Who was sanctioned, and for what?

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

According to the sanctions disclosure of the Financial Supervisory Service (FSS, Korea's financial supervisor), the online lending platform PFC Technologies transferred the resident registration numbers of 8,497 customers to a third party without their consent on 28 September 2022 in order to calculate the error rate of a new service for mortgage customers, and received credit information on the same customers from that third party, likewise without consent (such as the address and official value of their properties); in addition, when the inspection began it had not implemented password rules against easily guessed numbers. The sanction of 17 September 2026 comprises an institutional warning, an administrative fine (과태료) of KRW 24 million and a penalty surcharge (과징금) of KRW 49 million, KRW 73 million in total.

Authority / court

Financial Supervisory Service (FSS)

Area of law

Data protection

Legal basis

Art. 19, 32 und 34 Credit Information Use and Protection Act; Art. 16, 28 und 29 Durchführungsverordnung

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

Measures against individuals are not set out here.

Published

17 Sep 2026

Original amount 73,000,000 KRW, converted at the ECB reference rate of 17 Sep 2026.

Checked against the official source on 4 Oct 2026 · Direct link

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Using credentials stolen elsewhere, attackers logged in en masse on the websites of GS SHOP (June 2024 to February 2025) and GS25 (December 2024 to January 2025) and obtained data on 1,581,025 and 79,128 people respectively; GS Retail Co., Ltd. detected neither the bursts of login attempts from the same IP addresses nor the rising number of failed attempts, and after the first discovery at GS25 did not stop the parallel attack on GS SHOP. The authority also found an inadequate data protection organisation and that 1,599 further people were notified more than 72 hours late, imposed a penalty surcharge of 12,836,000,000 KRW and an administrative fine of 3,000,000 KRW (12,839,000,000 KRW in total) and ordered detection measures and a review of the data protection organisation.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 34(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and 40% for cooperation, remediation and protective efforts (ISMS-P certification, self-regulation, privacy impact assessment); increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to deploy dedicated data protection staff and to define the powers and responsibility of its chief privacy officer (CPO) clearly.

Published

31 Aug 2026

Original amount 12,839,000,000 KRW, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Public sector

Employees

10,000 or more

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Agência Nacional de Proteção de Dados (ANPD, Brazilian data protection authority) imposed three fines totalling 153,769,671.33 BRL on ByteDance Brasil Tecnologia Ltda., which operates TikTok in Brazil (63,176,686.67 BRL each for breaches of Art. 7 and Art. 6 VIII LGPD, and 27,416,297.99 BRL for Art. 6 X LGPD). According to the decision, data of children and adolescents were processed without a valid legal basis both in the feed available without registration and when accounts were created, and effective preventive and accountability measures were lacking. The authority also ordered the deletion of data of registered adolescents aged 13 to 18 whose legal representation is not regularised within 60 working days, backed by a daily penalty of 137,081.49 BRL for each day of delay.

Authority / court

Agência Nacional de Proteção de Dados (ANPD), Superintendência de Fiscalização

Area of law

Data protection

Legal basis

Art. 6 VIII, Art. 6 X und Art. 7 LGPD (Lei nº 13.709/2018); Sanktionen nach Art. 52 LGPD; Resolução CD/ANPD nº 4/2023 (Regulamento de Dosimetria)

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Employees

10,000 or more

Published

25 Aug 2026

Original amount 153,769,671.33 BRL, converted at the ECB reference rate of 24 Aug 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Attackers obtained the credentials of a user account with administrator rights through phishing and accessed customer data. The Romanian data protection authority (ANSPDCP) criticised the lack of technical and organisational measures and of regular effectiveness testing, imposed 15,728 lei (3,000 EUR) and ordered regular employee training, including on recognising phishing e-mails. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

19 Aug 2026

Original amount 15,728 RON, converted at the ECB reference rate of 19 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Through a software vulnerability in a mail platform developed by KDDI and provided to several internet service providers, unauthorised parties obtained the credentials (email address and password) of 12,231,954 people; 7,616,173 passwords were stored in plain text, so mailboxes could be read (discovered on 17 June 2026). The authority gave KDDI guidance (shidō) under Art. 147 APPI to improve its technical security measures because access controls against attackers spreading through the system had been inadequate, required a report by 19 October 2026 and also gave such guidance to individual providers responsible for the plain-text storage.

Authority / court

Personal Information Protection Commission (PPC, 個人情報保護委員会)

Area of law

Data protection · Data breaches and data security

Legal basis

Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 147, Art. 146 Abs. 1

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

19 Aug 2026

Checked against the official source on 4 Oct 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined the online dietary supplement retailer Lab Pharma AS NOK 205,000 for breaching its duty to cooperate with the supervisory authority (Art. 31 GDPR): the company had threatened case handlers with police reports and lawsuits in order to end the investigation of a complaint, and submitted requested documents late. The authority also ordered the company to delete the name and images of a former advertising partner (an influencer) from all its websites and to stop using her data for marketing until it can demonstrate a legal basis, as the underlying contract had already expired in March 2017.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 31, Art. 58 Abs. 2 lit. f, g und i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Liability of senior managers

Datatilsynet attributed the intentional conduct of the company's management to the company.

Published

17 Aug 2026

Original amount 205,000 NOK, converted at the ECB reference rate of 12 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The UK Information Commissioner's Office (ICO) issued a reprimand to ACRO Criminal Records Office. According to the ICO, it followed a cyber incident that may have affected the personal data of around 10,000 people in the UK. The ICO found infringements of the duty to implement appropriate technical and organisational security measures under Article 32 UK GDPR. No fine was imposed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Elderly Aids Limited, a seller of call-blocking devices, £190,000 and also issued an enforcement notice. The ICO found that the company had made 758,053 unsolicited direct marketing calls to numbers registered with the TPS/CTPS whose subscribers had not agreed to such calls, leading to 20 complaints. The legal basis is regulations 21 and 24 of PECR. Under the notice, payment by 7 September 2026 reduces the amount by 20% to £152,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998 (Geldbuße), section 40 DPA 1998 (Anordnung)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Original amount 190,000 GBP, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

6 Aug 2026

Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Attackers copied certificates from lost femtocells of KT Corporation into home-made devices, stayed connected to the mobile network undetected for around eleven months, intercepted data on 16,647 subscribers (phone number, IMSI, IMEI) and used intercepted confirmation codes to trigger unauthorised mobile payments of around 240 million KRW affecting 368 people. For inadequate access control – certificates valid for ten years, no IP restriction, no detection of unknown cell IDs – the authority imposed a penalty surcharge of 53,979,000,000 KRW and ordered vulnerability checks and a stronger role for the chief privacy officer.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Sanktion nach Art. 64-2(1) Nr. 9; gesonderter Beschluss 제2026-015-094호: Art. 63(1)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for cooperation, remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to define the responsibility and role of its chief privacy officer (CPO) for the whole company clearly and to revise its governance.

Published

30 Jul 2026

Original amount 53,979,000,000 KRW, converted at the ECB reference rate of 29 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

A large-scale breach affected EETAA information systems used to implement programmes of the Ministry of Social Cohesion and Family; identification, contact, financial and health data of a large number of people were affected. The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) attributed the success of the attack to outdated systems and inadequate security measures and criticised the absence of a data processing agreement. In Decision 15/2026 it imposed a total of EUR 350,000 (ministry EUR 150,000 under Art. 5(1)(f)/Art. 32 and EUR 50,000 under Art. 28(3) GDPR; EETAA EUR 100,000 under Art. 32 and EUR 50,000 under Art. 28(3) GDPR) and ordered the agreement to be concluded and the planned security measures implemented within one month.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 28 Abs. 3, Art. 32 Abs. 1, Art. 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

According to the authority, the ministry met its breach notification and communication obligations.

Checked against the official source on 28 Sep 2026 · Direct link

The Metropolitan Police handed a defendant unredacted documents containing the new address and telephone number of a stalking victim, and in a circular e-mail disclosed 18 people with a parliamentary connection in an open recipient list. The UK Information Commissioner's Office (ICO) ordered improvements within 3 and 12 months, including in data protection training completion rates.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Data Protection Act 2018, Section 40

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Culpability

negligent

Published

5 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 34,327 EUR on a call centre that mainly marketed telecoms products: 32,000 EUR for unlawful telephone advertising and 2,327 EUR because consents to sales calls had not been fully documented. The campaign continued despite the gaps and requests to stop calling were sometimes ignored; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; § 7a UWG (Dokumentation und Aufbewahrung von Einwilligungen)

Action

Fine

Status of proceedings

under appeal

Sector

Other

Checked against the official source on 2 Oct 2026 · Direct link

The Garante (Italian data protection authority) fined TIM 9,516,000 EUR because call centres outside the official sales network made promotional calls on the company's behalf using numbers not recorded in the operators' register ROC or falsified numbers (spoofing), often to lines entered in the do-not-call register, and the contacts obtained in this way reached its systems as apparently lawful leads via fictitious call-back requests on sales partners' web forms. The authority found that TIM had selected and supervised its sales partners inadequately and had systematically failed to answer, or answered late, requests for access, erasure and objection. In addition, TIM must secure its lead process, strengthen oversight of the sales chain and adapt its procedures for data subject rights.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 12, 15–22, 24, 25, 28 und 32 DSGVO; Art. 130 Codice in materia di protezione dei dati personali (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Taken into account as mitigating: short period and limited number of data subjects, measures taken during the proceedings (including checks on and termination of contracts with partners), a high level of cooperation, no special categories of personal data, adherence to the telemarketing code of conduct and substantial investment in controlling the sales chain.

Published

31 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined the IT and engineering consultancy EXTIA EUR 300,000 because, of 265 erasure requests received in 2024 – mostly from job applicants, occasionally from former employees – 12 were not processed at all and 166 applicants were not told of the outcome; 27 received their reply only after the one-month deadline. The CNIL regarded this as particularly negligent, especially as the company had already been reminded of its obligations by the CNIL twice in 2024 (Art. 12 and 17 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 und 17 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

negligent

Repeat case

yes

Mitigating circumstances

During the proceedings the company deleted the data concerned and informed the applicants retrospectively.

Published

9 Sep 2026

Checked against the official source on 2 Oct 2026 · Direct link

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

Authority / court

Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)

Area of law

Data protection · Employee data

Legal basis

Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

7 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined the US operator of the generative AI service Character.AI, on which users – including minors – chat with virtual characters, 158,000 EUR, among other things for deficient privacy information, a data protection impact assessment prepared late and the late appointment of a representative in the EU. It also criticised weaknesses in the protection of minors and in age verification; within 120 days the company must ensure working age verification, an effective cooling-off period preventing blocked minors from re-registering and private-by-default profiles for minors.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 2, 12 Abs. 1, 13 Abs. 1 und 2, 14 Abs. 1 und 2, 24 Abs. 1, 25 Abs. 2, 27 Abs. 1 und 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

no

Mitigating circumstances

Mitigating: progressively strengthened age checks (a dedicated service for minors, age verification by a third-party provider), no previous relevant infringements, cooperation and amendments to the privacy policy during the proceedings.

Published

9 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

At the request of a third party and outside the scope of his duties, a bank employee retrieved account statements of a data subject (name, IBAN, transactions, balances). The Romanian data protection authority (ANSPDCP) found insufficient technical and organisational measures and imposed 26,172 lei (5,000 EUR); the bank has paid the fine. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1, 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

2 Jul 2026

Original amount 26,172 RON, converted at the ECB reference rate of 2 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In a targeted inspection of cookies on company websites, the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) found fault with the site 4mebeles.lv. After a reprimand in February 2026, the company claimed that the deficiencies had been remedied, which a further inspection disproved; further requests for information went unanswered. The DVI imposed 1,000 EUR for failure to cooperate and requested the missing information by 3 August 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Cookies and tracking

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

After almost four years of litigation, the federal district court for Idaho entered an order agreed between the FTC and the data broker Kochava. The FTC had alleged that Kochava sold precise location data from hundreds of millions of mobile devices without the knowledge and consent of the people concerned, revealing, for example, visits to health facilities and places of worship. Kochava and its subsidiary Collective Data Solutions, which has taken over the data broker business, may only share sensitive location data with affirmative consent and for services requested by the consumer, and must introduce, among other things, a sensitive-locations programme, checks on their data suppliers, disclosure of recipients and retention limits; no payment is provided for. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. District Court for the District of Idaho auf Klage der Federal Trade Commission (FTC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Section 5 FTC Act, 15 U.S.C. § 45 (unlautere Praktiken); Verfahren nach Section 13(b), 15 U.S.C. § 53(b)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

26 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

Authority / court

Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)

Action

Fine

Status of proceedings

reduced

Sector

Other

Culpability

negligent

Mitigating circumstances

Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The debt collection company posted personal data of alleged debtors on the internet, some of it particularly sensitive, in order to obtain information on their whereabouts and to warn third parties. The Swiss Federal Administrative Court (Bundesverwaltungsgericht, A-3891/2025) upheld the ruling of the Federal Data Protection and Information Commissioner (EDÖB) of 28 April 2025, according to which this constitutes an unjustified violation of privacy.

Authority / court

Bundesverwaltungsgericht (A-3891/2025) auf Verfügung des EDÖB vom 28.04.2025

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSG Art. 6, Art. 19, Art. 31

Action

Order

Status of proceedings

final

Sector

Financial services and insurance

Published

20 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1

Action

Reprimand or warning

Status of proceedings

final

Sector

Defence and security

Checked against the official source on 25 Sep 2026 · Direct link

An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Video surveillance

Legal basis

Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

15 Jun 2026

Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The online retailer had not set a retention period for customer accounts and kept data until customers requested deletion; purchases were only possible with an account. The sanctions board of the Finnish Data Protection Ombudsman imposed 856,000 EUR in 2024, the administrative court reduced the fine to 792,639 EUR on the basis of current turnover, and the Supreme Administrative Court (Korkein hallinto-oikeus, KHO) confirmed this on 12 June 2026.

Authority / court

Korkein hallinto-oikeus (KHO); Sanktionsgremium des Datenschutzbeauftragten

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Retail and e-commerce

Published

18 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

A data subject complained about the disclosure of footage from the supermarket chain’s video surveillance and about the inadequate response to his access request. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that Market In had passed the video footage to the judicial authorities without informing the data subject beforehand, processed more data than necessary, failed to comply with the right of access and failed to cooperate with the authority, and by Decision 10/2026 imposed a total of 95,000 EUR (50,000 EUR for lawfulness/transparency, 20,000 EUR each for data minimisation and the right of access, 5,000 EUR for failure to cooperate); in the same proceedings, ΜΕΔΕ ΑΕ received 65,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, Art. 5 Abs. 2, Art. 12, 13, 15, 31 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Checked against the official source on 25 Sep 2026 · Direct link

Monash IVF collected sensitive information about visitors to its fertility treatment website through third-party tracking pixels. The Privacy Commissioner held that following the visitors of health-related websites and afterwards showing them targeted adverts on social networks amounts to collecting sensitive data, which requires consent, and found breaches of APP 3.3, 5.1, 5.2 and 7.1. Monash IVF must not continue or repeat the conduct and must implement specified remedial steps; a parallel determination against the telehealth provider Medmate Australia was made on the same day.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Cookies and tracking

Legal basis

Privacy Act 1988 (Cth), APP 3.3, 5.1, 5.2, 7.1

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

24 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

A former employee used authentication signing keys that had been accessible to him in plain text during his employment and were neither renewed nor destroyed after he left to create forged tokens and, from April to November 2025, retrieve data on around 33.22 million customers and delivery data on around 4.33 million other people. For inadequate security measures the authority imposed a penalty surcharge of 423,575,000,000 KRW on Coupang Corp. and, for late notification and failure to delete, an administrative fine of 16,800,000 KRW (423,591,800,000 KRW in total) and criticised the exclusion of the chief privacy officer from the internal investigation. A separate decision on the same day imposed a further 201,106,000,000 KRW for collecting behavioural data on third-party websites and apps without consent.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 34(1), Art. 21(1), Art. 31(6), Art. 63(2); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Reduction of 30% because no benefit was derived and 50% for remediation, compensation, certification and proportionality; increases of 25% (duration of the infringement), 30% (at least two previous penalties) and 10% (obstruction of the investigation).

Liability of senior managers

The chief privacy officer (CPO) was excluded from the internal investigation and publication; the company was ordered to set up governance that secures the CPO’s independent work and access to information in incidents.

Published

11 Jun 2026

Original amount 423,591,800,000 KRW, converted at the ECB reference rate of 10 Jun 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In November 2018 attackers encrypted patient data in the laboratory information system of Midlands Regional Hospital Tullamore. The DPC found that the HSE had infringed Art. 5(1)(f), 28, 30, 32(1) and 34 GDPR (including insufficient security, deficient processor contracts and record of processing, and incomplete notification of affected persons), issued a reprimand, imposed €300,000 for the security failings (Art. 5(1)(f) and 32(1)) and ordered it to introduce specified policies and procedures for secure processing.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 28, 30, 32(1), 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 2 Oct 2026 · Direct link

In 2019, the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) had imposed 14.5 million EUR on the housing group because tenant data such as salary statements, bank statements and social security data were held in an archive system with no means of deletion. Following the 2023 CJEU judgment on direct corporate liability, the Berlin Regional Court (Landgericht Berlin I) confirmed on 9 June 2026 infringements of data minimisation and storage limitation; the press release does not state the amount of the fine set by the court.

Authority / court

Landgericht Berlin I (Bußgeldbehörde: Berliner Beauftragte für Datenschutz und Informationsfreiheit)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5, Art. 25 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Liability of senior managers

According to the CJEU (C-807/21), a breach of duty by a person in a management position need not be proven for the corporate fine.

Published

10 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Due to errors by a processor of the energy supplier, incorrect details of a direct debit mandate were recorded, so that three bills instead of one were debited from the customer's account; call recordings and the mandate form had not been retained. ZENITH responded inadequately to the access request and did not correct the data (100,000 EUR), while Piraeus Bank infringed the right of access (10,000 EUR and a reprimand); Decision No. 8/2026 of the Hellenic Data Protection Authority.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. d, Art. 12 Abs. 3, Art. 15, Art. 28 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

According to the complaint by the US Federal Trade Commission (FTC), Illuminate promised schools data security but did not adequately protect its cloud databases, even though a service provider had pointed out vulnerabilities almost two years earlier; a hacker accessed data on 10.1 million students, including health information. The order requires an information security programme, data minimisation and a public deletion schedule, and prohibits misrepresentations about security and notification deadlines.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Data breaches and data security

Legal basis

FTC Act (Verbot unlauterer und irreführender Praktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined Elkjøp Nordic AS and Elkjøp Norge AS NOK 20,000,000. Following an on-site inspection in June 2022, the authority found that consent for the customer club was neither informed nor specific nor freely given, that club data had been reused without a legal basis for the 'kundematch' (customer match) tool, that the lawfulness of so-called offline conversions had not been assessed and documented, and that rectification requests had not been handled within the deadlines. The decision was adopted under the cooperation mechanism with the supervisory authorities of Sweden, Iceland, Finland and Denmark; more than six million club members across the Nordic countries were affected.

Authority / court

Datatilsynet

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 i. V. m. Art. 4 Nr. 11, Art. 6 Abs. 4, Art. 5 Abs. 2 i. V. m. Art. 5 Abs. 1 lit. a, Art. 12 Abs. 3 DSGVO; Art. 58 Abs. 2 lit. i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Improvements made after the inspection, Datatilsynet's long case-handling time and the lack of evidence that sensitive data were processed; the amount is well below the starting point in the EDPB guidelines (0.4–0.8% of group turnover).

Published

4 Jun 2026

Original amount 20,000,000 NOK, converted at the ECB reference rate of 1 Jun 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and issued an enforcement notice. After executing a search warrant in April 2025, the regulator found that between October 2024 and March 2025 the company had instigated 575,062 unsolicited marketing calls to numbers that had been on the TPS register for more than 28 days. There were 132 complaints. The legal basis is regulations 21 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 240,000 GBP, converted at the ECB reference rate of 28 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

On 7 November 2025, the publisher's news portals Origo and Magyar Nemzet linked to a map, created by unknown persons, containing the names, addresses, telephone numbers, email addresses, geo-coordinates and political preferences of Tisza sympathisers; Ripost showed an image with the name of the map. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found intentional infringements of Art. 6 and 9 GDPR, prohibited further dissemination and imposed 50 million HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection

Legal basis

DSGVO Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 58 Abs. 2 lit. b und f

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Culpability

intentional

Published

26 May 2026

Original amount 50,000,000 HUF, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In September 2022 the public TVET college mistakenly emailed reports verifying the qualifications and criminal records of three employees to other staff, informed neither the regulator nor those affected, and had not registered an information officer. Departing from the view of its Enforcement Committee, the regulator also treated this as impermissible further processing and found breaches of accountability, purpose limitation, security safeguards and the notification duty; on 22 May 2026 it ordered, among other things, registration, notification of the breach, a written apology, a compliance framework and POPIA training for all staff.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Employee data

Legal basis

Sections 8, 15(1), 19(1) und 22(1) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA

Action

Order

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The college recalled the email two days later, informed staff of the error and took action against those responsible; according to the regulator, this did not relieve it of the duty to notify.

Published

2 Jun 2026

Checked against the official source on 4 Oct 2026 · Direct link

The ICO fined a UK marketing company £300,000 and issued an enforcement notice. The ICO found that the company had sent more than 5.5 million unsolicited marketing text messages, including messages styled as if they came from bailiffs. The 7726 spam reporting service received over 60,000 complaints. The ICO relied on regulations 22 and 23 of PECR (electronic marketing without consent and concealed sender identity).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 22 und 23 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 300,000 GBP, converted at the ECB reference rate of 20 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO (Integrität und Vertraulichkeit, Art. 32)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Walloon water utility recorded and listened in on customer calls for quality control and training purposes; the Litigation Chamber of the Autorité de protection des données (Belgian Data Protection Authority, APD/GBA) found infringements of transparency and fairness as well as in the engagement of a sub-processor. It imposed two fines totalling 86,000 EUR (85,000 + 1,000) after reducing the amounts in view of the situation of the public utility; an appeal against the decision has been lodged with the Market Court.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13, Art. 28 Abs. 3

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

Fraudsters in possession of customer data posed as customers at the bank's ‘Open24’ call centre, had account details changed and obtained further information because security protocols were not followed; those affected had to close accounts, and some suffered losses. Ireland's Data Protection Commission (DPC) imposed 250,000 EUR for inadequate security and 27,500 EUR for late breach notification (decision served in the week before the press release).

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1, Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

8 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

In 2020, malware entered the water supplier's network via a phishing e-mail and remained undetected for around 20 months; in 2022, attackers obtained administrator rights and stole data on 633,887 people, which ended up on the dark web. The UK Information Commissioner's Office (ICO) criticised, among other things, monitoring of only 5% of the IT environment, outdated software such as Windows Server 2003 and a lack of vulnerability and patch management.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Energy and utilities

Culpability

negligent

Mitigating circumstances

40% reduction for early admission of liability; payment agreed without appeal.

Published

11 May 2026

Original amount 963,900 GBP, converted at the ECB reference rate of 7 May 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Since 2020, the Canada Revenue Agency (CRA) has experienced more than 42,000 individual breaches in which unauthorised persons accessed tax accounts or changed data in order to redirect benefits. In a special report to Parliament, the Privacy Commissioner of Canada criticised, among other things, the delayed introduction of mandatory MFA and incomplete incident recording, and made nine recommendations, eight of which were accepted in full and one in part.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act (Kanada)

Action

Other

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

7 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Although the Information and Data Protection Commissioner (IDPC) had already ruled in favour of a complainant, an insurance company (name redacted) again had him called for marketing purposes via a third-party company; his number remained on call lists. The IDPC criticised the lack of safeguards and inadequate contracts with processors, ordered remedial action within 20 days and imposed two fines totalling 1,000 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 2, Art. 21 Abs. 2, Art. 24 Abs. 1, Art. 28 Abs. 3 i. V. m. Art. 58 Abs. 2 lit. b, d, i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

A processor of Berlin's public transport operator BVG, which had sent customer letters in early 2025, was hacked; around 180,000 customer records were affected, although they should long since have been deleted after the end of the contract. BVG had never checked the deletion, had not agreed any procedure for data breaches in the data processing agreement and reported the incident only after the 72-hour deadline had expired; the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI) issued a reprimand.

Authority / court

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 2 i. V. m. Abs. 1 lit. c, e, f, Art. 28 Abs. 3 S. 2 lit. f, Art. 32 Abs. 1, Art. 33 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Mitigating circumstances

BVG has announced measures against similar incidents.

Published

4 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

In a ransomware attack on the membership management system of Yau Yat Chuen Garden City Club Limited, a private, non-profit recreational club, reported on 31 October 2025, data of 9,045 current and former members and supplementary card holders were affected, including identity card or passport numbers. The attacker exploited a known vulnerability in outdated remote access software of the external service provider and reached the server, which had been left logged in, without further authentication; antivirus software and firewall were outdated, and personal data had been kept longer than necessary. In its investigation report published on 23 April 2026 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of DPP 4(1) and DPP 2(2) and served an enforcement notice.

Authority / court

Privacy Commissioner for Personal Data (PCPD), Hongkong

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data (Privacy) Ordinance, Data Protection Principles 4(1) und 2(2); Enforcement Notice

Action

Order

Status of proceedings

unknown

Sector

Other

Published

23 Apr 2026

Checked against the official source on 3 Oct 2026 · Direct link

The ICO issued an enforcement notice to a UK company. The ICO found that the company had instigated calls about claims management services without the consent of the people called. Under regulation 21A of PECR such calls are only permitted with prior consent; the ICO also found a breach of regulation 24. The notice is an enforcement notice and does not impose a fine.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21A und 24 PECR; section 40 DPA 1998

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Both companies continued to use e-mail addresses and telephone numbers from online purchases for advertising, although data subjects had objected – in some cases after deletion had been confirmed. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) ordered the processing for advertising to cease and the data to be deleted on request.

Authority / court

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)

Area of law

Data protection · Marketing and consent

Legal basis

DSG Art. 6, Art. 30 Abs. 2 lit. b, Art. 31

Action

Order

Status of proceedings

final

Sector

Retail and e-commerce

Published

26 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A provider of public utility services used GPS transmitters in company vehicles to record employees’ location data permanently and without cause, without defining a purpose, carrying out a balancing of interests or providing sufficient information. The Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP) imposed 6,000 EUR on the company.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Liability of senior managers

Measures against individuals are not reported here.

Published

15 Apr 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The publisher kept data of around 685,000 former book club members in a ‘passive database’, in around 395,000 cases more than ten years after they had left, without any deletion rules. The Danish Data Protection Agency (Datatilsynet) had recommended a fine of 1 million DKK in 2022; the case was closed on 14 April 2026 with a fine notice whose amount is not stated in the source.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection

Legal basis

DSGVO Art. 5 Abs. 1 lit. e, Art. 5 Abs. 2

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Mitigating circumstances

Cooperative conduct; only two employees had access to the passive database; deletion after the supervisory visit.

Checked against the official source on 25 Sep 2026 · Direct link

An employer installed the software Spyrix Employee Monitoring on the work computers of individual employees, which for months recorded screen content, audio and even private e-mails and conversations without informing the employees. The supervisory authority, the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP), imposed 71,474 EUR on the company.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Liability of senior managers

Measures against individuals are not reported here.

Published

9 Apr 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Amsterdam-based Ridetech offered the ride-hailing app Yango in Finland and Norway and transferred data of drivers and customers to the group companies Yandex.Taxi LLC and Yandex LLC in Russia without demonstrating appropriate safeguards. The Autoriteit Persoonsgegevens (Dutch Data Protection Authority, AP) imposed 100 million EUR on the legal successor and prohibited further transfers to Russia.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · International data transfers

Legal basis

Art. 44, Art. 46 iVm Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Checked against the official source on 25 Sep 2026 · Direct link

The Privacy Commissioner found that the rental application platform 2Apply collected more personal information than necessary from March 2020 to March 2025, such as gender, student status, citizenship, visa expiry and previous living arrangements, and did so unfairly through design techniques such as “confirmshaming”, biased framing and bundled consent. The determination requires IRE to stop this collection within 60 days, engage an independent reviewer and report to the OAIC within twelve months on implementing the recommendations.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

APP 3.2 und APP 3.5 (Privacy Act 1988 (Cth)); Feststellungen nach s 52(1A)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

IRE adapted its collection practices during the investigation without admitting a breach.

Published

22 Apr 2026

Checked against the official source on 3 Oct 2026 · Direct link

The management corporation of the Riverfront Residences condominium had not designated a data protection officer until March 2025, had no data protection policies of its own and had given its managing agent, which acted for it as a data intermediary, no instructions on handling personal data; in April 2025 an employee of the managing agent mistakenly sent the names, addresses and maintenance fee details of two owners to another owner. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found breaches of the Accountability Obligation and the Protection Obligation; by contrast, it found no breach in the circulation of a requisition for an extraordinary general meeting bearing the names and signatures of 303 owners, because strata management law prevailed. It directed the corporation to introduce, within 90 days, policies and procedures for the processing of data by the managing agent and to communicate them to it; the managing agent itself had given a voluntary undertaking.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Sections 11(3) und 12(a) PDPA 2012 (Accountability Obligation); Section 24 i. V. m. Section 4(3) PDPA (Protection Obligation bei Einsatz eines Data Intermediary)

Action

Order

Status of proceedings

unknown

Sector

Construction and real estate

Published

7 May 2026

Checked against the official source on 4 Oct 2026 · Direct link

The ICO fined Energy Prices Direct Limited, an energy switching broker, £160,000. The ICO found that the company had obtained contact details from public sources and list providers and did not screen them against the TPS/CTPS registers before making marketing calls. The legal basis is regulations 21 and 24 of PECR. Under the notice, timely payment reduces the amount by 20% to £128,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Original amount 160,000 GBP, converted at the ECB reference rate of 30 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In an attack on an application operated by a processor, data of a very large number of persons (including personal identification numbers, driving licence and identity card numbers, vehicle identification numbers) were stolen and published. The Romanian data protection authority (ANSPDCP) criticised the lack of security measures and effectiveness testing as well as the selection of a service provider without sufficient guarantees and imposed 637,262.50 lei (125,000 EUR).

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data processors

Legal basis

Art. 32 Abs. 1 lit. b und d, Abs. 2 i. V. m. Art. 28 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Published

25 Mar 2026

Original amount 637,262.5 RON, converted at the ECB reference rate of 25 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

A person complained that Fitsypro had not responded to their request for access, rectification and erasure of November 2023. Three requests for information from the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) between 2024 and 2026 went unanswered, and nobody attended the hearing. The DVI imposed 1,500 EUR and requested the information by 21 April 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 58 Abs. 1 lit. e, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Checked against the official source on 25 Sep 2026 · Direct link

In December 2024 the Kolding City Court fined the Region Syddanmark (Region of Southern Denmark) 1,000,000 DKK for two breaches of the duty to ensure appropriate data security. On 23 March 2026 the Vestre Landsret (Western High Court) upheld only the first charge – in a research and clinical database, logged-in users could access PDF documents of more than 23,000 registered persons, including health data of minors in psychiatric care, by changing the URL – and reduced the fine to 500,000 DKK; it acquitted the region of the charge concerning patient data in a presentation on its website.

Authority / court

Retten i Kolding; Vestre Landsret (auf Anzeige der Datatilsynet)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1, Art. 83 Abs. 4 lit. a und Abs. 9 DSGVO; databeskyttelseslovens § 41 stk. 1 nr. 1, stk. 3 og 6

Action

Fine

Status of proceedings

reduced

Sector

Public sector

Culpability

negligent

Repeat case

yes

Original amount 500,000 DKK, converted at the ECB reference rate of 23 Mar 2026.

Checked against the official source on 28 Sep 2026 · Direct link

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Singtel Optus asked customers who ported their number to Optus whether they wanted to appear in the phone directory, but between October 2015 and September 2019 it did not act on requests for an unlisted number, so that 41,278 affected customers remained published in the White Pages. The Privacy Commissioner found a breach of APP 11.1 because Optus did not remove a risk of errors it had been aware of throughout the period with reasonable steps such as regular system reconciliations, and declared that the company must not repeat this conduct. The regulator intends to decide on compensation separately in a representative complaint concerning the same conduct.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 1988 (Cth) s 13(1), APP 11.1; Erklärung nach s 52(1A)(a)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

11 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

Following a cyber attack in spring 2025 in which data of about 375,000 current and 540,000 former customers was exfiltrated, including bank account, driver's licence and social insurance numbers, Nova Scotia Power signed a compliance letter to the Privacy Commissioner of Canada. The company commits to delete customers' social insurance numbers and, by 31 October 2026, to submit an independent security assessment – including employee training and notification processes – and to report on implementing its recommendations; only then will the investigation be discontinued. According to the letter, the starting point was an employee clicking a link in a pop-up on a compromised website, which installed malware.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection and Electronic Documents Act (PIPEDA); Einstellung nach Paragraph 12.2(1)(c) bei Erfüllung der Zusagen

Action

Other

Status of proceedings

unknown

Sector

Energy and utilities

Published

25 Mar 2026

Checked against the official source on 3 Oct 2026 · Direct link

In March 2026 the ICO fined a small UK direct marketing company £130,000 and also served an enforcement notice. According to the ICO, over almost eleven months in 2024 the company had staff make more than 230,000 marketing calls to lines that had been on the UK's opt-out register for sales calls (Telephone Preference Service, TPS) for over 28 days, prompting 12 complaints. The ICO treated this as a breach of regulation 21 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 130,000 GBP, converted at the ECB reference rate of 12 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2021, the Luxembourg data protection authority (CNPD) had imposed 746 million EUR and an order to bring processing into compliance on account of behavioural online advertising; the Administrative Tribunal (Tribunal administratif) confirmed this on 18 March 2025. On 12 March 2026, the Administrative Court (Cour administrative) confirmed that legitimate interest was not a sound legal basis and that the information was insufficient, but annulled the fine on the basis of more recent CJEU case law on the requirement of culpability; the CNPD is re-examining the sanction.

Authority / court

Cour administrative (Luxemburg); Verfahren der CNPD

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. f, Art. 12 ff. DSGVO

Action

Order

Status of proceedings

overturned

Sector

Retail and e-commerce

Employees

10,000 or more

Mitigating circumstances

Amazon had implemented the compliance order before the hearing.

Checked against the official source on 25 Sep 2026 · Direct link

In February 2023 there was external, unauthorised access to a system operated by a processor containing data on users and employees. As lead authority, the AEPD imposed 650,000 EUR for breaching Art. 5(1)(f) GDPR, dropped the charges under Art. 32 and 34 and ordered appropriate security measures within six months. The amount and the facts have not been confirmed against the primary source.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

The Montreal-based World Anti-Doping Agency (WADA), a foundation under Swiss private law, entered into a compliance agreement under PIPEDA with the Privacy Commissioner of Canada, under which an investigation opened in November 2024 following a complaint is held in abeyance and will be discontinued once the agreement is fulfilled. WADA must ensure that anti-doping organisations use athletes' personal information in the ADAMS system only for anti-doping purposes from 1 January 2027, amend the World Anti-Doping Code and the ADAMS agreements accordingly, document a control mechanism and report quarterly. WADA disputes any contravention and the Commissioner's jurisdiction; if it fails to comply, the Commissioner may apply to the Federal Court for an order.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection

Legal basis

Personal Information Protection and Electronic Documents Act (PIPEDA), Sections 17.1 und 17.2 (Compliance Agreement)

Action

Other

Status of proceedings

unknown

Sector

Other

Published

17 Mar 2026

Checked against the official source on 3 Oct 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) fined a company marketing financial and insurance products 50,000 EUR for unlawful telephone advertising. The calls were particularly intrusive, callers falsely claimed to be an independent advice centre and presented sales calls as service calls; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Checked against the official source on 2 Oct 2026 · Direct link

During a wave of boycotts in 2024, Loblaw did not process deletion requests in time and retained purchase and usage data from the loyalty programme (more than 17 million members) even after accounts were closed, without demonstrating effective anonymisation. Loblaw undertook to the Office of the Privacy Commissioner of Canada (OPC) to have the anonymisation independently reviewed and to carry out annual deletions.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

PIPEDA

Action

Other

Status of proceedings

unknown

Sector

Retail and e-commerce

Employees

10,000 or more

Published

5 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Despite repeated follow-ups by the trade union, the cleaning company did not respond to a union member’s access request and also failed to comply with the order of the Danish Data Protection Agency (Datatilsynet) to decide on the request. Datatilsynet reported the company; the case was closed on 2 March 2026 with a fine notice of 60,000 DKK.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15; Nichtbefolgung einer Anordnung der Datatilsynet; databeskyttelsesloven

Action

Fine

Status of proceedings

final

Sector

Other

Original amount 60,000 DKK, converted at the ECB reference rate of 2 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following six complaints, the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found that the company did not provide a copy to customers who requested recordings of their sales calls in order to dispute invoices, offering only to let them listen via customer service, and in some cases deleted recordings. In addition to a reprimand, a fine of 5,000 EUR was imposed.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15 Abs. 1 und 3

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

25 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

During an inspection at the Passo Corese logistics centre (around 1,800 employees), the Garante (Italian data protection authority) found that, after return-to-work interviews, information on illnesses, participation in strikes, trade union activities and family circumstances of employees – irrelevant to their professional aptitude – was recorded in free-text fields of a platform linked to time recording and accessible to many managers. With immediate effect it ordered the definitive restriction of processing of these entries – also at all other sites using the platform – and of four cameras at the entrances to toilets and break areas; the investigation was continuing.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, c und e, Art. 6, 9 und 88 DSGVO; Art. 113 Codice privacy (D.Lgs. 196/2003); Maßnahme nach Art. 58 Abs. 2 lit. f DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Published

24 Feb 2026

Checked against the official source on 28 Sep 2026 · Direct link

The ICO fined Reddit, Inc. £14,472,500. The regulator found that the platform did not use any robust age assurance and therefore had no lawful basis for processing the personal data of children under 13. The ICO also found that Reddit had not carried out a data protection impact assessment on the risks to children before January 2025. The ICO found infringements of Articles 5(1)(a), 6, 8 and 35 UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155 DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 14,472,500 GBP, converted at the ECB reference rate of 23 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to the City of London Police. The ICO found that between 1 April 2023 and 31 July 2025 the police force had failed to answer subject access requests within the statutory deadline. The ICO found this breached Article 12(3) UK GDPR and section 45(3) of the Data Protection Act 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 45(3) DPA 2018; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Since 2019, the delivery platform had required scans or photos of its users’ identity cards and passports in cases of suspected fraud, relying on legitimate interests. The Prezes Urzędu Ochrony Danych Osobowych (President of Poland’s data protection authority, UODO) regarded this as processing without a legal basis and a breach of data minimisation, imposed 5,898,064 PLN and ordered the processing to stop and the data to be erased.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 5 Abs. 2, Art. 6 Abs. 1 DSGVO (DKN.5112.33.2022)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

16 Mar 2026

Original amount 5,898,064 PLN, converted at the ECB reference rate of 19 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

An estate agency (name not published) kept 11,887 brokerage contracts from 2010 to 2019, together with 914 copies of identity cards, passports and bank cards, without a legal basis, although the managing director stated that no card copies were collected. The Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) also criticised irregular and inadequate data protection training for employees and imposed 100,000 EUR (date of publication; exact date of the decision not stated).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. c und e, Art. 6 Abs. 1, Art. 32 Abs. 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Culpability

negligent

Mitigating circumstances

No damage to data subjects was found.

Published

19 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.

Authority / court

Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Area of law

Data protection · Data breaches and data security

Legal basis

Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1

Action

Other

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.

Published

18 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Disney implemented objections to the sale and sharing of data only for individual services or devices rather than across the whole account, continued to disclose data via embedded ad-tech providers and offered no opt-out in connected TV apps. It was the largest CCPA settlement at the time of the agreement with the Attorney General of California.

Authority / court

Attorney General of California (California Department of Justice)

Area of law

Data protection · Cookies and tracking

Legal basis

California Consumer Privacy Act (CCPA)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Published

11 Feb 2026

Original amount 2,750,000 USD, converted at the ECB reference rate of 11 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The UODO (Urząd Ochrony Danych Osobowych, Polish data protection authority) fined the parcel carrier DPD Polska sp. z o.o. a total of PLN 11,461,030. PLN 6,251,471 relates to the company using external hauliers for shipments between its depots without a data processing agreement under Art. 28(3) GDPR, although they had access to the address labels during loading and unloading; PLN 5,209,559 relates to staff not being given effective authorisations to process data and the company's own data protection policy not being implemented (Art. 24, 29, 32 GDPR). The authority classed both infringements as intentional and treated earlier reprimands against the company as aggravating. The decision is not final.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data processors

Legal basis

Art. 28 Abs. 3 i. V. m. Art. 5 Abs. 1 lit. a und Abs. 2 DSGVO; Art. 24 Abs. 1 und 2, Art. 29, Art. 32 Abs. 1 und 4 i. V. m. Art. 5 Abs. 1 lit. f und Abs. 2 DSGVO; Art. 83 Abs. 4 lit. a und Abs. 5 lit. a DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

intentional

Repeat case

yes

Mitigating circumstances

It was treated as mitigating that, after the proceedings were opened, DPD amended its contracts with the hauliers to include data processing terms and changed its procedure for granting authorisations.

Liability of senior managers

No personal liability was established.

Published

23 Feb 2026

Original amount 11,461,030 PLN, converted at the ECB reference rate of 5 Feb 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The ICO fined MediaLab.AI, Inc., which operated the Imgur platform in the UK until 30 September 2025, £247,590. The ICO found that Imgur admitted children under 13, stated to be under parental supervision, and relied on consent as its lawful basis, but it had no way of establishing users' ages and therefore of obtaining the required parental consent. The ICO therefore found there was no valid lawful basis and also found that no data protection impact assessment had been carried out (Articles 5(1)(a), 6, 8 and 35 UK GDPR).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 5(1)(a), 6, 8 und 35 UK GDPR; section 155(1)(a) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Media and online platforms

Original amount 247,590 GBP, converted at the ECB reference rate of 4 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Ten municipalities (Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal and Zoetermeer) had received, stored and used analyses of the local Islamic community prepared by an external research firm (mostly so-called power-field analyses, in Haarlemmermeer a quick scan), which also contained information on the religion and other sensitive characteristics of individuals. On 3 February 2026 the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed 25,000 EUR on each board in separate decisions (250,000 EUR in total); for seven municipalities it also restricted further processing of the analyses to handling data subject rights and court proceedings.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection

Legal basis

Art. 5 Abs. 1 lit. a i. V. m. Art. 6 Abs. 1 und Art. 9 Abs. 1 DSGVO (AVG); Verarbeitungsbeschränkung nach Art. 58 Abs. 2 DSGVO (sieben Bescheide)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

5 Feb 2026

Checked against the official source on 2 Oct 2026 · Direct link

The ICO fined TMAC Ltd £100,000 and issued an enforcement notice. The ICO found that between 8 February and 24 September 2024 the company made 260,332 unsolicited marketing calls to numbers registered with the Telephone Preference Service (TPS). Recipients were also not given the caller details required by regulation 24 of PECR. The legal basis is regulations 21 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21(1)(b) und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 100,000 GBP, converted at the ECB reference rate of 3 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The provider of management software and an app for sports clubs suffered a data exfiltration by an external attacker in January 2025. The Swedish Authority for Privacy Protection (IMY) found that no appropriate technical and organisational security measures were in place before and at the time of the incident, even though the data processed related predominantly to children and also included health information (allergies, disabilities), and imposed 6 million SEK; in setting the amount it took into account the 2024 group turnover of the Lime group (around 685.7 million SEK).

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Prompt and comprehensive information of the clubs and data subjects after the incident; support for around 1,700 clubs in filing their notifications within 72 hours.

Published

26 Jan 2026

Original amount 6,000,000 SEK, converted at the ECB reference rate of 26 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

29 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).

Authority / court

Datenschutzbehörde

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13

Action

Fine

Status of proceedings

under appeal

Sector

Other

Employees

Under 50

Mitigating circumstances

No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.

Checked against the official source on 25 Sep 2026 · Direct link

An Excel file containing data from medical certificates of current and former employees was repeatedly circulated within the company; the company reported the incident itself. The Romanian data protection authority (ANSPDCP) imposed 25,455 lei (5,000 EUR) for breach of data minimisation and accountability and 50,911 lei (10,000 EUR) for insufficient security measures and ordered a monitoring and control procedure. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c und Abs. 2, Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Published

19 Jan 2026

Original amount 76,366 RON, converted at the ECB reference rate of 19 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined the time-recording system provider Timegrip AS NOK 250,000 because, after a retail chain went bankrupt, the company refused 80 former employees access to their clock-in data, which they needed to document their wage claims. The authority treated Timegrip as controller, since after the bankruptcy the company alone in fact decided on storage, use and access, and found a breach of the right of access under Art. 15(1) and (3) GDPR. A fine of NOK 750,000 had been notified; the authority took into account, among other things, the confused situation and its own long case-handling time.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 15 Abs. 1 und 3, Art. 58 Abs. 2 lit. i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Mitigating circumstances

The confused situation after the customer's bankruptcy (given only limited weight) and Datatilsynet's long case-handling time; NOK 750,000 had been notified.

Published

20 Jan 2026

Original amount 250,000 NOK, converted at the ECB reference rate of 16 Jan 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The ICO fined Allay Claims Ltd £120,000 and issued an enforcement notice. The ICO found that the company had sent a large volume of unsolicited text messages promoting services to reclaim tax on PPI refunds; the enforcement notice gives the period as 1 February 2023 to 13 February 2024. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Original amount 120,000 GBP, converted at the ECB reference rate of 15 Jan 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The FTC finalised its order against General Motors and OnStar. According to the authority, GM used a misleading enrolment process to sign customers up for the OnStar service and the Smart Driver feature, collected precise location and driving behaviour data from millions of vehicles and sold it to third parties, including consumer reporting agencies, without clear notice and affirmative consent. GM may not disclose this data to consumer reporting agencies for five years and, for the 20-year term of the order, must obtain affirmative consent before collecting, using or sharing connected vehicle data, allow access and deletion, and offer a way to disable location collection; the order does not provide for any payment. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Marketing and consent

Legal basis

Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)

Action

Order

Status of proceedings

final

Sector

Automotive

Employees

10,000 or more

Published

14 Jan 2026

Checked against the official source on 3 Oct 2026 · Direct link

Following an attack in October 2024 in which data relating to around 24 million customer contracts, including IBANs, was exfiltrated, the French data protection authority (CNIL) imposed 27 million EUR on Free Mobile and 15 million EUR on Free (42 million EUR in total). The authority objected to VPN access without adequate authentication, deficient detection of suspicious access, incomplete notification of data subjects and, at Free Mobile, excessively long retention of old contracts; orders with deadlines were also issued.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 32, Art. 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

During the proceedings, the companies introduced multi-factor authentication, a Security Operations Centre and improved logging.

Published

14 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

The provider of cloud-based HR software received an extortion email in April 2024; an attacker had deleted databases on its AWS servers and likely exfiltrated data, and data allegedly taken was offered for sale on the dark web – data on 95,000 employees of its clients (including identity number, salary, bank account and religion) and on 24,765 emergency contacts and children was put at risk. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because, despite the HR data entrusted to it by clients, the provider had no web application firewall against existing SQL injection vulnerabilities, remote desktop access open to the internet without two-factor authentication, and vulnerability scans only every two years. It imposed 17,500 SGD, payable in twelve monthly instalments in view of the company's cash flow, and directed among other things a web application firewall, annual penetration tests, two-factor authentication and encryption of all personal data fields.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach; payment in instalments in view of cash flow, while a waiver was refused.

Published

8 Jan 2026

Original amount 17,500 SGD, converted at the ECB reference rate of 8 Jan 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

The function of data protection officer was performed by a manager who was at the same time responsible for security and protection of classified information and thus monitored their own activities; there was no conflict analysis. Poland’s data protection authority (UODO) imposed 978,128 PLN and referred to numerous previous reprimands and orders against the company.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 3 und 6 DSGVO (DKN.5131.4.2025)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Repeat case

yes

Mitigating circumstances

During the proceedings the function was made independent and placed directly under the management board.

Published

26 Jan 2026

Original amount 978,128 PLN, converted at the ECB reference rate of 2 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following numerous complaints about marketing calls for the gas supplier ZENITH, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that the call centre engaged had insufficient security measures and called persons without valid consent. By Decision 44/2025, One Way received 40,000 EUR each as processor and as controller, together with an order to delete the data of persons without valid consent; ZENITH and two other service providers were also held liable (10,000, 10,000 and 5,000 EUR).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 29, 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined an unnamed retail chain EUR 3,500,000 (EUR 2,500,000 under Art. 6(1)(a), 13, 32 and 35 GDPR and EUR 1,000,000 under Art. 82 of the Loi Informatique et Libertés, the French Data Protection Act). Since 2018 the company had transferred e-mail addresses and telephone numbers of members of its loyalty programme to a social network without valid consent in order to show them targeted advertising there; more than 10.5 million people were affected. In addition, there was inadequate information, weak password rules with SHA-256 hashing, no data protection impact assessment, and cookies that were set before any choice and continued to be read after a refusal.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. a, 13, 32 und 35 DSGVO; Art. 82 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

negligent

Published

22 Jan 2026

Checked against the official source on 2 Oct 2026 · Direct link

Without registering as a data broker, the Texas reseller traded in the names and contact details of millions of people, sorted by illnesses such as Alzheimer's or addiction, by age, presumed ethnicity and political views. In addition to the fine, the California Privacy Protection Agency (CPPA) requires it to stop selling data on all Californians.

Authority / court

California Privacy Protection Agency (CPPA)

Area of law

Data protection · Marketing and consent

Legal basis

California Delete Act (Registrierungspflicht für Datenhändler)

Action

Fine

Status of proceedings

final

Sector

Other

Published

8 Jan 2026

Original amount 45,000 USD, converted at the ECB reference rate of 30 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

In August 2024 an attacker encrypted a network drive shared by SESAMi and its subsidiary Abecha holding payment data (including full credit card numbers and bank account details) of around 20,471 customers of the subsidiary's fuel fleet discount programme and of up to 18,837 individuals from registrations for SESAMi's B2B platform; exfiltration could not be established. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) classified SESAMi, which ran the network for the subsidiary without a written contract, as a data intermediary in that respect and found a negligent breach of the Protection Obligation by SESAMi (including outdated firewall and VPN firmware, no patch management and unenforced password and MFA rules), and likewise by Abecha, which as controller had taken no steps to ensure adequate security at SESAMi. SESAMi received 8,750 SGD and directions, while Abecha, as the controller, received directions only, including setting out roles and data protection duties within the group in writing.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation); Section 4(3) PDPA (Pflichten bei Einsatz eines Data Intermediary); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Cooperation, prompt and effective remediation, admission under the Expedited Decision Procedure; for Abecha also lower culpability owing to its limited autonomy as a wholly owned subsidiary, one of the reasons for not imposing a fine on it.

Published

26 Feb 2026

Original amount 8,750 SGD, converted at the ECB reference rate of 29 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Following numerous complaints about marketing calls for Heron, the Archi Prostasias Dedomenon (Hellenic Data Protection Authority) found in Decision 43/2025 shortcomings in the controls over the call centres engaged and in security measures, with the result that subscribers on the opt-out register under Art. 11 of Law 3471/2006 were also called; in addition, some data had been collected unlawfully. It imposed a total of EUR 165,000: EUR 115,000 on Heron (Art. 32 GDPR) together with a warning and an order to introduce, within six months, an audit procedure for call-centre partners with checks at least once a year, EUR 35,000 on ICOMM (5,000 Art. 32, 10,000 Art. 29, 20,000 Art. 5(1)(a) GDPR) with an erasure order, and EUR 15,000 on a further call centre (Art. 32 GDPR).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 29, Art. 32, Art. 58 Abs. 2 lit. d, f und i DSGVO; Art. 11 ν. 3471/2006; Art. 21 ν. 2472/1997 i. V. m. Art. 84 ν. 4624/2019

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 28 Sep 2026 · Direct link

In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.

Authority / court

Conseil d'État

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Transport, logistics and shipping

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

On a complaint filed by the U.S. Department of Justice on behalf of the FTC, the federal district court for the Central District of California entered an order against two Disney companies. Disney is alleged to have failed to label child-directed videos on YouTube as 'Made for Kids' because it designated audiences only at channel level; as a result, data from children under 13 could be collected via YouTube without notice to and consent from their parents and used for targeted advertising. Disney pays a civil penalty of 10,000,000 USD and must set up a programme for reviewing and designating the audience of its videos. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC); Klage durch das U.S. Department of Justice, Anordnung des U.S. District Court for the Central District of California

Area of law

Data protection · Marketing and consent

Legal basis

COPPA Rule, 16 C.F.R. Part 312; Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c), 6505(d); Verfahren nach 15 U.S.C. §§ 45(m)(1)(A), 53(b)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Employees

10,000 or more

Published

31 Dec 2025

Original amount 10,000,000 USD, converted at the ECB reference rate of 23 Dec 2025.

Checked against the official source on 3 Oct 2026 · Direct link

As a processor, Nexpublica developed and operated the case management software ‘Public CRM’ for the disability authority MDPH Nord. Following two data breaches in 2022, audits revealed critical vulnerabilities that had existed since 2021, such as outdated SHA-1 hashing; the French data protection authority (CNIL) imposed 1.7 million EUR directly on the service provider.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data processors

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

An employee of the customer service provider was serving two customers in chat at the same time and assigned one customer's e-mail address to the other; as a result, the complainant received the name, debts and billing data of a stranger. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) saw the cause in the process design, which allowed parallel chats, and imposed 500,000 EUR for lack of data protection by design; the request for reconsideration was rejected.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data processors

Legal basis

Art. 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

For years the cameras at stations and stops of the Budapest suburban railway HÉV also recorded sound; the NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, Hungarian data protection authority) found breaches of transparency, data minimisation, lawfulness, storage limitation and the duty to carry out a data protection impact assessment. It imposed HUF 50,000,000 on the operator's legal successor and at the same time warned it against future audio recording without demonstrated necessity.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, e, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13 Abs. 1 lit. e, Art. 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

negligent

Published

19 Dec 2025

Original amount 50,000,000 HUF, converted at the ECB reference rate of 19 Dec 2025.

Checked against the official source on 28 Sep 2026 · Direct link

The mobile banking app of a bank (name not published) scanned the list of all installed applications on the Android and Huawei devices of 433,922 customers and stored it centrally – without a legal basis, without transparent information and without a data-minimising design. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 1.5 million EUR; the decision is not final (date = publication).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1, Art. 12, 13, 25 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

18 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) fined an energy company 210,000 EUR for unlawful telephone advertising. Callers often posed as the consumer's energy supplier, and in many cases contracts were foisted on the people called; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 2 Oct 2026 · Direct link

At the instruction of a group company based in Switzerland, the seed company had telematics devices installed in company cars that also recorded private journeys and assigned employees scores for their driving behaviour. Italy's data protection authority (Garante per la protezione dei dati personali) found breaches of transparency, purpose limitation, data minimisation and employee protection rules, imposed 120,000 EUR and ordered the deletion of the data on private journeys.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

DSGVO Art. 5 Abs. 1 lit. a-c, 6 Abs. 1 lit. f, 13, 28, 88; Codice privacy Art. 2-quaterdecies, 113, 114

Action

Fine

Status of proceedings

final

Sector

Food and agriculture

Mitigating circumstances

Small number of data subjects (five employees), immediate suspension of the processing.

Checked against the official source on 25 Sep 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 100,500 EUR on a solar photovoltaic company: 66,000 EUR for unlawful telephone advertising and 34,500 EUR for withholding caller numbers on sales calls. Callers concealed who the calls were really for and in some cases falsely presented sales calls as mere advisory calls.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; Verbot der Rufnummernunterdrückung bei Werbeanrufen

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 2 Oct 2026 · Direct link

During an on-site inspection in November 2023, a Luxembourg manufacturer of technical equipment (pseudonymised in the decision as “Société A”) did not hand over its record of processing activities but only showed it in an online application; the record exported from the software the following day, with 40 entries, was incomplete and inaccurate, including as regards contact details, categories of data subjects and data, recipients and transfers to third countries. The CNPD (Commission nationale pour la protection des données, the Luxembourg data protection authority) imposed 7,000 EUR, issued a reprimand and ordered the record to be completed within two months.

Authority / court

Commission nationale pour la protection des données (CNPD), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 30 Abs. 1 lit. a, c, d, e

Action

Fine

Status of proceedings

unknown

Sector

Manufacturing and mechanical engineering

Culpability

negligent

Checked against the official source on 28 Sep 2026 · Direct link

The CNPD (Luxembourg data protection authority) imposed a fine of EUR 2,784, a reprimand and an order on a Luxembourg private security services company with more than 250 employees because its record of processing activities did not fully contain the information required by Art. 30(1) GDPR. Within one month it had to describe the security measures for its whistleblowing report handling, or state expressly that there were none.

Authority / court

Commission nationale pour la protection des données (CNPD), formation restreinte

Area of law

Data protection

Legal basis

Art. 30(1)(a), (c), (d), (e), (f) und (g) DSGVO; Art. 58(2) und 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Defence and security

Checked against the official source on 2 Oct 2026 · Direct link

In 2021, a hacker gained access via a web form to a web server and a database server of the university, obtained, among other things, names with passwords and citizen service numbers of students and staff, and unsuccessfully demanded a ransom. According to the Dutch data protection authority (Autoriteit Persoonsgegevens, AP), security was not aligned with the risks, and the rights of a database account were not restricted.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Mitigating circumstances

Settlement without objection; active damage limitation, strengthened resilience and sharing of lessons learned with other organisations.

Published

17 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined the Police Service of Scotland £66,000 and also issued a reprimand. The ICO found that, during a criminal investigation, the police carried out a bulk download of data from the mobile phone of an employee who had made a complaint, without ensuring that this was lawful, fair and limited to what was necessary; it found infringements for the period 18 January to 5 April 2021. For this the ICO issued the reprimand under sections 35 and 37 DPA 2018 (Part 3). The ICO also found that the Professional Standards Department later disclosed this data without authorisation to the person accused, in an internal misconduct investigation. Appropriate technical and organisational measures for compiling such misconduct packs were missing, and the breach was only reported to the ICO on 30 June 2022, although the police had known of it since 17 June 2022. For these infringements the ICO imposed the fine. The combined notice relies, among other provisions, on Articles 5(1)(f) and 32(1) UK GDPR (security of processing), Articles 5(1)(c) and 25 UK GDPR (data minimisation, data protection by design) and Article 33(1) UK GDPR (breach notification).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(c), 5(1)(f), 25(1)-(2), 32(1) und 33(1) UK GDPR; section 155 DPA 2018 (Geldbuße); sections 35 und 37 DPA 2018 (Part 3), Verwarnung nach Schedule 13 para 2(c) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 66,000 GBP, converted at the ECB reference rate of 12 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The CNIL (Commission nationale de l'informatique et des libertés, French data protection authority) fined MOBIUS SOLUTIONS LTD, a provider of tools for personalised advertising campaigns with no establishment in the EU, EUR 1,000,000: as a processor for Deezer, the company had kept a copy of the data of more than 46 million users after the contract ended, used the data without instructions to improve its own services and kept no record of its processing activities (Art. 28(3)(g), Art. 29, Art. 30 GDPR). Deezer had notified the CNIL in November 2022 that user data had appeared on the dark web.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data processors

Legal basis

Art. 28 Abs. 3 lit. g, Art. 29 und Art. 30 DSGVO (Délibération SAN-2025-014 vom 11.12.2025)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

19 Dec 2025

Checked against the official source on 2 Oct 2026 · Direct link

The ICO fined ZMLUK Limited £105,000. The ICO found that the company had sent unsolicited marketing emails for energy-saving products; the notice gives the period as 1 January to 21 July 2023. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent). Under the notice, timely payment reduces the amount by 20% to £84,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 105,000 GBP, converted at the ECB reference rate of 11 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Between 2018 and 2020 the university notified twelve personal data breaches, six of which involved unauthorised persons gaining access to staff email accounts through phishing and in some cases setting up forwarding rules. The DPC found infringements of Art. 5(1)(f), 30(1), 32(1), 33(1) and 34(1) GDPR, issued a reprimand and imposed fines of €45,000, €3,000, €35,000 and €15,000, totalling €98,000.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 30(1), 32(1), 33(1), 34(1) DSGVO; ss. 110–111 Data Protection Act 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The university accepted most of the findings, acknowledged responsibility and improved its systems, training and policies; the fines are well below those in the draft and no remedial order was made.

Checked against the official source on 2 Oct 2026 · Direct link

On 2 December 2025 the ICO issued a reprimand to Post Office Limited. The ICO found that on 25 April 2024 the company put the unredacted version of a settlement deed on its corporate website instead of the intended redacted one, exposing personal data of 502 postmasters who had taken part in the 2017 group litigation linked to the Horizon IT scandal. The ICO concluded that appropriate technical and organisational measures were lacking, in breach of Articles 5(1)(f), 32(1) and 32(2) UK GDPR. No fine was imposed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1) und 32(2) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Transport, logistics and shipping