Who was sanctioned, and for what?

Datatilsynet (Norwegian Data Protection Authority) fined the online dietary supplement retailer Lab Pharma AS NOK 205,000 for breaching its duty to cooperate with the supervisory authority (Art. 31 GDPR): the company had threatened case handlers with police reports and lawsuits in order to end the investigation of a complaint, and submitted requested documents late. The authority also ordered the company to delete the name and images of a former advertising partner (an influencer) from all its websites and to stop using her data for marketing until it can demonstrate a legal basis, as the underlying contract had already expired in March 2017.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 31, Art. 58 Abs. 2 lit. f, g und i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Liability of senior managers

Datatilsynet attributed the intentional conduct of the company's management to the company.

Published

17 Aug 2026

Original amount 205,000 NOK, converted at the ECB reference rate of 12 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The CNIL (French data protection authority) fined the IT and engineering consultancy EXTIA EUR 300,000 because, of 265 erasure requests received in 2024 – mostly from job applicants, occasionally from former employees – 12 were not processed at all and 166 applicants were not told of the outcome; 27 received their reply only after the one-month deadline. The CNIL regarded this as particularly negligent, especially as the company had already been reminded of its obligations by the CNIL twice in 2024 (Art. 12 and 17 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 und 17 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

negligent

Repeat case

yes

Mitigating circumstances

During the proceedings the company deleted the data concerned and informed the applicants retrospectively.

Published

9 Sep 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Garante (Italian data protection authority) fined the US operator of the generative AI service Character.AI, on which users – including minors – chat with virtual characters, 158,000 EUR, among other things for deficient privacy information, a data protection impact assessment prepared late and the late appointment of a representative in the EU. It also criticised weaknesses in the protection of minors and in age verification; within 120 days the company must ensure working age verification, an effective cooling-off period preventing blocked minors from re-registering and private-by-default profiles for minors.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 2, 12 Abs. 1, 13 Abs. 1 und 2, 14 Abs. 1 und 2, 24 Abs. 1, 25 Abs. 2, 27 Abs. 1 und 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

no

Mitigating circumstances

Mitigating: progressively strengthened age checks (a dedicated service for minors, age verification by a third-party provider), no previous relevant infringements, cooperation and amendments to the privacy policy during the proceedings.

Published

9 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

After almost four years of litigation, the federal district court for Idaho entered an order agreed between the FTC and the data broker Kochava. The FTC had alleged that Kochava sold precise location data from hundreds of millions of mobile devices without the knowledge and consent of the people concerned, revealing, for example, visits to health facilities and places of worship. Kochava and its subsidiary Collective Data Solutions, which has taken over the data broker business, may only share sensitive location data with affirmative consent and for services requested by the consumer, and must introduce, among other things, a sensitive-locations programme, checks on their data suppliers, disclosure of recipients and retention limits; no payment is provided for. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. District Court for the District of Idaho auf Klage der Federal Trade Commission (FTC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Section 5 FTC Act, 15 U.S.C. § 45 (unlautere Praktiken); Verfahren nach Section 13(b), 15 U.S.C. § 53(b)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

26 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

The debt collection company posted personal data of alleged debtors on the internet, some of it particularly sensitive, in order to obtain information on their whereabouts and to warn third parties. The Swiss Federal Administrative Court (Bundesverwaltungsgericht, A-3891/2025) upheld the ruling of the Federal Data Protection and Information Commissioner (EDÖB) of 28 April 2025, according to which this constitutes an unjustified violation of privacy.

Authority / court

Bundesverwaltungsgericht (A-3891/2025) auf Verfügung des EDÖB vom 28.04.2025

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSG Art. 6, Art. 19, Art. 31

Action

Order

Status of proceedings

final

Sector

Financial services and insurance

Published

20 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

The online retailer had not set a retention period for customer accounts and kept data until customers requested deletion; purchases were only possible with an account. The sanctions board of the Finnish Data Protection Ombudsman imposed 856,000 EUR in 2024, the administrative court reduced the fine to 792,639 EUR on the basis of current turnover, and the Supreme Administrative Court (Korkein hallinto-oikeus, KHO) confirmed this on 12 June 2026.

Authority / court

Korkein hallinto-oikeus (KHO); Sanktionsgremium des Datenschutzbeauftragten

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. e DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Retail and e-commerce

Published

18 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Due to errors by a processor of the energy supplier, incorrect details of a direct debit mandate were recorded, so that three bills instead of one were debited from the customer's account; call recordings and the mandate form had not been retained. ZENITH responded inadequately to the access request and did not correct the data (100,000 EUR), while Piraeus Bank infringed the right of access (10,000 EUR and a reprimand); Decision No. 8/2026 of the Hellenic Data Protection Authority.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic DPA)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. d, Art. 12 Abs. 3, Art. 15, Art. 28 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Walloon water utility recorded and listened in on customer calls for quality control and training purposes; the Litigation Chamber of the Autorité de protection des données (Belgian Data Protection Authority, APD/GBA) found infringements of transparency and fairness as well as in the engagement of a sub-processor. It imposed two fines totalling 86,000 EUR (85,000 + 1,000) after reducing the amounts in view of the situation of the public utility; an appeal against the decision has been lodged with the Market Court.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13, Art. 28 Abs. 3

Action

Fine

Status of proceedings

under appeal

Sector

Energy and utilities

Checked against the official source on 25 Sep 2026 · Direct link

The Privacy Commissioner found that the rental application platform 2Apply collected more personal information than necessary from March 2020 to March 2025, such as gender, student status, citizenship, visa expiry and previous living arrangements, and did so unfairly through design techniques such as “confirmshaming”, biased framing and bundled consent. The determination requires IRE to stop this collection within 60 days, engage an independent reviewer and report to the OAIC within twelve months on implementing the recommendations.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

APP 3.2 und APP 3.5 (Privacy Act 1988 (Cth)); Feststellungen nach s 52(1A)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

IRE adapted its collection practices during the investigation without admitting a breach.

Published

22 Apr 2026

Checked against the official source on 3 Oct 2026 · Direct link

A person complained that Fitsypro had not responded to their request for access, rectification and erasure of November 2023. Three requests for information from the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) between 2024 and 2026 went unanswered, and nobody attended the hearing. The DVI imposed 1,500 EUR and requested the information by 21 April 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 58 Abs. 1 lit. e, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Checked against the official source on 25 Sep 2026 · Direct link

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

During a wave of boycotts in 2024, Loblaw did not process deletion requests in time and retained purchase and usage data from the loyalty programme (more than 17 million members) even after accounts were closed, without demonstrating effective anonymisation. Loblaw undertook to the Office of the Privacy Commissioner of Canada (OPC) to have the anonymisation independently reviewed and to carry out annual deletions.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

PIPEDA

Action

Other

Status of proceedings

unknown

Sector

Retail and e-commerce

Employees

10,000 or more

Published

5 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Despite repeated follow-ups by the trade union, the cleaning company did not respond to a union member’s access request and also failed to comply with the order of the Danish Data Protection Agency (Datatilsynet) to decide on the request. Datatilsynet reported the company; the case was closed on 2 March 2026 with a fine notice of 60,000 DKK.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15; Nichtbefolgung einer Anordnung der Datatilsynet; databeskyttelsesloven

Action

Fine

Status of proceedings

final

Sector

Other

Original amount 60,000 DKK, converted at the ECB reference rate of 2 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following six complaints, the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found that the company did not provide a copy to customers who requested recordings of their sales calls in order to dispute invoices, offering only to let them listen via customer service, and in some cases deleted recordings. In addition to a reprimand, a fine of 5,000 EUR was imposed.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15 Abs. 1 und 3

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

25 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to the City of London Police. The ICO found that between 1 April 2023 and 31 July 2025 the police force had failed to answer subject access requests within the statutory deadline. The ICO found this breached Article 12(3) UK GDPR and section 45(3) of the Data Protection Act 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 45(3) DPA 2018; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Since 2019, the delivery platform had required scans or photos of its users’ identity cards and passports in cases of suspected fraud, relying on legitimate interests. The Prezes Urzędu Ochrony Danych Osobowych (President of Poland’s data protection authority, UODO) regarded this as processing without a legal basis and a breach of data minimisation, imposed 5,898,064 PLN and ordered the processing to stop and the data to be erased.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 5 Abs. 2, Art. 6 Abs. 1 DSGVO (DKN.5112.33.2022)

Action

Fine

Status of proceedings

final

Sector

Media and online platforms

Published

16 Mar 2026

Original amount 5,898,064 PLN, converted at the ECB reference rate of 19 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

An estate agency (name not published) kept 11,887 brokerage contracts from 2010 to 2019, together with 914 copies of identity cards, passports and bank cards, without a legal basis, although the managing director stated that no card copies were collected. The Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) also criticised irregular and inadequate data protection training for employees and imposed 100,000 EUR (date of publication; exact date of the decision not stated).

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. c und e, Art. 6 Abs. 1, Art. 32 Abs. 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Culpability

negligent

Mitigating circumstances

No damage to data subjects was found.

Published

19 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).

Authority / court

Datenschutzbehörde

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13

Action

Fine

Status of proceedings

under appeal

Sector

Other

Employees

Under 50

Mitigating circumstances

No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.

Checked against the official source on 25 Sep 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined the time-recording system provider Timegrip AS NOK 250,000 because, after a retail chain went bankrupt, the company refused 80 former employees access to their clock-in data, which they needed to document their wage claims. The authority treated Timegrip as controller, since after the bankruptcy the company alone in fact decided on storage, use and access, and found a breach of the right of access under Art. 15(1) and (3) GDPR. A fine of NOK 750,000 had been notified; the authority took into account, among other things, the confused situation and its own long case-handling time.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 15 Abs. 1 und 3, Art. 58 Abs. 2 lit. i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Mitigating circumstances

The confused situation after the customer's bankruptcy (given only limited weight) and Datatilsynet's long case-handling time; NOK 750,000 had been notified.

Published

20 Jan 2026

Original amount 250,000 NOK, converted at the ECB reference rate of 16 Jan 2026.

Checked against the official source on 28 Sep 2026 · Direct link