Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe and North America: 756 cases from 32 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by regionAll jurisdictions
What for?
by action- Fine €1.74m 100 % · 9 cases
- Order — 0 % · 1 case
- Reprimand or warning — 0 % · 1 case
Who?
by sectorAll sectors
When?
per quarter, by date of decision| Period | Cases | Total |
|---|---|---|
| Q3 2023 | 0 | — |
| Q4 2023 | 1 | €20,000 |
| Q1 2024 | 0 | — |
| Q2 2024 | 0 | — |
| Q3 2024 | 2 | €1.5m |
| Q4 2024 | 3 | €104,275 |
| Q1 2025 | 0 | — |
| Q2 2025 | 0 | — |
| Q3 2025 | 0 | — |
| Q4 2025 | 1 | €15,000 |
| Q1 2026 | 0 | — |
| Q2 2026 | 3 | €96,948 |
| Q3 2026 | 1 | €8,000 |
11 cases
3 Sep 2026 ASIS – Azienda Speciale per la gestione degli Impianti Sportivi (Trento)Garante: 8,000 EUR for cameras in swimming pool changing rooms of a Trentino sports operator €8,000
Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.
Changing rooms and comparably intimate areas are off limits for video surveillance – even when theft prevention is the motive.
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Public sector
- Published
- 11 Sep 2026
- Newsletter del 11 settembre 2026 – Garante privacy Press release of an authority
- Garante – Provvedimento n. 619 del 3 settembre 2026 [10294255] (ASIS Trento) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
16 Jun 2026 Securitas Sverige AktiebolagSecuritas Sverige: reprimand over cameras in company vehicles without legal basis Reprimand or warning
The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.
Dashcams in company cars also need a verified legal basis and a balancing against the interests of employees and passers-by.
Use of cameras in vehicles
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · Video surveillance
- Legal basis
- DSGVO Art. 6 Abs. 1
- Action
- Reprimand or warning
- Status of proceedings
- final
- Sector
- Defence and security
- IMY – Tillsyn Securitas Sverige Aktiebolag Decision of an authority
- IMY – Beslut Securitas Sverige AB Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
15 Jun 2026 SSG SELECT SOLUTIONS S.R.L.Stranger in Kaufland CCTV room – service provider SSG Select Solutions pays 2,000 EUR €1,948
An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.
Anyone with access to surveillance rooms must know: video footage is confidential, and third parties have no access there.
Access to surveillance rooms; staff bound by instructions
- Authority / court
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Published
- 15 Jun 2026
Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.
- ANSPDCP – Comunicat de presă 15.06.2026 (SSG SELECT SOLUTIONS S.R.L.) Press release of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
12 Jun 2026 Μάρκετ Ιν ΑΕΒΕ (Market In)Greece: 95,000 EUR against supermarket chain Market In over video footage €95,000
A data subject complained about the disclosure of footage from the supermarket chain’s video surveillance and about the inadequate response to his access request. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that Market In had passed the video footage to the judicial authorities without informing the data subject beforehand, processed more data than necessary, failed to comply with the right of access and failed to cooperate with the authority, and by Decision 10/2026 imposed a total of 95,000 EUR (50,000 EUR for lawfulness/transparency, 20,000 EUR each for data minimisation and the right of access, 5,000 EUR for failure to cooperate); in the same proceedings, ΜΕΔΕ ΑΕ received 65,000 EUR.
Release video footage only for a specific purpose – and anyone ignoring requests from the supervisory authority pays extra.
Handling video footage and access requests
- Authority / court
- Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. a, c, Art. 5 Abs. 2, Art. 12, 13, 15, 31 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Retail and e-commerce
- Απόφαση 10/2026 της Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
23 Oct 2025 Comune di CurtaroloMunicipality of Curtarolo: 15,000 EUR for video surveillance of streets and employees €15,000
The municipality in the province of Padua monitored public streets and work areas without a sound legal basis, without adequate information and without a data protection impact assessment; recordings were used for disciplinary purposes, and an employee was secretly filmed while on sick leave. Italy's data protection authority (Garante per la protezione dei dati personali) imposed a fine of 15,000 EUR (5,000 EUR for public surveillance, 10,000 EUR for workplace surveillance).
Do not repurpose video recordings for disciplinary proceedings; specific employment law protections apply to employees.
Purpose limitation in video surveillance and employee data
- Authority / court
- Garante per la protezione dei dati personali
- Area of law
- Data protection · Video surveillance
- Legal basis
- DSGVO Art. 5, 6, 12, 13, 35, 88
- Action
- Fine
- Status of proceedings
- final
- Sector
- Public sector
- Provvedimento del 23 ottobre 2025 [10196164] Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Dec 2024 Danske Shoppingcentre P/SDanske Shoppingcentre: 350,000 DKK for camera above urinal in City2 shopping centre €46,909
Because of vandalism, the operator of the City2 shopping centre had installed cameras in toilet areas; one camera in the men’s toilets also captured the area in front of the urinal despite a black masking, and there were no signs. The court followed the Danish Data Protection Agency (Datatilsynet) and the public prosecutor and imposed 350,000 DKK for breach of the data minimisation principle.
Cameras have virtually no place in toilet and changing areas – masking parts of the image is no substitute for checking the location.
- Authority / court
- Retten i Glostrup (auf Anzeige der Datatilsynet)
- Area of law
- Data protection · Video surveillance
- Legal basis
- DSGVO Art. 5 Abs. 1 lit. c; databeskyttelsesloven § 41; tv-overvågningsloven
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Construction and real estate
Original amount 350,000 DKK, converted at the ECB reference rate of 19 Dec 2024.
- Datatilsynet – Danske Shoppingcentre indstilles til bøde (mit Ausgang des Verfahrens) Press release of an authority
- Domsdatabasen – Retten i Glostrup SS-9747/2023-GLO, Dom 19.12.2024 Court decision
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
19 Dec 2024 CNIL: 40,000 EUR against estate agency over constant video surveillance of staff €40,000
An estate agency (name redacted in the publication) continuously filmed workstations and break areas with image and sound, accessible via a smartphone app, and used the software Time Doctor to record keyboard and mouse activity as well as screenshots of the computers; several people accessed this data via the administrator account of one of them. The French data protection authority (CNIL) found infringements of data minimisation, legal basis, information, security and the obligation to carry out an impact assessment, and imposed 40,000 EUR.
Permanent video and audio recording of workplaces is practically never proportionate – not even in a small business.
Permissible employee monitoring and password security
- Authority / court
- Commission nationale de l'informatique et des libertés (CNIL)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. c, Art. 6, 12, 13, 32, 35 DSGVO
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- Délibération SAN-2024-021 du 19 décembre 2024 Decision of an authority
- CNIL – Les sanctions prononcées par la CNIL (Eintrag 19/12/2024, agence immobilière) Enforcement database of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
11 Dec 2024 Granit Bostad Beritsholm ABGranit Bostad Beritsholm: 200,000 SEK for round-the-clock video surveillance in a block of flats €17,366
The landlord monitored a multi-family building in Malmö around the clock with cameras at entrances, lifts, flat doors, in the stairwell, the basement and the refuse room, without any legal basis for doing so; the signs did not name the controller. The Swedish Authority for Privacy Protection (IMY) imposed 200,000 SEK and ordered the landlord to stop the surveillance except in the garage and to supplement the signs.
Video surveillance in residential buildings requires a balancing of interests for each individual area – problems such as vandalism do not justify blanket, permanent surveillance.
- Authority / court
- Integritetsskyddsmyndigheten (IMY)
- Area of law
- Data protection · Video surveillance
- Legal basis
- DSGVO Art. 6 Abs. 1, Art. 13
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Construction and real estate
- Published
- 12 Dec 2024
Original amount 200,000 SEK, converted at the ECB reference rate of 11 Dec 2024.
- IMY – Tillsyn Granit Bostad Beritsholm AB Decision of an authority
- IMY – Beslut efter tillsyn, IMY-2023-15373 (11.12.2024) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
30 Sep 2024 AS WasaWellness hotel Wasa must suspend video surveillance in treatment area Order
Following a tip-off that at the Wasa Resort Spa filming was also taking place in the treatment area and for monitoring work discipline, and that cameras captured the neighbouring property, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered the hotel to suspend video surveillance until a sound balancing of interests had been submitted, to stop recording the neighbouring property and to correct the camera information on the website. The hotel had repeatedly let the supervisory authority’s deadlines lapse.
Cameras require a documented balancing of interests for each location – performance monitoring of employees is not a permissible purpose.
Video surveillance of employees and guests
- Authority / court
- Andmekaitse Inspektsioon (AKI)
- Area of law
- Data protection · Video surveillance
- Legal basis
- § 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d und f, Art. 5 Abs. 1, Art. 6 Abs. 1 DSGVO
- Action
- Order
- Status of proceedings
- unknown
- Sector
- Other
- Ettekirjutus-hoiatus nr 2.1.-1/23/124-377-13 (AS Wasa), 30.09.2024 Decision of an authority
- Andmekaitse Inspektsioon – veröffentlichte Ettekirjutused (Liste) Official register or notice
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
16 Aug 2024 DSB: 1.5 million EUR against retail chain over cameras on self-checkouts, PIN pad and surroundings €1.5m
In 2022, a retail company (name pseudonymised) used nine cameras in one branch to film, among other things, the self-service checkouts including the keypad of the card payment terminal, as well as public areas, bus stops and neighbouring properties. The Austrian data protection authority (Datenschutzbehörde, DSB) imposed 1.5 million EUR for lack of a legal basis and infringement of data minimisation; the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) confirmed the amount on 25 July 2025, and an appeal on points of law is pending.
Align cameras in retail closely with their protective purpose – PIN entries, public spaces and neighbouring properties must not be in the frame.
- Authority / court
- Datenschutzbehörde (DSB)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- under appeal
- Sector
- Retail and e-commerce
- DSB Straferkenntnis GZ 2023-0.680.196 vom 16.08.2024 (RIS) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link
Report an error
7 Dec 2023 DSB: 20,000 EUR against restaurant business over constant surveillance of kitchen and pick-up area €20,000
A restaurant company with a delivery and pick-up service (name pseudonymised) recorded workstations in the kitchen and pick-up area without interruption, even outside opening hours, and stored the recordings for 14 days. In addition, there had been no record of processing activities since 2018; the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 20,000 EUR, and the penalty decision is final.
Even small businesses may not film employees permanently – and they need a record of their processing activities.
- Authority / court
- Datenschutzbehörde (DSB)
- Area of law
- Data protection · Video surveillance
- Legal basis
- Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1, Art. 30 Abs. 1 DSGVO
- Action
- Fine
- Status of proceedings
- final
- Sector
- Food and agriculture
- DSB Straferkenntnis GZ 2023-0.583.644 vom 07.12.2023 (RIS) Decision of an authority
Checked against the official source on 25 Sep 2026 · Direct link