Compliance Radar

Who was sanctioned, and for what?

Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.

EU Public sector Clear all filters

38cases from 15 jurisdictions

€20.2mTotal of monetary amounts (34 cases with an amount)

€7.86mLargest single case: AS "Latvijas valsts meži"

€30,974Median per case with an amount

Click a bar to drill down one level.

by amount by number of cases

Where?

by country

What for?

by area of law

All areas of law

Who?

by company

When?

per year, by date of decision

Trend
Period	Cases	Total
2022	3	€4.5m
2023	4	€182,500
2024	10	€391,751
2025	12	€940,138
2026	9	€14.2m

38 cases

Newest first Highest amounts

15 Sep 2026 Ministerstvo životního prostředí (Umweltministerium der Tschechischen Republik)Ministry of the Environment: 300,000 CZK over unresolved conflict of interest of an insurance broker CzechiaOther €12,350

In an insurance tender in 2024 worth around 200 million CZK, the ministry had parts of the tender documents drawn up by a broker who could later receive commissions from the winning insurer. As the contracting authority took no measures against the conflict of interest, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed a final fine of 300,000 CZK.

What organisations can take from it

External advisers who help draft tender documents must not benefit from the outcome – examine and document conflicts of interest before the tender.

Relevance to training and awareness

Conflicts of interest of external advisers in procurement procedures

Authority / court: Úřad pro ochranu hospodářské soutěže (ÚOHS)
Area of law: Other
Legal basis: Gesetz über die Vergabe öffentlicher Aufträge (Pflicht zur Vermeidung von Interessenkonflikten)
Action: Fine
Status of proceedings: final
Sector: Public sector
Culpability: negligent
Published: 15 Sep 2026

Original amount 300,000 CZK, converted at the ECB reference rate of 15 Sep 2026.

Sources

ÚOHS uložil pokutu 300 tisíc korun resortu životního prostředí kvůli neošetření možného střetu zájmů Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

3 Sep 2026 ASIS – Azienda Speciale per la gestione degli Impianti Sportivi (Trento)Garante: 8,000 EUR for cameras in swimming pool changing rooms of a Trentino sports operator ItalyVideo surveillance €8,000

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

What organisations can take from it

Changing rooms and comparably intimate areas are off limits for video surveillance – even when theft prevention is the motive.

Authority / court: Garante per la protezione dei dati personali
Area of law: Data protection · Video surveillance
Legal basis: Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Published: 11 Sep 2026

Sources

Newsletter del 11 settembre 2026 – Garante privacy Press release of an authority
Garante – Provvedimento n. 619 del 3 settembre 2026 [10294255] (ASIS Trento) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

25 Aug 2026 Health Service Executive (HSE)Irish health service HSE: 645,000 EUR for neglected paper patient records IrelandData breaches and data security €645,000

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

What organisations can take from it

Data protection also applies to paper archives in disused buildings – retention requires an inventory, erasure periods and physical security.

Relevance to training and awareness

Physical security and retention of paper records

Authority / court: Data Protection Commission (DPC)
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1
Action: Fine
Status of proceedings: final
Sector: Public sector
Employees: 10,000 or more
Published: 2 Sep 2026

Sources

Data Protection Commission announces Final Decision following Inquiry into the Health Service Executive (HSE) Press release of an authority
EDPB – DPC announces Final Decision following Inquiry into the HSE Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

4 Aug 2026 AS "Latvijas valsts meži"7.86 million EUR against Latvijas valsts meži for breach of competitive neutrality LatviaCompetition law €7.86m

From 2020 to April 2026, on the basis of old long-term logging contracts, the state forestry group supplied six wood processors with guaranteed quantities of roundwood outside public auctions, while all others could only buy through auctions. In its first decision on the competitive neutrality of public undertakings, the Konkurences padome (Latvian Competition Council) imposed 7,859,606.89 EUR and required equal sales conditions for all qualified bidders.

What organisations can take from it

State-owned companies must allocate resources without discrimination – review historical special contracts regularly for competitive neutrality.

Authority / court: Konkurences padome (Lettischer Wettbewerbsrat)
Area of law: Competition law
Legal basis: Art. 14.1 Konkurences likums (Wettbewerbsneutralität)
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Published: 13 Aug 2026

Sources

Konkurences padome konstatē konkurences neitralitātes pārkāpumu AS „Latvijas valsts meži“ darbībā (13.08.2026) Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

28 Jul 2026 Ελληνική Εταιρεία Τοπικής Ανάπτυξης και Αυτοδιοίκησης Α.Ε. (EETAA) und Υπουργείο Κοινωνικής Συνοχής και ΟικογένειαςCyber attack on EETAA systems: EUR 350,000 against social affairs ministry and operator GreeceData breaches and data security €350,000

A large-scale breach affected EETAA information systems used to implement programmes of the Ministry of Social Cohesion and Family; identification, contact, financial and health data of a large number of people were affected. The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) attributed the success of the attack to outdated systems and inadequate security measures and criticised the absence of a data processing agreement. In Decision 15/2026 it imposed a total of EUR 350,000 (ministry EUR 150,000 under Art. 5(1)(f)/Art. 32 and EUR 50,000 under Art. 28(3) GDPR; EETAA EUR 100,000 under Art. 32 and EUR 50,000 under Art. 28(3) GDPR) and ordered the agreement to be concluded and the planned security measures implemented within one month.

What organisations can take from it

Running legacy systems despite known risks and leaving controller and processor roles without a contract creates liability on both sides.

Relevance to training and awareness

Outdated IT systems and missing data processing agreements in the public sector

Authority / court: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 5 Abs. 1 lit. f, Art. 28 Abs. 3, Art. 32 Abs. 1, Art. 58 Abs. 2 lit. d und i DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Mitigating circumstances: According to the authority, the ministry met its breach notification and communication obligations.

Sources

ΑΠΟΦΑΣΗ 15/2026 (Αθήνα, 28 Ιουλίου 2026) Decision of an authority
Αρχή Προστασίας Δεδομένων – Πράξεις της Αρχής: Απόφαση για περιστατικό παραβίασης προσωπικών δεδομένων ΕΕΤΑΑ (Ημερομηνία 28/07/2026) Enforcement database of an authority

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

23 Mar 2026 Region SyddanmarkRegion Syddanmark: GDPR fine over exposed research database halved on appeal DenmarkData breaches and data security €66,919

In December 2024 the Kolding City Court fined the Region Syddanmark (Region of Southern Denmark) 1,000,000 DKK for two breaches of the duty to ensure appropriate data security. On 23 March 2026 the Vestre Landsret (Western High Court) upheld only the first charge – in a research and clinical database, logged-in users could access PDF documents of more than 23,000 registered persons, including health data of minors in psychiatric care, by changing the URL – and reduced the fine to 500,000 DKK; it acquitted the region of the charge concerning patient data in a presentation on its website.

What organisations can take from it

Access rights must be checked server-side for every document; an editable URL is not access control.

Relevance to training and awareness

Access control in web applications (manipulable URLs)

Authority / court: Retten i Kolding; Vestre Landsret (auf Anzeige der Datatilsynet)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 32 Abs. 1, Art. 83 Abs. 4 lit. a und Abs. 9 DSGVO; databeskyttelseslovens § 41 stk. 1 nr. 1, stk. 3 og 6
Action: Fine
Status of proceedings: reduced
Sector: Public sector
Culpability: negligent
Repeat case: yes

Original amount 500,000 DKK, converted at the ECB reference rate of 23 Mar 2026.

Sources

Datatilsynet: Region Syddanmark indstilles til bøde (2021, mit Update zu Byret und Landsret) Press release of an authority
Retten i Kolding, dom 23.12.2024, SS-5399/2023-KOL (Domsdatabasen) Court decision
Vestre Landsret, dom 23.03.2026, SS-113/2025-VLR (Domsdatabasen, ECLI:DK:VLR:2026:SS0000000101) Court decision

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

3 Feb 2026 Gemeenten Delft, Ede, Eindhoven u. a. (10 Gemeinden)AP: €25,000 each for ten municipalities over analyses of Muslim communities NetherlandsData protection €250,000

Ten municipalities (Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal and Zoetermeer) had received, stored and used analyses of the local Islamic community prepared by an external research firm (mostly so-called power-field analyses, in Haarlemmermeer a quick scan), which also contained information on the religion and other sensitive characteristics of individuals. On 3 February 2026 the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed 25,000 EUR on each board in separate decisions (250,000 EUR in total); for seven municipalities it also restricted further processing of the analyses to handling data subject rights and court proceedings.

What organisations can take from it

Anyone taking over externally prepared reports containing information on religion or belief is themselves processing special category data and needs their own exemption for doing so.

Relevance to training and awareness

Special category personal data in security analyses

Authority / court: Autoriteit Persoonsgegevens (AP)
Area of law: Data protection
Legal basis: Art. 5 Abs. 1 lit. a i. V. m. Art. 6 Abs. 1 und Art. 9 Abs. 1 DSGVO (AVG); Verarbeitungsbeschränkung nach Art. 58 Abs. 2 DSGVO (sieben Bescheide)
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Published: 5 Feb 2026

Sources

AP – Boetebesluiten tien gemeenten voor illegaal verwerken van informatie islamitische mensen (Dokumentseite) Decision of an authority
AP – Boetebesluiten 10 Nederlandse gemeenten (Sammel-PDF), 3 februari 2026 Decision of an authority

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

22 Jan 2026 France TravailCNIL: 5 million EUR against France Travail after social engineering attack FranceData breaches and data security €5m

In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.

What organisations can take from it

Accounts of external partners with extensive data access need strong authentication, narrow rights and anomaly detection – and their users need training against social engineering.

Relevance to training and awareness

Social engineering and account takeover

Authority / court: Commission nationale de l'informatique et des libertés (CNIL)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 32 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Employees: 10,000 or more
Published: 29 Jan 2026

Sources

Violation de données : sanction de 5 millions d'euros à l'encontre de FRANCE TRAVAIL Press release of an authority
CNIL – Les sanctions prononcées par la CNIL (Eintrag 22/01/2026) Enforcement database of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

8 Jan 2026 Αρχηγείο Πυροσβεστικού Σώματος (Hauptquartier der griechischen Feuerwehr)Greece: 10,000 EUR against Fire Service Headquarters over health data in duty log GreeceEmployee data €10,000

In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.

What organisations can take from it

Employees’ health information never belongs in generally accessible official records – the reason for an absence generally does not need to be disclosed.

Relevance to training and awareness

Confidential handling of employees’ health data

Authority / court: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)
Area of law: Data protection · Employee data
Legal basis: Art. 5 Abs. 1 lit. a und c DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector

Sources

Απόφαση 1/2026 της Αρχής Προστασίας Δεδομένων Προσωπικού Χαρακτήρα Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

15 Dec 2025 Stichting Hogeschool van Arnhem en Nijmegen (HAN University of Applied Sciences)Netherlands: 175,000 EUR against HAN university over inadequate security after hack NetherlandsData breaches and data security €175,000

In 2021, a hacker gained access via a web form to a web server and a database server of the university, obtained, among other things, names with passwords and citizen service numbers of students and staff, and unsuccessfully demanded a ransom. According to the Dutch data protection authority (Autoriteit Persoonsgegevens, AP), security was not aligned with the risks, and the rights of a database account were not restricted.

What organisations can take from it

Give database accounts of web applications minimal rights so that a single vulnerability does not expose the entire data set.

Authority / court: Autoriteit Persoonsgegevens (AP)
Area of law: Data protection · Data breaches and data security
Legal basis: DSGVO Art. 32
Action: Fine
Status of proceedings: final
Sector: Public sector
Culpability: negligent
Mitigating circumstances: Settlement without objection; active damage limitation, strengthened resilience and sharing of lessons learned with other organisations.
Published: 17 Dec 2025

Sources

HAN krijgt boete van 175.000 euro voor onvoldoende beveiliging van persoonsgegevens Press release of an authority
Boete HAN Decision of an authority
AP: Besluit tot oplegging van een bestuurlijke boete aan Stichting Hogeschool van Arnhem en Nijmegen Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

10 Dec 2025 University of LimerickDPC: €98,000 fine against University of Limerick after phishing of staff mailboxes IrelandData breaches and data security €98,000

Between 2018 and 2020 the university notified twelve personal data breaches, six of which involved unauthorised persons gaining access to staff email accounts through phishing and in some cases setting up forwarding rules. The DPC found infringements of Art. 5(1)(f), 30(1), 32(1), 33(1) and 34(1) GDPR, issued a reprimand and imposed fines of €45,000, €3,000, €35,000 and €15,000, totalling €98,000.

What organisations can take from it

Phishing protection for mailboxes and clear internal reporting channels determine whether data breaches are reported to the authority and affected persons on time.

Relevance to training and awareness

Recognising phishing and reporting data breaches within 72 hours

Missing or inadequate training played a role in the decision.

Authority / court: Data Protection Commission (DPC)
Area of law: Data protection · Data breaches and data security
Legal basis: Art. 5(1)(f), 30(1), 32(1), 33(1), 34(1) DSGVO; ss. 110–111 Data Protection Act 2018
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Mitigating circumstances: The university accepted most of the findings, acknowledged responsibility and improved its systems, training and policies; the fines are well below those in the draft and no remedial order was made.

Sources

DPC: Inquiry concerning the University of Limerick (IN-19-7-1) Decision of an authority

Checked against the official source on 2 Oct 2026 · Direct link

Report an error

23 Oct 2025 Comune di CurtaroloMunicipality of Curtarolo: 15,000 EUR for video surveillance of streets and employees ItalyVideo surveillance €15,000

The municipality in the province of Padua monitored public streets and work areas without a sound legal basis, without adequate information and without a data protection impact assessment; recordings were used for disciplinary purposes, and an employee was secretly filmed while on sick leave. Italy's data protection authority (Garante per la protezione dei dati personali) imposed a fine of 15,000 EUR (5,000 EUR for public surveillance, 10,000 EUR for workplace surveillance).

What organisations can take from it

Do not repurpose video recordings for disciplinary proceedings; specific employment law protections apply to employees.

Relevance to training and awareness

Purpose limitation in video surveillance and employee data

Authority / court: Garante per la protezione dei dati personali
Area of law: Data protection · Video surveillance
Legal basis: DSGVO Art. 5, 6, 12, 13, 35, 88
Action: Fine
Status of proceedings: final
Sector: Public sector

Sources

Provvedimento del 23 ottobre 2025 [10196164] Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

23 Oct 2025 Komornik Sądowy przy Sądzie Rejonowym w S. (Gerichtsvollzieherkanzlei, im Bescheid pseudonymisiert)Bailiff: 20,900 PLN – documents with PESEL number misdirected, not notified PolandIncident reporting obligations €4,938

In October 2023, an uninvolved person received a debtor’s enforcement documents containing name, address, date of birth, PESEL number, amount of the claim and employer. The bailiff’s office neither notified the supervisory authority nor informed the data subject; the UODO (Poland’s data protection authority) imposed 7,700 PLN for the failure to notify and 13,200 PLN for the failure to inform the data subject, and ordered the data subject to be informed within three days.

What organisations can take from it

Where identification numbers such as the PESEL number are disclosed, a high risk can almost always be assumed – notification of the authority and of the data subject is then mandatory.

Relevance to training and awareness

Checking postal mailings; notifying data breaches involving identification numbers

Authority / court: Prezes Urzędu Ochrony Danych Osobowych (UODO)
Area of law: Information security and cyber · Incident reporting obligations
Legal basis: Art. 33 Abs. 1, Art. 34 Abs. 1 und 2 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector

Original amount 20,900 PLN, converted at the ECB reference rate of 23 Oct 2025.

Sources

UODO, Decyzja DKN.5131.17.2024 vom 23.10.2025 (nicht rechtskräftig) Decision of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

10 Oct 2025 Ministerstvo vnútra Slovenskej republikySlovakia: another EUR 70,000 fine for the interior ministry over transfers of whistleblowers SlovakiaRetaliation against whistleblowers €70,000

The Slovak Whistleblower Protection Office again fined the Ministry of Interior, this time 70,000 EUR. From the end of August 2024 the ministry had issued personnel orders, without the Office's consent, against five protected whistleblowers in the police service, transferring them and removing them from their posts. The President of the Office dismissed the appeal on 24 November 2025.

What organisations can take from it

An organisation already sanctioned for measures against whistleblowers needs a binding approval process that checks every personnel decision against the protection register.

Relevance to training and awareness

Consent requirement before personnel measures against protected whistleblowers

Authority / court: Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)
Area of law: Whistleblower protection · Retaliation against whistleblowers
Legal basis: § 7 Abs. 1, § 19 Abs. 3 Zákon č. 54/2019 Z. z. (Hinweisgeberschutzgesetz)
Action: Fine
Status of proceedings: final
Sector: Public sector
Repeat case: yes
Liability of senior managers: The fine was imposed on the body as employer.

Sources

Úrad na ochranu oznamovateľov – Rozhodnutia úradu (2025, Nr. 8) Official register or notice
Rozhodnutie sp. zn. UOO-471/2025, č. z. 5152/2025 zo dňa 10. 10. 2025 Decision of an authority
Rozhodnutie o odvolaní sp. zn. UOO-729/2025, č. r. 6039/2025 zo dňa 24. 11. 2025 Decision of an authority

Checked against the official source on 28 Sep 2026 · Direct link

Report an error

4 Sep 2025 Einheitlicher Abwicklungsausschuss (Single Resolution Board, SRB)CJEU: pseudonymised data in disclosure to Deloitte – EDPS v SRB EU levelData subject rights and transparency –

The Single Resolution Board (SRB) passed on pseudonymised comments from former Banco Popular shareholders to Deloitte without informing the data subjects; the European Data Protection Supervisor (EDPS) considered this an infringement of the duty to inform. The Court of Justice of the European Union (Case C-413/23 P) set aside the judgment of the General Court and clarified that the duty to inform is to be assessed from the controller's perspective at the time of collection; the case was referred back to the General Court.

What organisations can take from it

Pseudonymisation does not release the controller from informing data subjects about the recipients of their data.

Authority / court: Gerichtshof der Europäischen Union, Rs. C-413/23 P
Area of law: Data protection · Data subject rights and transparency
Legal basis: Verordnung (EU) 2018/1725 (Informationspflicht)
Status of proceedings: under appeal
Sector: Public sector
Published: 4 Sep 2025

Sources

Press Release No 107/25: Judgment of the Court in Case C-413/23 P EDPS v SRB Court press release

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

24 Jul 2025 Slovenský pozemkový fondSlovak Land Fund: 6,000 EUR for late examination of a whistleblower report SlovakiaMissing or inadequate reporting channel €6,000

The state land fund examined a report from September 2022 only after 128 days and, until November 2024, did not sufficiently inform employees about the reporting procedure, protection options and the responsible person. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 6,000 EUR.

What organisations can take from it

Whistleblower reports are subject to statutory examination deadlines – anyone who misses them and does not publicise the procedure will be sanctioned.

Relevance to training and awareness

Deadlines and transparency in the internal reporting system

Authority / court: Úrad na ochranu oznamovateľov (Slowakei)
Area of law: Whistleblower protection · Missing or inadequate reporting channel
Legal basis: § 10 Abs. 5 und 8, § 19 Gesetz Nr. 54/2019 über den Schutz von Hinweisgebern
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Culpability: negligent

Sources

Rozhodnutie ÚOO z 24. 7. 2025, UOO-277/2025 (Slovenský pozemkový fond) Decision of an authority

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Report an error

16 Jun 2025 Ústredie práce, sociálnych vecí a rodinyCentral Office ÚPSVaR: 5,000 EUR – reporting office for children’s homes not operated SlovakiaMissing or inadequate reporting channel €5,000

For months, the central authority failed to perform the tasks of the reporting office for three centres for children and families under its authority and did not make the responsible person known to employees. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 5,000 EUR; the appeal decision of 12 September 2025 reworded the operative part but left the fine at 5,000 EUR.

What organisations can take from it

Anyone running the reporting office for subordinate units must also make it visible there and handle reports from those units.

Authority / court: Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)
Area of law: Whistleblower protection · Missing or inadequate reporting channel
Legal basis: Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 3 und 5, § 19 Abs. 3
Action: Fine
Status of proceedings: final
Sector: Public sector

Sources

ÚOO, Rozhodnutie vom 16.06.2025 (UOO-104/2025), ÚPSVaR Decision of an authority
ÚOO, Berufungsentscheidung vom 12.09.2025 Decision of an authority
Úrad na ochranu oznamovateľov: Rozhodnutia úradu (Liste der Entscheidungen) Official register or notice

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

12 Jun 2025 Department of Social Protection (DSP)DPC: 550,000 EUR against Irish social protection ministry over facial matching without legal basis IrelandData subject rights and transparency €550,000

For registration for the Public Services Card, the ministry created biometric facial templates of a large part of the population without a sufficiently clear legal basis, with deficient information and an incomplete data protection impact assessment. Ireland's Data Protection Commission (DPC) issued a reprimand, imposed 550,000 EUR and ordered the biometric processing to be stopped within nine months if no valid legal basis is found.

What organisations can take from it

Biometric procedures require a precise statutory basis and a complete impact assessment before they are rolled out widely.

Authority / court: Data Protection Commission (DPC)
Area of law: Data protection · Data subject rights and transparency
Legal basis: Art. 5 Abs. 1 lit. a und e, Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 Abs. 7 DSGVO
Action: Fine
Status of proceedings: unknown
Sector: Public sector
Mitigating circumstances: No deficiencies were found in the technical and organisational security measures.
Published: 12 Jun 2025

Sources

DPC announces conclusion of investigation into use of facial matching technology in connection with the Public Services Card Press release of an authority

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

9 Apr 2025 Slovenské národné múzeumSlovak National Museum: 7,000 EUR – employees not informed about reporting system SlovakiaMissing or inadequate reporting channel €7,000

The museum published no information on the protection options or on the external reporting channel and could not prove that employees were familiar with the internal reporting rules – there were no signature lists and no proof of intranet access. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 7,000 EUR.

What organisations can take from it

Informing employees about the reporting system must be documented – without proof, it is deemed not to have taken place.

Relevance to training and awareness

Informing employees about internal and external reporting channels

Missing or inadequate training played a role in the decision.

Authority / court: Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)
Area of law: Whistleblower protection · Missing or inadequate reporting channel
Legal basis: Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 5, § 19 Abs. 3
Action: Fine
Status of proceedings: unknown
Sector: Public sector

Sources

ÚOO, Rozhodnutie vom 09.04.2025 (UOO-195/2025), Slovenské národné múzeum Decision of an authority
Úrad na ochranu oznamovateľov: Rozhodnutia úradu (Liste der Entscheidungen) Official register or notice

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

14 Feb 2025 Obec SološnicaMunicipality of Sološnica: 200 EUR – contradictory reporting rules and missing information on protection SlovakiaMissing or inadequate reporting channel €200

The municipality did not publish any information on the protection available to whistleblowers and at times had two valid, contradictory sets of rules on the internal reporting procedure online without stating which applied. The Office imposed a fine of 200 EUR.

What organisations can take from it

Reporting rules must be unambiguous and up to date – remove outdated versions from the internet.

Authority / court: Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)
Area of law: Whistleblower protection · Missing or inadequate reporting channel
Legal basis: Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 5, § 19 Abs. 2
Action: Fine
Status of proceedings: unknown
Sector: Public sector

Sources

ÚOO, Rozhodnutie vom 14.02.2025 (UOO-178/2025), Obec Sološnica Decision of an authority
Úrad na ochranu oznamovateľov: Rozhodnutia úradu (Liste der Entscheidungen) Official register or notice

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Load 18 more of 18

How the radar is compiled

Official sources only

Every case is based on a decision, press release or database of an authority or a court. Press and law-firm reports count at most as additional references.

Four-eyes check

Whoever enters a case may not approve it. A second, independent check compares company, date, amount and area of law with the source. Only then is the case published.

Comparable amounts

Amounts are converted at the ECB reference rate on the day of the decision. Each case also shows the original amount.

Corrections on record

A correction is a new version that is checked again. Every change is logged. You can report errors directly on each case.

Case texts are translated from the German original. Where a translation is not yet available, the German text is shown and marked “(German original)”. Names of authorities, laws and companies are given as in the source (company names until they are anonymised).

Company names are anonymised two years after the decision in a case, in line with the practice of many supervisory authorities. The official sources remain linked.

The radar reports on published decisions and is not legal advice. Decisions that are not yet final are marked as such where the status is known.

Embed the radar on your website

Ready for training that actually lands?