a 20% reduction for immediate payment – 4,000, 2,400 and 3,200 EUR for lack of a legal basis, insufficient information and a deficient impact assessment (17,600 EUR in total); the request for reconsideration was unsuccessful.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Mitigating circumstances

Partial immediate payment (20% reduction under Art. 85 LPACAP).

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Despite access requests, two patients did not receive copies of their scan files at the end of treatment; the practice responded only sluggishly to enquiries and did not attend an appointment with the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered disclosure under Art. 15(3) GDPR or a reasoned refusal and threatened a penalty payment of 2,000 EUR.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. c, Art. 12 Abs. 4, Art. 15 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The company had used an automated script to carry out mass queries in the electronic land register and stored data of natural persons without demonstrating a legal basis; it did not respond to requests from the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered erasure with proof or a statement of a legal basis with a balancing of interests; a penalty payment of 2,000 EUR was threatened.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d, Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A retail company (name not published) had advertising letters sent via service providers and, in several cases, failed for an extended period to respond in time to the data subject rights that recipients then asserted. The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) imposed a fine of 195,000 EUR; the measure was published in the interim report of 30 September 2025 (exact date of the decision not stated).

Authority / court

Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (HmbBfDI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO (Betroffenenrechte)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

30 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For almost six years, the chair of the management board of the medical company was also its data protection officer; this came to light after a report that a patient had been handed documents relating to another person. Poland’s data protection authority (UODO) found a conflict of interest and imposed 11,365 PLN.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 6 DSGVO (DKN.5131.7.2025)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

An independent external data protection officer was appointed in July 2024.

Published

29 Sep 2025

Original amount 11,365 PLN, converted at the ECB reference rate of 12 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

After a new login function was introduced in the S-mobiili app in April 2022, a vulnerability in the identification service made it possible until August 2022 to access online banking and services requiring strong authentication using other customers’ credentials; misuse caused financial losses. The bank had introduced the function without sufficient risk analysis and testing; the sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.8 million EUR in addition to a reprimand, with a previous reprimand acting as an aggravating factor.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 25 Abs. 1, Art. 32 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

The fine imposed by the financial supervisory authority (7.67 million EUR) for the same facts was taken into account (fine around one third of the amount that would otherwise have been imposed); according to the bank, it compensated customers for direct losses.

Published

10 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Unknown persons accessed the system operator’s databases via several websites and obtained personal data. The Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) initially imposed 400,000 EUR; in the objection procedure, the director set aside the allegation relating to the company’s role as controller because ZZ Dats was a processor, and set the fine at 300,000 EUR for insufficient security measures under Art. 32 GDPR. The company has brought an action.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und d, Abs. 2, Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Single Resolution Board (SRB) passed on pseudonymised comments from former Banco Popular shareholders to Deloitte without informing the data subjects; the European Data Protection Supervisor (EDPS) considered this an infringement of the duty to inform. The Court of Justice of the European Union (Case C-413/23 P) set aside the judgment of the General Court and clarified that the duty to inform is to be assessed from the controller's perspective at the time of collection; the case was referred back to the General Court.

Authority / court

Gerichtshof der Europäischen Union, Rs. C-413/23 P

Area of law

Data protection · Data subject rights and transparency

Legal basis

Verordnung (EU) 2018/1725 (Informationspflicht)

Status of proceedings

under appeal

Sector

Public sector

Published

4 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The furniture retailer had stored data of around 385,000 customers in a legacy system without retention periods. The district court had imposed 100,000 DKK; following a referral to the CJEU on whether the fine is to be calculated on the basis of the turnover of the entire group, the High Court increased the fine to 1.5 million DKK.

Authority / court

Vestre Landsret (auf Anzeige der Datatilsynet)

Area of law

Data protection

Legal basis

DSGVO Art. 5 Abs. 1 lit. e, Art. 83

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Original amount 1,500,000 DKK, converted at the ECB reference rate of 2 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

When creating a Google account, users were not sufficiently informed that advertising cookies were necessarily placed in the process; in addition, Google displayed advertisements between e-mails in Gmail without prior consent. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 200 million EUR on Google LLC and 125 million EUR on Google Ireland and ordered remedial action within six months, subject to a penalty payment of 100,000 EUR per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés; Art. L. 34-5 Code des postes et des communications électroniques

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On shein.com, advertising cookies were placed without consent as soon as the site was accessed; in addition to an incomplete cookie banner, there was an advertising pop-up without an option to reject. After clicking ‘Reject all’ or withdrawing consent, cookies continued to be read. The Commission nationale de l’informatique et des libertés (French data protection authority, CNIL) imposed 150 million EUR.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 82 Loi Informatique et Libertés (Umsetzung von Art. 5 Abs. 3 ePrivacy-Richtlinie)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A school employee gained access to her school’s official e-mail account and sent forged documents on the basis of which the credit association concluded 17 loans in 2023/2024 without the knowledge of the data subjects. The Romanian data protection authority (ANSPDCP) criticised the insufficient identity verification for remote applications and imposed 15,141.6 lei (3,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in June 2025.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

12 Aug 2025

Original amount 15,141.6 RON, converted at the ECB reference rate of 12 Aug 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2023, the Austrian data protection authority (Datenschutzbehörde, DSB) had ordered a local news portal (a media GmbH & Co KG, name pseudonymised) by decision to offer, on the first layer of the cookie banner, an equivalent option to close it without consent. Because the company did not implement this from October 2024 until at least March 2025, the DSB imposed 6,200 EUR for failure to comply with an instruction; the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 58 Abs. 2 lit. d i. V. m. Art. 83 Abs. 6 DSGVO; Art. 7 DSGVO

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The instalment payment provider created customer profiles without a contract for persons who signed in via retailer checkouts, refused former customers the closure of their accounts and continued to send them transactional e-mails with advertising content. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered transparent information, valid consent, erasure options under Art. 17 GDPR and the separation of transactional and advertising e-mails; a penalty payment of 5,000 EUR is threatened for each item not fulfilled.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d, Art. 4 Nr. 11, 5, 6, 7, 12–14, 17 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The district heating company stored the passwords of almost 16,000 users of its customer portal ‘Moj račun’ in readable form and, when ‘forgot password’ was used, sent the old password by e-mail. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 320,000 EUR for lack of security measures and insufficient cooperation, as the company neither provided evidence of remediation nor disclosed all information (date = publication).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 31, Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Published

22 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following an anonymous tip-off about a USB stick containing data on more than one million vehicle owners (name, OIB, address, registration number, insurance data), the Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) found that the data originated from the database of the Insurance Bureau, which had not laid down appropriate protective measures or deletion periods. Because of its public tasks, the fine was capped at 101,000 EUR (date of publication; exact date of the decision not stated).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 32 Abs. 2 und 4 DSGVO; Art. 44 kroatisches DSGVO-Durchführungsgesetz

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

Cap due to public tasks (Art. 44 of the Implementing Act).

Published

2 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Using a customer’s identity card, an unknown person registered at least 15 prepaid numbers in her name at a Vodafone partner shop. By Decision 27/2025, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) imposed on Vodafone 350,000 EUR (processing by a processor, Art. 28), 200,000 EUR (accuracy of data) and 150,000 EUR under the Greek ePrivacy law, and issued a reprimand requiring the company to secure the activation of new numbers technically within three months (for example by sending an SMS to the existing customer); the shop (Karampelas K. & Sia E.E., ‘DS Phone’) received 40,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 1 lit. d, Art. 28 Abs. 1 und 3 DSGVO; Art. 12 Gesetz 3471/2006

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The shipping company processed results of on-board breath alcohol tests that could be attributed to a complainant employed as a captain. The Swedish Authority for Privacy Protection (IMY) regarded this as processing without a legal basis and as unlawful processing of health data and imposed 75,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Employee data

Legal basis

DSGVO Art. 6, Art. 9

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

18 Jun 2025

Original amount 75,000 SEK, converted at the ECB reference rate of 18 Jun 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For registration for the Public Services Card, the ministry created biometric facial templates of a large part of the population without a sufficiently clear legal basis, with deficient information and an incomplete data protection impact assessment. Ireland's Data Protection Commission (DPC) issued a reprimand, imposed 550,000 EUR and ordered the biometric processing to be stopped within nine months if no valid legal basis is found.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und e, Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 Abs. 7 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

No deficiencies were found in the technical and organisational security measures.

Published

12 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A person who was not (or no longer) a customer received a letter from CaixaBank about an update to its privacy statement, announcing that she would be contacted about her advertising preferences. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) considered the continued storage of her data to be an infringement of the principle of storage limitation and imposed 200,000 EUR; the bank's request for reconsideration was dismissed as inadmissible.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Malicious employees in partner agencies that broker contracts for Vodafone had created fictitious contracts and contract changes to the detriment of customers. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) imposed 15 million EUR for inadequate vetting and monitoring of the partner agencies (Art. 28) and 30 million EUR for authentication deficiencies in ‘MeinVodafone’ in combination with the hotline, through which unauthorised persons were able, among other things, to retrieve eSIM profiles; in addition, a reprimand was issued under Art. 32.

Authority / court

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)

Area of law

Data protection · Data processors

Legal basis

Art. 28 Abs. 1 S. 1, Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

Full cooperation including self-incrimination, modernisation of systems, separation from fraudulent partners; fines accepted and paid, plus donations amounting to millions.

Published

3 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A customer's mobile number was ported to MásMóvil without the customer having requested it; the new SIM card was handed over to a third party who did not identify themselves. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) found processing without a legal basis, imposed 200,000 EUR and ordered measures against such incidents; the company's request for reconsideration was unsuccessful.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The company behind the Kruidvat drugstore chain tracked visitors to Kruidvat.nl with tracking cookies without their knowledge or consent, enabling it to build profiles from location, pages visited, shopping basket and purchases. The Dutch data protection authority (Autoriteit Persoonsgegevens, AP) had imposed 600,000 EUR in 2024, upheld the objection in May 2025 and reduced the fine to 50,000 EUR.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 6 Abs. 1 i. V. m. Art. 5 Abs. 1 lit. a DSGVO (Tracking-Cookies ohne Einwilligung)

Action

Fine

Status of proceedings

reduced

Sector

Retail and e-commerce

Published

12 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 9, Art. 25, Art. 32

Action

Fine

Status of proceedings

overturned

Sector

Healthcare

Published

4 Jun 2025

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

TikTok allowed employees in China to access European users' data remotely without assessing and demonstrating that standard contractual clauses and supplementary measures ensured an equivalent level of protection against access by Chinese authorities; it also informed users inadequately. Ireland's Data Protection Commission (DPC) imposed 530 million EUR and ordered that the transfers be brought into compliance or suspended within six months.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · International data transfers

Legal basis

Art. 46 Abs. 1, Art. 13 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

2 May 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In an audit campaign on records of processing activities, the Commission nationale pour la protection des données (Luxembourg data protection authority, CNPD) found that an engineering and design consultancy (pseudonymised as ‘Société A’) had omitted mandatory information such as name and contact details, categories of data subjects and data, and retention periods. It imposed 7,000 EUR.

Authority / court

Commission nationale pour la protection des données (CNPD) – formation restreinte

Area of law

Data protection

Legal basis

DSGVO Art. 30 Abs. 1 lit. a, c, f

Action

Fine

Status of proceedings

unknown

Sector

Manufacturing and mechanical engineering

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Although the platform operator had repeatedly confirmed to a customer that his e-mail addresses had been deleted, he continued to receive feedback requests; in addition, certain partners could see the address. The Romanian data protection authority (ANSPDCP) found breaches of transparency and erasure obligations, imposed 49,770 lei (10,000 EUR) and ordered, among other things, training of the staff responsible.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 Abs. 1 i. V. m. Art. 17 und 19 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Published

24 Apr 2025

Original amount 49,770 RON, converted at the ECB reference rate of 24 Apr 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Since 2008, Iberinform had obtained data on sole traders through a supply contract with Camerdata and used it to enrich its own files for commercial information services. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) found no legal basis for this and no information of the data subjects, and imposed 360,000 EUR for each (720,000 EUR in total) as well as an order to bring the processing into compliance; the request for reconsideration (recurso de reposición) was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 6 Abs. 1, Art. 14 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Despite being asked to do so, a healthcare provider (name redacted) did not correct a patient’s address, so that health reports were sent to third parties, and used address data from the electoral register without a legal basis. The Information and Data Protection Commissioner (IDPC) issued a reprimand, ordered rectification, erasure of the register data and the designation of a data protection officer, and imposed fines of 12,500, 5,000 and 2,500 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und d, Art. 6 Abs. 1, Art. 14, 16, 37 Abs. 1 lit. c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A customer denied having registered in the EAC Mobile App and having changed his billing address there; the supplier could not prove that the mobile number used for identification originated from the customer himself. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) found breaches of accountability and data security, issued a reprimand and ordered the delivery address to be clarified with the customer in writing.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 24, Art. 32 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The housing finance corporation retained data of a former customer in its loan system beyond the permissible retention period because deletion there is only possible manually, record by record. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) imposed 10,000 EUR and ordered erasure within 10 days as well as technical and organisational corrections within six months.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. d und e, Art. 24 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a report through which a minor victim became identifiable, an inspection found that the broadcaster had no risk analysis for editorial work, no rules for checking personal data before publication and no encryption of mobile storage media. Poland’s data protection authority (UODO) imposed 56,824 PLN; the Warsaw Administrative Court dismissed the action on 18 March 2026.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 24 Abs. 1, Art. 32 Abs. 1 und 2 DSGVO (DKN.5112.10.2024)

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Published

11 Mar 2025

Original amount 56,824 PLN, converted at the ECB reference rate of 6 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

As part of a preventive review of the privacy policy on zoopasaule.lv, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) repeatedly asked the online pet retailer for information from July 2024 onwards. The company let the first deadlines lapse, later twice asked for an extension citing the absence of its programmer, and still did not deliver thereafter. The DVI imposed 500 EUR for failure to cooperate with the supervisory authority.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 58 Abs. 1 lit. d und e, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An insurance agent who was himself involved in an accident received, on request, the roadside assistance file from the insurer, including data of the other party to the accident, and subsequently contacted that person. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) issued a reprimand because there was no legal basis for the disclosure and internal procedures did not cover this case, and ordered a procedure for data requests from agents and employees.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. a und f, Art. 6 Abs. 1, Art. 32 Abs. 1 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Financial services and insurance

Mitigating circumstances

The company implemented the order

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employee accidentally attached an Excel file containing data of 29,636 clients, including health data, to an e-mail sent to 292 clients. The Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found that measures to prevent data leakage had not been sufficiently tested and that the employee had not been involved in data classification and had been insufficiently instructed; fine of 9,000 EUR. Date = publication; source: archived copy.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 24 Abs. 1, Art. 32 Abs. 1 lit. b und d DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

21 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Several reported incidents were attributable to employees or service providers: a photo of an invoice sent to third parties, open e-mail distribution lists instead of BCC, a screenshot from the customer application shared via WhatsApp and misdirected invoices. The Romanian data protection authority (ANSPDCP) found insufficient measures to ensure that employees processed data in accordance with instructions and imposed 74,526 lei (15,000 EUR); the company paid. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 4 i. V. m. Abs. 1 lit. b DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

20 Jan 2025

Original amount 74,526 RON, converted at the ECB reference rate of 20 Jan 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An IRIS transfer made by mobile number via the bank’s app ended up with an uninvolved customer instead of the intended recipient because the number had been assigned incorrectly. By Decision 3/2025, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) imposed 100,000 EUR for inaccurate data, insufficient security, lack of data protection by design and failure to notify the data breach, as well as 20,000 EUR for breach of the right of access.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. d und f, Art. 15, 25, 32, 33, 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following 47 complaints, the Commission nationale pour la protection des données (Luxembourg data protection authority, CNPD) found that a Luxembourg credit institution (pseudonymised in the decision as ‘Société A’) had not responded to data subjects’ requests on time; the CNPD did not accept the reference to the COVID-19 pandemic. It issued a reprimand (rappel à l’ordre) and imposed 175,000 EUR.

Authority / court

Commission nationale pour la protection des données (CNPD) – formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 12 Abs. 3 und 4

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A courier of the insurer delivered an employee’s dismissal letter unsealed to his parents’ home and, when the father refused to accept it, left it there, so that third parties could read its contents. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) issued a reprimand for breaches of lawfulness, confidentiality and accountability and ordered the delivery procedure for dismissal letters to be revised within one month.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und f, Art. 6, Art. 24 Abs. 1 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Because of vandalism, the operator of the City2 shopping centre had installed cameras in toilet areas; one camera in the men’s toilets also captured the area in front of the urinal despite a black masking, and there were no signs. The court followed the Danish Data Protection Agency (Datatilsynet) and the public prosecutor and imposed 350,000 DKK for breach of the data minimisation principle.

Authority / court

Retten i Glostrup (auf Anzeige der Datatilsynet)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 5 Abs. 1 lit. c; databeskyttelsesloven § 41; tv-overvågningsloven

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 350,000 DKK, converted at the ECB reference rate of 19 Dec 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An estate agency (name redacted in the publication) continuously filmed workstations and break areas with image and sound, accessible via a smartphone app, and used the software Time Doctor to record keyboard and mouse activity as well as screenshots of the computers; several people accessed this data via the administrator account of one of them. The French data protection authority (CNIL) found infringements of data minimisation, legal basis, information, security and the obligation to carry out an impact assessment, and imposed 40,000 EUR.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. c, Art. 6, 12, 13, 32, 35 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2018, attackers exploited a flaw in the ‘View As’ feature and gained access to around 29 million accounts, of which around 3 million were in the EEA. Ireland's Data Protection Commission (DPC) imposed 8 million EUR (Art. 33(3)) and 3 million EUR (Art. 33(5)) for incomplete notification and documentation, as well as 130 million EUR and 110 million EUR for infringements of data protection by design (Art. 25(1) and (2)).

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 33 Abs. 3 und 5, Art. 25 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

17 Dec 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On the loan comparison portals lainaparkki.fi and rahoitu.fi, application data (including income, housing costs, marital status, children) could be accessed by anyone who knew the personal customer link; the links were targeted by phishing and data reached third parties. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 950,000 EUR and ordered the data subjects to be notified.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 25, Art. 32

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

20 Dec 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a complaint – one of several complaints about cookie banners lodged with European data protection authorities – the Swedish Authority for Privacy Protection (IMY) found that the betting operator did not make withdrawing consent as easy as giving it and, through the misleading design of the banner (choice of colours, contrast, rejection only as a link), made informed, freely given consent more difficult. IMY issued a reprimand; ATG had since changed the banner.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 6, Art. 7 Abs. 3

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The landlord monitored a multi-family building in Malmö around the clock with cameras at entrances, lifts, flat doors, in the stairwell, the basement and the refuse room, without any legal basis for doing so; the signs did not name the controller. The Swedish Authority for Privacy Protection (IMY) imposed 200,000 SEK and ordered the landlord to stop the surveillance except in the garage and to supplement the signs.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1, Art. 13

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

12 Dec 2024

Original amount 200,000 SEK, converted at the ECB reference rate of 11 Dec 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

At least 1,000 former employees retained access after leaving to the KMD Nexus specialist system containing data on around 30,000 citizens; one former employee viewed 1,022 citizen records. In addition, an unauthorised person used an employee's login credentials for Office services containing information on around 5,000 people – both systems had been accessible from the internet for years without multi-factor authentication. The Danish data protection authority (Datatilsynet) reported the municipality to the police and proposed a fine of 350,000 to 400,000 DKK; the case is still pending before the courts, and no fine has been imposed so far.

Authority / court

Datatilsynet

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 32

Action

Other

Status of proceedings

unknown

Sector

Public sector

Published

27 Nov 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between 2018 and 2020, Netflix did not adequately inform customers about what happens to their data, and the information available was partly unclear. The Dutch supervisory authority (Autoriteit Persoonsgegevens, AP) imposed 4.75 million EUR; Netflix has since revised its privacy statement.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a i. V. m. Art. 12 Abs. 1, Art. 13 Abs. 1 lit. c, e, f und Abs. 2 lit. a, Art. 15 Abs. 1 lit. a, c, d und Abs. 2 DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

The privacy statement and the information provided were subsequently improved.

Published

18 Dec 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Without informing them, the residence permit consultancy sent a client couple’s marriage certificate and proof of salary to a sister company in Georgia for translation; the documents subsequently appeared publicly on the Scribd platform. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) imposed 2,000 EUR each for an impermissible transfer to a third country and for lack of security measures, as well as a reprimand for insufficient cooperation.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · International data transfers

Legal basis

Art. 5 Abs. 1 lit. f, Art. 31, Art. 44 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In April 2021, data on around 533 million Facebook users from 106 countries was made public, which unknown persons had previously linked to telephone numbers and harvested via the contact import function. Germany's Federal Court of Justice (Bundesgerichtshof, BGH) ruled that the mere loss of control over data already constitutes non-material damage under Art. 82 GDPR, considered around 100 EUR appropriate and referred the case back to the Higher Regional Court of Cologne (OLG Köln), among other things to examine the default searchability setting in the light of data minimisation.

Authority / court

Bundesgerichtshof (VI. Zivilsenat)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 82 Abs. 1 DSGVO

Action

Other

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

18 Nov 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The delivery platform unlawfully processed data on more than 35,000 riders: facial recognition for identity verification, location tracking even outside working hours and automated assessments without human review. Foodinho had already been sanctioned with 2.6 million EUR in 2021; in addition to 5 million EUR, the Italian data protection authority (Garante per la protezione dei dati personali) prohibited the biometric processing.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

DSGVO (u. a. Transparenz, biometrische Daten, automatisierte Entscheidungen)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Repeat case

yes

Published

22 Nov 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Customers who ordered, for example, mail forwarding automatically received an electronic OmaPosti mailbox that could not be deselected separately; they were also informed insufficiently and in part incorrectly about the activation. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found no contractual legal basis for this bundling and imposed 2.4 million EUR together with a reprimand and an order to rectify the situation. On 3 November 2025 the Helsinki Administrative Court upheld the reprimand and the order on account of the insufficient information but annulled the fine, as it considered the processing necessary for the contract on Posti’s electronic services.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 6 Abs. 1 lit. b, Art. 13, Art. 25

Action

Fine

Status of proceedings

overturned

Sector

Transport, logistics and shipping

Published

15 Nov 2024

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

As processor for a chiropractic practice, the IT service provider had encrypted backups without securing the key; after a ransomware attack in 2020, patient data including health information and CPR numbers could not be restored. The Danish data protection authority (Datatilsynet) reported the company to the police and proposed 50,000 DKK; the court sentenced it to a fine of 40,000 DKK on 12 November 2024.

Authority / court

Dänisches Gericht auf Anzeige der Datatilsynet

Area of law

Data protection · Data processors

Legal basis

Art. 32 DSGVO; Auftragsverarbeitungsvertrag

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Original amount 40,000 DKK, converted at the ECB reference rate of 12 Nov 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Untold SRL left an access request and an erasure request from a data subject unanswered, even though the data subject had provided all contact details. The Romanian data protection authority (ANSPDCP) imposed 49,741 lei (10,000 EUR) in respect of access and 24,870.5 lei (5,000 EUR) in respect of erasure and ordered staff training. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 Abs. 3 und 4, Art. 15, Art. 17 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

30 Oct 2024

Original amount 74,611.5 RON, converted at the ECB reference rate of 30 Oct 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a break-in into the district administration’s servers in which data were encrypted, services failed and social benefits were delayed. The Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found insufficient malware protection, deficient management of rights and passwords, a lack of recovery and insufficient information of data subjects and imposed 9,000 EUR. Date = publication; source: archived copy.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 lit. b, c und d, Art. 34 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

18 Oct 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A limited company operating a diagnostic laboratory (name pseudonymised), which during the pandemic carried out up to 45,000 PCR analyses a day with around 200 employees, had appointed its managing director as data protection officer at the same time. Because of the resulting conflict of interest, the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 5,000 EUR; the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection

Legal basis

Art. 37, Art. 38 Abs. 6 DSGVO

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

50 to 249

Liability of senior managers

The managing director was also appointed as data protection officer – an impermissible conflict of interest.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The cancer charity reported thefts of computers from its offices in Copenhagen and Aarhus as well as phishing attacks in 2019 and 2020; according to the Danish Data Protection Agency (Datatilsynet), at least 1,448 people were affected, some with health data. Although the organisation itself had considered multi-factor authentication necessary after an attack in 2018, this and encryption of the computers were lacking; Københavns Byret (Copenhagen City Court) issued a final judgment ordering it to pay 75,000 DKK (Datatilsynet’s recommendation and the prosecution’s request: 800,000 DKK).

Authority / court

Københavns Byret (auf Anzeige der Datatilsynet)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1; databeskyttelsesloven § 41

Action

Fine

Status of proceedings

final

Sector

Healthcare

Repeat case

yes

Original amount 75,000 DKK, converted at the ECB reference rate of 1 Oct 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a tip-off that at the Wasa Resort Spa filming was also taking place in the treatment area and for monitoring work discipline, and that cameras captured the neighbouring property, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered the hotel to suspend video surveillance until a sound balancing of interests had been submitted, to stop recording the neighbouring property and to correct the camera information on the website. The hotel had repeatedly let the supervisory authority’s deadlines lapse.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Video surveillance

Legal basis

§ 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d und f, Art. 5 Abs. 1, Art. 6 Abs. 1 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Meta stored users' passwords unencrypted in plaintext in internal systems and reported this to Ireland's Data Protection Commission (DPC) in March 2019. The DPC found infringements of the security obligations (Art. 5(1)(f), Art. 32(1)) and of the notification and documentation obligations (Art. 33(1) and (5)), and additionally issued a reprimand.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 und 5

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Mitigating circumstances

According to the DPC, the passwords were not disclosed to external third parties.

Published

27 Sep 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report