Who was sanctioned, and for what?

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The data protection authority had prohibited a company from tracking its three company vehicles continuously by GPS and ordered the data to be erased; narrow purposes such as theft protection while parked remained permitted. The Upravno sodišče Republike Slovenije (Administrative Court of the Republic of Slovenia) upheld this and clarified that employee consent bundled with other declarations is invalid.

Authority / court

Upravno sodišče Republike Slovenije (bekanntgemacht durch den Informacijski pooblaščenec)

Area of law

Data protection · Employee data

Legal basis

Art. 6 Abs. 1 lit. f, Art. 7 Abs. 2 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

7 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In September 2022 the public TVET college mistakenly emailed reports verifying the qualifications and criminal records of three employees to other staff, informed neither the regulator nor those affected, and had not registered an information officer. Departing from the view of its Enforcement Committee, the regulator also treated this as impermissible further processing and found breaches of accountability, purpose limitation, security safeguards and the notification duty; on 22 May 2026 it ordered, among other things, registration, notification of the breach, a written apology, a compliance framework and POPIA training for all staff.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Employee data

Legal basis

Sections 8, 15(1), 19(1) und 22(1) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA

Action

Order

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The college recalled the email two days later, informed staff of the error and took action against those responsible; according to the regulator, this did not relieve it of the duty to notify.

Published

2 Jun 2026

Checked against the official source on 4 Oct 2026 · Direct link

A provider of public utility services used GPS transmitters in company vehicles to record employees’ location data permanently and without cause, without defining a purpose, carrying out a balancing of interests or providing sufficient information. The Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP) imposed 6,000 EUR on the company.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Liability of senior managers

Measures against individuals are not reported here.

Published

15 Apr 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

An employer installed the software Spyrix Employee Monitoring on the work computers of individual employees, which for months recorded screen content, audio and even private e-mails and conversations without informing the employees. The supervisory authority, the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP), imposed 71,474 EUR on the company.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Liability of senior managers

Measures against individuals are not reported here.

Published

9 Apr 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

During an inspection at the Passo Corese logistics centre (around 1,800 employees), the Garante (Italian data protection authority) found that, after return-to-work interviews, information on illnesses, participation in strikes, trade union activities and family circumstances of employees – irrelevant to their professional aptitude – was recorded in free-text fields of a platform linked to time recording and accessible to many managers. With immediate effect it ordered the definitive restriction of processing of these entries – also at all other sites using the platform – and of four cameras at the entrances to toilets and break areas; the investigation was continuing.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, c und e, Art. 6, 9 und 88 DSGVO; Art. 113 Codice privacy (D.Lgs. 196/2003); Maßnahme nach Art. 58 Abs. 2 lit. f DSGVO

Action

Order

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Employees

10,000 or more

Published

24 Feb 2026

Checked against the official source on 28 Sep 2026 · Direct link

An Excel file containing data from medical certificates of current and former employees was repeatedly circulated within the company; the company reported the incident itself. The Romanian data protection authority (ANSPDCP) imposed 25,455 lei (5,000 EUR) for breach of data minimisation and accountability and 50,911 lei (10,000 EUR) for insufficient security measures and ordered a monitoring and control procedure. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c und Abs. 2, Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Automotive

Published

19 Jan 2026

Original amount 76,366 RON, converted at the ECB reference rate of 19 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

In 2023, the French data protection authority (CNIL) had imposed 32 million EUR for the real-time monitoring of warehouse staff through scanner metrics. France's supreme administrative court (Conseil d'État) held that three metrics (‘Stow Machine Gun’, ‘Idle Time’, ‘Latency’) were covered by legitimate interest, but upheld the findings on the 31-day retention of all metrics, information deficiencies and security flaws in the video surveillance, and reduced the fine to 15 million EUR.

Authority / court

Conseil d'État

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c, Art. 12, 13, 32 DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Transport, logistics and shipping

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

At the instruction of a group company based in Switzerland, the seed company had telematics devices installed in company cars that also recorded private journeys and assigned employees scores for their driving behaviour. Italy's data protection authority (Garante per la protezione dei dati personali) found breaches of transparency, purpose limitation, data minimisation and employee protection rules, imposed 120,000 EUR and ordered the deletion of the data on private journeys.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

DSGVO Art. 5 Abs. 1 lit. a-c, 6 Abs. 1 lit. f, 13, 28, 88; Codice privacy Art. 2-quaterdecies, 113, 114

Action

Fine

Status of proceedings

final

Sector

Food and agriculture

Mitigating circumstances

Small number of data subjects (five employees), immediate suspension of the processing.

Checked against the official source on 25 Sep 2026 · Direct link

The municipality had processed personal information of a former employee which was exposed on the internet; the Information Regulator treated this as a gross violation of privacy and issued an enforcement notice. Because the municipality did not implement the corrective instructions, an administrative fine of ZAR 500,000 followed; as it did not pay, the Regulator has initiated court proceedings to recover the amount.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Employee data

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Nov 2025

Original amount 500,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Data of employees of McDonald’s and its franchisees from the rota module (including names, PESEL or passport numbers, working hours, positions) sat in a publicly accessible directory. UODO found that McDonald’s Polska had carried out no risk analysis, implemented no appropriate safeguards and not effectively supervised its processor, and imposed fines of PLN 1,632,063, 13,600,528 and 1,700,066 (PLN 16,932,657 in total) and a reprimand; the processor 24/7 Communication received PLN 94,286, 42,429 and 47,143 (PLN 183,858), making PLN 17,116,515 overall. The decision is not final.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. c und f, Art. 5 Abs. 2, Art. 25 Abs. 1, Art. 28 Abs. 1, Art. 32 Abs. 1 und 2, Art. 38 Abs. 1 DSGVO sowie Art. 34 Abs. 1 und 3 lit. c DSGVO (Verwarnung) (Verantwortlicher); Art. 28 Abs. 3 lit. c, Abs. 4 und 9, Art. 32 Abs. 1 und 2, Art. 38 Abs. 1 DSGVO (Auftragsverarbeiter)

Action

Fine

Status of proceedings

under appeal

Sector

Food and agriculture

Published

21 Jul 2025

Original amount 17,116,515 PLN, converted at the ECB reference rate of 23 Jun 2025.

Checked against the official source on 28 Sep 2026 · Direct link

The shipping company processed results of on-board breath alcohol tests that could be attributed to a complainant employed as a captain. The Swedish Authority for Privacy Protection (IMY) regarded this as processing without a legal basis and as unlawful processing of health data and imposed 75,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Employee data

Legal basis

DSGVO Art. 6, Art. 9

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Published

18 Jun 2025

Original amount 75,000 SEK, converted at the ECB reference rate of 18 Jun 2025.

Checked against the official source on 25 Sep 2026 · Direct link

In 2023 the wholesale distributor of pipes and valves installed a camera system in all its delivery vehicles that also films the driver's cab from engine start until 20 minutes after the engine is switched off and uses artificial intelligence to detect events such as phone use, not wearing a seatbelt or smoking. The Commission d'accès à l'information (CAI, Quebec's access to information and privacy commission) found the necessity of the collection not established because the intrusion into drivers' privacy had not been sufficiently minimised, and ordered the company to limit in-cab recording to a few seconds before and after an incident or to stop it, to stop recording once the engine is off and to destroy any recordings going beyond that.

Authority / court

Commission d'accès à l'information du Québec (CAI), section de surveillance

Area of law

Data protection · Employee data

Legal basis

Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1), Art. 5 (Notwendigkeit der Erhebung) und Art. 83

Action

Order

Status of proceedings

unknown

Sector

Retail and e-commerce

Checked against the official source on 3 Oct 2026 · Direct link

A courier of the insurer delivered an employee’s dismissal letter unsealed to his parents’ home and, when the father refused to accept it, left it there, so that third parties could read its contents. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) issued a reprimand for breaches of lawfulness, confidentiality and accountability and ordered the delivery procedure for dismissal letters to be revised within one month.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und f, Art. 6, Art. 24 Abs. 1 DSGVO

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The delivery platform unlawfully processed data on more than 35,000 riders: facial recognition for identity verification, location tracking even outside working hours and automated assessments without human review. Foodinho had already been sanctioned with 2.6 million EUR in 2021; in addition to 5 million EUR, the Italian data protection authority (Garante per la protezione dei dati personali) prohibited the biometric processing.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

DSGVO (u. a. Transparenz, biometrische Daten, automatisierte Entscheidungen)

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Repeat case

yes

Published

22 Nov 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In December 2022 an attacker used an employee's stolen credentials to break into the systems of the cinema operator National Amusements because multi-factor authentication was not enforced for all access routes; data such as social security, passport and account numbers of 82,128 people was affected – according to the company, current and former employees and contractors – of whom 23,365 were in New York, and some of the social security numbers were stored unencrypted. Those affected were only notified on 18 December 2023, more than a year after the incident. Under the Assurance of Discontinuance with the New York Attorney General's office, the company pays 250,000 USD and must introduce, among other things, encryption, password rules, vulnerability testing and an incident response plan. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Office of the New York State Attorney General (Bureau of Internet & Technology)

Area of law

Data protection · Employee data

Legal basis

New York Executive Law § 63(12); New York General Business Law § 899-aa (Benachrichtigung bei Datenpannen) und § 899-bb (SHIELD Act, Datensicherheit)

Action

Fine

Status of proceedings

final

Sector

Other

Published

15 Nov 2024

Original amount 250,000 USD, converted at the ECB reference rate of 13 Nov 2024.

Checked against the official source on 3 Oct 2026 · Direct link

During the pandemic in 2020 the printing company introduced an access control system with facial recognition and temperature checks for its employees, and kept using facial recognition after the temperature function was discontinued in October 2022. The Commission d'accès à l'information (CAI, Quebec's access to information and privacy commission) found that the company had not shown that collecting the biometric data was necessary for access control and ordered it, within 90 days, to stop collecting and using facial recognition and to destroy the biometric templates created.

Authority / court

Commission d'accès à l'information du Québec (CAI), section de surveillance

Area of law

Data protection · Employee data

Legal basis

Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1), Art. 4 (Notwendigkeit der Erhebung) und Art. 83

Action

Order

Status of proceedings

unknown

Sector

Manufacturing and mechanical engineering

Checked against the official source on 3 Oct 2026 · Company name anonymised since 4 Sep 2026 · Direct link

Following complaints from three employees, the President of the CNIL (French data protection authority) issued a French energy group with a reprimand (rappel à ses obligations légales under Art. 20 III of the Loi Informatique et Libertés, the French Data Protection Act). The employees were affected by an internal investigation following reports; the company had rejected their objection to the processing without sound reasons, informed them incompletely, refused access requests and answered one request late. On 1 December 2025 the Conseil d'État (French supreme administrative court) confirmed that the processing was based on legitimate interest rather than a legal obligation, so the right to object applied, and that access had to be given, with redactions where needed to protect third parties.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), présidente

Area of law

Data protection · Employee data

Legal basis

Art. 20 III Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 6 Abs. 1 lit. c und f, 12, 15 und 21 DSGVO

Action

Reprimand or warning

Status of proceedings

final

Sector

Energy and utilities

Employees

10,000 or more

Checked against the official source on 2 Oct 2026 · Company name anonymised since 19 Jul 2026 · Direct link

Using a compromised user account, an attacker gained remote desktop access to servers of the payroll service provider between December 2022 and January 2023 and exfiltrated data; data on employees of one client, including name, identity number, bank account and salary, appeared on a leak site. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because the sensitive data was stored on unsecured internal drives, staff had local administrator rights and there was no multi-factor authentication. Given the company's role as a payroll provider and the type of data, it considered a fine appropriate and set it at 4,000 SGD.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Employee data

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

22 Apr 2024

Original amount 4,000 SGD, converted at the ECB reference rate of 22 Apr 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 22 Apr 2026 · Direct link