Who was sanctioned, and for what?

For seven months (October 2025 to May 2026), the bank continued to send a customer advertising via its app, although he had objected several times. The Italian data protection authority (Garante per la protezione dei dati personali) also found deficient systems for implementing objections and inaccurate information about the processing, and imposed 5,508,000 EUR (Provvedimento No. 613).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. a, Art. 12, 21, 24 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined Elderly Aids Limited, a seller of call-blocking devices, £190,000 and also issued an enforcement notice. The ICO found that the company had made 758,053 unsolicited direct marketing calls to numbers registered with the TPS/CTPS whose subscribers had not agreed to such calls, leading to 20 complaints. The legal basis is regulations 21 and 24 of PECR. Under the notice, payment by 7 September 2026 reduces the amount by 20% to £152,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998 (Geldbuße), section 40 DPA 1998 (Anordnung)

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Original amount 190,000 GBP, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

6 Aug 2026

Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) imposed fines totalling 34,327 EUR on a call centre that mainly marketed telecoms products: 32,000 EUR for unlawful telephone advertising and 2,327 EUR because consents to sales calls had not been fully documented. The campaign continued despite the gaps and requests to stop calling were sometimes ignored; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern; § 7a UWG (Dokumentation und Aufbewahrung von Einwilligungen)

Action

Fine

Status of proceedings

under appeal

Sector

Other

Checked against the official source on 2 Oct 2026 · Direct link

The Garante (Italian data protection authority) fined TIM 9,516,000 EUR because call centres outside the official sales network made promotional calls on the company's behalf using numbers not recorded in the operators' register ROC or falsified numbers (spoofing), often to lines entered in the do-not-call register, and the contacts obtained in this way reached its systems as apparently lawful leads via fictitious call-back requests on sales partners' web forms. The authority found that TIM had selected and supervised its sales partners inadequately and had systematically failed to answer, or answered late, requests for access, erasure and objection. In addition, TIM must secure its lead process, strengthen oversight of the sales chain and adapt its procedures for data subject rights.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 12, 15–22, 24, 25, 28 und 32 DSGVO; Art. 130 Codice in materia di protezione dei dati personali (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Taken into account as mitigating: short period and limited number of data subjects, measures taken during the proceedings (including checks on and termination of contracts with partners), a high level of cooperation, no special categories of personal data, adherence to the telemarketing code of conduct and substantial investment in controlling the sales chain.

Published

31 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

Authority / court

Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)

Action

Fine

Status of proceedings

reduced

Sector

Other

Culpability

negligent

Mitigating circumstances

Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined Elkjøp Nordic AS and Elkjøp Norge AS NOK 20,000,000. Following an on-site inspection in June 2022, the authority found that consent for the customer club was neither informed nor specific nor freely given, that club data had been reused without a legal basis for the 'kundematch' (customer match) tool, that the lawfulness of so-called offline conversions had not been assessed and documented, and that rectification requests had not been handled within the deadlines. The decision was adopted under the cooperation mechanism with the supervisory authorities of Sweden, Iceland, Finland and Denmark; more than six million club members across the Nordic countries were affected.

Authority / court

Datatilsynet

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 i. V. m. Art. 4 Nr. 11, Art. 6 Abs. 4, Art. 5 Abs. 2 i. V. m. Art. 5 Abs. 1 lit. a, Art. 12 Abs. 3 DSGVO; Art. 58 Abs. 2 lit. i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Retail and e-commerce

Culpability

intentional

Mitigating circumstances

Improvements made after the inspection, Datatilsynet's long case-handling time and the lack of evidence that sensitive data were processed; the amount is well below the starting point in the EDPB guidelines (0.4–0.8% of group turnover).

Published

4 Jun 2026

Original amount 20,000,000 NOK, converted at the ECB reference rate of 1 Jun 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The ICO fined Thermotech Wall and Loft Surveys Ltd £240,000 and issued an enforcement notice. After executing a search warrant in April 2025, the regulator found that between October 2024 and March 2025 the company had instigated 575,062 unsolicited marketing calls to numbers that had been on the TPS register for more than 28 days. There were 132 complaints. The legal basis is regulations 21 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Construction and real estate

Original amount 240,000 GBP, converted at the ECB reference rate of 28 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined a UK marketing company £300,000 and issued an enforcement notice. The ICO found that the company had sent more than 5.5 million unsolicited marketing text messages, including messages styled as if they came from bailiffs. The 7726 spam reporting service received over 60,000 complaints. The ICO relied on regulations 22 and 23 of PECR (electronic marketing without consent and concealed sender identity).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 22 und 23 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 300,000 GBP, converted at the ECB reference rate of 20 May 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Although the Information and Data Protection Commissioner (IDPC) had already ruled in favour of a complainant, an insurance company (name redacted) again had him called for marketing purposes via a third-party company; his number remained on call lists. The IDPC criticised the lack of safeguards and inadequate contracts with processors, ordered remedial action within 20 days and imposed two fines totalling 1,000 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 2, Art. 21 Abs. 2, Art. 24 Abs. 1, Art. 28 Abs. 3 i. V. m. Art. 58 Abs. 2 lit. b, d, i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued an enforcement notice to a UK company. The ICO found that the company had instigated calls about claims management services without the consent of the people called. Under regulation 21A of PECR such calls are only permitted with prior consent; the ICO also found a breach of regulation 24. The notice is an enforcement notice and does not impose a fine.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21A und 24 PECR; section 40 DPA 1998

Action

Order

Status of proceedings

unknown

Sector

Financial services and insurance

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Both companies continued to use e-mail addresses and telephone numbers from online purchases for advertising, although data subjects had objected – in some cases after deletion had been confirmed. The Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) ordered the processing for advertising to cease and the data to be deleted on request.

Authority / court

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)

Area of law

Data protection · Marketing and consent

Legal basis

DSG Art. 6, Art. 30 Abs. 2 lit. b, Art. 31

Action

Order

Status of proceedings

final

Sector

Retail and e-commerce

Published

26 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined Energy Prices Direct Limited, an energy switching broker, £160,000. The ICO found that the company had obtained contact details from public sources and list providers and did not screen them against the TPS/CTPS registers before making marketing calls. The legal basis is regulations 21 and 24 of PECR. Under the notice, timely payment reduces the amount by 20% to £128,000.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Energy and utilities

Original amount 160,000 GBP, converted at the ECB reference rate of 30 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In March 2026 the ICO fined a small UK direct marketing company £130,000 and also served an enforcement notice. According to the ICO, over almost eleven months in 2024 the company had staff make more than 230,000 marketing calls to lines that had been on the UK's opt-out register for sales calls (Telephone Preference Service, TPS) for over 28 days, prompting 12 complaints. The ICO treated this as a breach of regulation 21 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21 und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 130,000 GBP, converted at the ECB reference rate of 12 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2021, the Luxembourg data protection authority (CNPD) had imposed 746 million EUR and an order to bring processing into compliance on account of behavioural online advertising; the Administrative Tribunal (Tribunal administratif) confirmed this on 18 March 2025. On 12 March 2026, the Administrative Court (Cour administrative) confirmed that legitimate interest was not a sound legal basis and that the information was insufficient, but annulled the fine on the basis of more recent CJEU case law on the requirement of culpability; the CNPD is re-examining the sanction.

Authority / court

Cour administrative (Luxemburg); Verfahren der CNPD

Area of law

Data protection · Marketing and consent

Legal basis

Art. 6 Abs. 1 lit. f, Art. 12 ff. DSGVO

Action

Order

Status of proceedings

overturned

Sector

Retail and e-commerce

Employees

10,000 or more

Mitigating circumstances

Amazon had implemented the compliance order before the hearing.

Checked against the official source on 25 Sep 2026 · Direct link

The Bundesnetzagentur (Federal Network Agency) fined a company marketing financial and insurance products 50,000 EUR for unlawful telephone advertising. The calls were particularly intrusive, callers falsely claimed to be an independent advice centre and presented sales calls as service calls; the company has appealed.

Authority / court

Bundesnetzagentur (BNetzA)

Area of law

Data protection · Marketing and consent

Legal basis

UWG – Verbot unerlaubter Telefonwerbung gegenüber Verbraucherinnen und Verbrauchern

Action

Fine

Status of proceedings

under appeal

Sector

Financial services and insurance

Checked against the official source on 2 Oct 2026 · Direct link

The ICO fined TMAC Ltd £100,000 and issued an enforcement notice. The ICO found that between 8 February and 24 September 2024 the company made 260,332 unsolicited marketing calls to numbers registered with the Telephone Preference Service (TPS). Recipients were also not given the caller details required by regulation 24 of PECR. The legal basis is regulations 21 and 24 of PECR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulations 21(1)(b) und 24 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 100,000 GBP, converted at the ECB reference rate of 3 Feb 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO fined Allay Claims Ltd £120,000 and issued an enforcement notice. The ICO found that the company had sent a large volume of unsolicited text messages promoting services to reclaim tax on PPI refunds; the enforcement notice gives the period as 1 February 2023 to 13 February 2024. The ICO found a serious breach of regulation 22 of PECR (electronic marketing without consent).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Marketing and consent

Legal basis

Regulation 22 PECR; section 55A DPA 1998

Action

Fine

Status of proceedings

unknown

Sector

Financial services and insurance

Original amount 120,000 GBP, converted at the ECB reference rate of 15 Jan 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The FTC finalised its order against General Motors and OnStar. According to the authority, GM used a misleading enrolment process to sign customers up for the OnStar service and the Smart Driver feature, collected precise location and driving behaviour data from millions of vehicles and sold it to third parties, including consumer reporting agencies, without clear notice and affirmative consent. GM may not disclose this data to consumer reporting agencies for five years and, for the 20-year term of the order, must obtain affirmative consent before collecting, using or sharing connected vehicle data, allow access and deletion, and offer a way to disable location collection; the order does not provide for any payment. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Marketing and consent

Legal basis

Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)

Action

Order

Status of proceedings

final

Sector

Automotive

Employees

10,000 or more

Published

14 Jan 2026

Checked against the official source on 3 Oct 2026 · Direct link

Following numerous complaints about marketing calls for the gas supplier ZENITH, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that the call centre engaged had insufficient security measures and called persons without valid consent. By Decision 44/2025, One Way received 40,000 EUR each as processor and as controller, together with an order to delete the data of persons without valid consent; ZENITH and two other service providers were also held liable (10,000, 10,000 and 5,000 EUR).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 29, 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link