Who was sanctioned, and for what?

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The security services provider used cameras in vehicles through which personal data was processed without any legal basis for doing so. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) issued a reprimand under Art. 58 GDPR; no fine was imposed.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1

Action

Reprimand or warning

Status of proceedings

final

Sector

Defence and security

Checked against the official source on 25 Sep 2026 · Direct link

An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Video surveillance

Legal basis

Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

15 Jun 2026

Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

A data subject complained about the disclosure of footage from the supermarket chain’s video surveillance and about the inadequate response to his access request. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that Market In had passed the video footage to the judicial authorities without informing the data subject beforehand, processed more data than necessary, failed to comply with the right of access and failed to cooperate with the authority, and by Decision 10/2026 imposed a total of 95,000 EUR (50,000 EUR for lawfulness/transparency, 20,000 EUR each for data minimisation and the right of access, 5,000 EUR for failure to cooperate); in the same proceedings, ΜΕΔΕ ΑΕ received 65,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, Art. 5 Abs. 2, Art. 12, 13, 15, 31 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Checked against the official source on 25 Sep 2026 · Direct link

For years the cameras at stations and stops of the Budapest suburban railway HÉV also recorded sound; the NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, Hungarian data protection authority) found breaches of transparency, data minimisation, lawfulness, storage limitation and the duty to carry out a data protection impact assessment. It imposed HUF 50,000,000 on the operator's legal successor and at the same time warned it against future audio recording without demonstrated necessity.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, c, e, Art. 6 Abs. 1, Art. 12 Abs. 1, Art. 13 Abs. 1 lit. e, Art. 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Transport, logistics and shipping

Culpability

negligent

Published

19 Dec 2025

Original amount 50,000,000 HUF, converted at the ECB reference rate of 19 Dec 2025.

Checked against the official source on 28 Sep 2026 · Direct link

The municipality in the province of Padua monitored public streets and work areas without a sound legal basis, without adequate information and without a data protection impact assessment; recordings were used for disciplinary purposes, and an employee was secretly filmed while on sick leave. Italy's data protection authority (Garante per la protezione dei dati personali) imposed a fine of 15,000 EUR (5,000 EUR for public surveillance, 10,000 EUR for workplace surveillance).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 5, 6, 12, 13, 35, 88

Action

Fine

Status of proceedings

final

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined Samaritaine SAS, operator of the Paris department store of the same name, EUR 100,000 because in August 2023, in response to thefts of goods, it had installed cameras disguised as smoke detectors and capable of recording sound in two stockrooms, which employees discovered a few weeks later. The CNIL objected to the lack of any prior assessment and documentation of the covert deployment, intended to be only temporary, the excessive recording of employees' conversations, the late involvement of the data protection officer, and the failure to notify and document a personal data breach after employees kept the memory cards containing the recordings when the cameras were removed (Art. 33(1) and (5) GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 5 Abs. 2, Art. 5 Abs. 1 lit. c, Art. 33 Abs. 1 und 5, Art. 38 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Employees

250 to 999

Culpability

negligent

Published

23 Sep 2025

Checked against the official source on 2 Oct 2026 · Direct link

From June 2020 to July 2022, Kmart Australia used facial recognition in 28 stores to record the face of every person who came in and of every customer at the returns counters, with the aim of uncovering refund fraud, without informing them or obtaining their consent. The Privacy Commissioner rejected the exception for addressing unlawful activity, because the indiscriminate collection of sensitive biometric information was disproportionate given less intrusive alternatives and its limited benefit, and ordered that the conduct must not be continued or repeated. The decision is currently under review before the Administrative Review Tribunal; hearings are scheduled for early 2027. The decision is not final.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Video surveillance

Legal basis

Privacy Act 1988 (Cth), APP 1.3, 1.4, 3.3, 3.4, 5.1, 5.2

Action

Order

Status of proceedings

under appeal

Sector

Retail and e-commerce

Mitigating circumstances

Kmart stopped using the system in July 2022 when the investigation began and cooperated with the regulator throughout.

Published

18 Sep 2025

Checked against the official source on 3 Oct 2026 · Direct link

In 2024 Metro notified the Commission d'accès à l'information (CAI, Quebec's access to information and privacy commission) of a pilot project in which people entering stores of the Metro, Super C and Jean Coutu banners would be matched by facial recognition, using the cameras at entrances and exits, against a biometric database; the database was to hold people involved in shoplifting or fraud incidents that led to police intervention. The CAI treated this as identity verification by means of biometric characteristics, which under s. 44 of the LCCJTI (Quebec Act to establish a legal framework for information technology) requires the express consent of the persons concerned, and prohibited putting the database into service. The decision is being challenged before the Court of Québec. The decision is not final.

Authority / court

Commission d'accès à l'information du Québec (CAI), section de surveillance

Area of law

Data protection · Video surveillance

Legal basis

Loi concernant le cadre juridique des technologies de l'information (RLRQ c. C-1.1), Art. 44 und 45; Loi sur la protection des renseignements personnels dans le secteur privé (RLRQ c. P-39.1), Art. 83

Action

Order

Status of proceedings

under appeal

Sector

Retail and e-commerce

Employees

10,000 or more

Checked against the official source on 3 Oct 2026 · Direct link

Because of vandalism, the operator of the City2 shopping centre had installed cameras in toilet areas; one camera in the men’s toilets also captured the area in front of the urinal despite a black masking, and there were no signs. The court followed the Danish Data Protection Agency (Datatilsynet) and the public prosecutor and imposed 350,000 DKK for breach of the data minimisation principle.

Authority / court

Retten i Glostrup (auf Anzeige der Datatilsynet)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 5 Abs. 1 lit. c; databeskyttelsesloven § 41; tv-overvågningsloven

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 350,000 DKK, converted at the ECB reference rate of 19 Dec 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

An estate agency (name redacted in the publication) continuously filmed workstations and break areas with image and sound, accessible via a smartphone app, and used the software Time Doctor to record keyboard and mouse activity as well as screenshots of the computers; several people accessed this data via the administrator account of one of them. The French data protection authority (CNIL) found infringements of data minimisation, legal basis, information, security and the obligation to carry out an impact assessment, and imposed 40,000 EUR.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. c, Art. 6, 12, 13, 32, 35 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Checked against the official source on 25 Sep 2026 · Direct link

The landlord monitored a multi-family building in Malmö around the clock with cameras at entrances, lifts, flat doors, in the stairwell, the basement and the refuse room, without any legal basis for doing so; the signs did not name the controller. The Swedish Authority for Privacy Protection (IMY) imposed 200,000 SEK and ordered the landlord to stop the surveillance except in the garage and to supplement the signs.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 6 Abs. 1, Art. 13

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Published

12 Dec 2024

Original amount 200,000 SEK, converted at the ECB reference rate of 11 Dec 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The CNPD (Luxembourg data protection authority) fined a Luxembourg limited company selling telecoms equipment in specialist shops EUR 2,300 and ordered it to remove two cameras that permanently filmed employees' office workstations and to delete their recordings. It also found no legal basis, insufficient information, excessive retention and security shortcomings; the company's data protection guide had to be supplemented with the legal basis.

Authority / court

Commission nationale pour la protection des données (CNPD), formation restreinte

Area of law

Data protection · Video surveillance

Legal basis

Art. 6(1), 5(1)(a) i. V. m. 13(1) und (2), 5(2) i. V. m. 24(1), 5(1)(e) und 32(1) DSGVO; Art. 58(2)(d), (f) und 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

Following a tip-off that an Estonian spa hotel was filming also in the treatment area and for monitoring work discipline, and that cameras captured the neighbouring property, the Estonian Data Protection Inspectorate (AKI) ordered the hotel to suspend video surveillance until a sound balancing of interests had been submitted, to stop recording the neighbouring property and to correct the camera information on the website. The hotel had repeatedly let the supervisory authority's deadlines lapse.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Video surveillance

Legal basis

§ 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d und f, Art. 5 Abs. 1, Art. 6 Abs. 1 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Other

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 30 Sep 2026 · Direct link

In 2022, a retail company (name pseudonymised) used nine cameras in one branch to film, among other things, the self-service checkouts including the keypad of the card payment terminal, as well as public areas, bus stops and neighbouring properties. The Austrian data protection authority (Datenschutzbehörde, DSB) imposed 1.5 million EUR for lack of a legal basis and infringement of data minimisation; the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) confirmed the amount on 25 July 2025, and an appeal on points of law is pending.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Retail and e-commerce

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 16 Aug 2026 · Direct link

The Integritetsskyddsmyndigheten (IMY, Swedish data protection authority) fined the fashion retailer 300,000 SEK over camera surveillance at its premises (distribution centre and warehouse). A team leader had operated a covert camera in a work room on his or her own initiative on a total of five nights; IMY attributed this to the company as controller because operational problems prompted it, the company's equipment was used and the footage was used in employment-related meetings. For the regular surveillance, IMY ordered the company to add the data protection officer's contact details to the signs.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Video surveillance

Legal basis

Art. 6 Abs. 1 und Art. 13 DSGVO; 15 § kamerabevakningslagen (2018:1200); Art. 58 Abs. 2 und Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Liability of senior managers

A team leader acted on his or her own initiative, according to the company contrary to company policy; in IMY's view, the company nevertheless bears responsibility under data protection law.

Original amount 300,000 SEK, converted at the ECB reference rate of 18 Apr 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 18 Apr 2026 · Direct link

The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) examined on its own initiative a digital security monitoring system (including video surveillance and drones) and an access control system using fingerprints in reception and closed controlled facilities for third-country nationals. In a 2024 decision it imposed EUR 100,000 because no complete data protection impact assessment and no data protection by design were in place before procurement and deployment, and EUR 75,000 for unclear, incomplete and contradictory information and missing documents provided to the authority. The ministry must also achieve GDPR compliance within three months.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 25, 31, 35, 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Company name anonymised since 2 Apr 2026 · Direct link

In two EU-funded research projects, the city analysed footage from existing surveillance cameras, audio from microphones in public spaces and posts from social networks using AI methods, without any legal basis for this processing, and shared the data with project partners. The Garante (Italian data protection authority) imposed a fine of 50,000 EUR, prohibited further processing of the collected data and ordered its erasure.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, 6, 9, 10, 13, 14 und 35 DSGVO; Art. 2-ter, 2-sexies und 2-octies Codice privacy (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

Mitigating: video footage recorded only for a limited number of hours, action in good faith owing to an error of law (relying in part on the assessment of the city's own data protection officer) and public information about the projects.

Published

25 Jan 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 11 Jan 2026 · Direct link

A restaurant company with a delivery and pick-up service (name pseudonymised) recorded workstations in the kitchen and pick-up area without interruption, even outside opening hours, and stored the recordings for 14 days. In addition, there had been no record of processing activities since 2018; the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 20,000 EUR, and the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a und c, Art. 6 Abs. 1, Art. 30 Abs. 1 DSGVO

Action

Fine

Status of proceedings

final

Sector

Food and agriculture

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link

Persónuvernd (Icelandic Data Protection Authority) fined the operator of an Icelandic event hall 3,500,000 ISK after finding on 7 February 2023 that video surveillance during events held by third parties took place without a legal basis, without a specified legitimate purpose and without adequate information. Weighing heavily was that the cameras also covered rooms where children and young people stayed overnight as well as Covid-19 mass vaccinations, and that the surveillance had affected a very large number of people since at least 2008.

Authority / court

Persónuvernd

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 Bst. a und b, Art. 5 Abs. 2, Art. 6 Abs. 1 und Art. 13 DSGVO; § 8 Abs. 1 Nr. 1 und 2 und Abs. 2, §§ 9 und 17 Abs. 2 Gesetz Nr. 90/2018 (isländisches Datenschutzgesetz); Geldbuße nach § 46 Abs. 3 Gesetz Nr. 90/2018 i.V.m. Art. 83 Abs. 5 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Mitigating circumstances

There was signage, albeit inadequate; the company cooperated with the authority and partly implemented the earlier orders; no financial damage (given little weight by the authority).

Published

17 Oct 2023

Original amount 3,500,000 ISK, converted at the ECB reference rate of 17 Oct 2023.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 17 Oct 2025 · Direct link