Who was sanctioned, and for what?

In an insurance tender in 2024 worth around 200 million CZK, the ministry had parts of the tender documents drawn up by a broker who could later receive commissions from the winning insurer. As the contracting authority took no measures against the conflict of interest, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) imposed a final fine of 300,000 CZK.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Other

Legal basis

Gesetz über die Vergabe öffentlicher Aufträge (Pflicht zur Vermeidung von Interessenkonflikten)

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Published

15 Sep 2026

Original amount 300,000 CZK, converted at the ECB reference rate of 15 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Since 2007, the municipal sports facilities operator had had cameras in the changing rooms of a swimming pool that recorded the locker area. The Italian data protection authority (Garante per la protezione dei dati personali) found no sound legal basis, incomplete notices and a 72-hour retention period not justified by a necessity assessment, and imposed 8,000 EUR (Provvedimento No. 619); the cameras were removed during the proceedings.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 lit. c und e DSGVO; Art. 2-ter Codice privacy

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

In 2023, intruders gained access to two former psychiatric hospitals and posted videos of the patient records stored there online. An inspection of twelve sites found records with mould, water and animal damage in unsuitable rooms, up to and including shipping containers. Ireland's Data Protection Commission (DPC) imposed a fine of 645,000 EUR, issued a reprimand and ordered audits and the relocation of records.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. e und f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Public sector

Employees

10,000 or more

Published

2 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The UK Information Commissioner's Office (ICO) issued a reprimand to ACRO Criminal Records Office. According to the ICO, it followed a cyber incident that may have affected the personal data of around 10,000 people in the UK. The ICO found infringements of the duty to implement appropriate technical and organisational security measures under Article 32 UK GDPR. No fine was imposed.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32(1), 32(1)(b) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

From 2020 to April 2026, on the basis of old long-term logging contracts, the state forestry group supplied six wood processors with guaranteed quantities of roundwood outside public auctions, while all others could only buy through auctions. In its first decision on the competitive neutrality of public undertakings, the Konkurences padome (Latvian Competition Council) imposed 7,859,606.89 EUR and required equal sales conditions for all qualified bidders.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law

Legal basis

Art. 14.1 Konkurences likums (Wettbewerbsneutralität)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

A large-scale breach affected EETAA information systems used to implement programmes of the Ministry of Social Cohesion and Family; identification, contact, financial and health data of a large number of people were affected. The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) attributed the success of the attack to outdated systems and inadequate security measures and criticised the absence of a data processing agreement. In Decision 15/2026 it imposed a total of EUR 350,000 (ministry EUR 150,000 under Art. 5(1)(f)/Art. 32 and EUR 50,000 under Art. 28(3) GDPR; EETAA EUR 100,000 under Art. 32 and EUR 50,000 under Art. 28(3) GDPR) and ordered the agreement to be concluded and the planned security measures implemented within one month.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 28 Abs. 3, Art. 32 Abs. 1, Art. 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

According to the authority, the ministry met its breach notification and communication obligations.

Checked against the official source on 28 Sep 2026 · Direct link

The Metropolitan Police handed a defendant unredacted documents containing the new address and telephone number of a stalking victim, and in a circular e-mail disclosed 18 people with a parliamentary connection in an open recipient list. The UK Information Commissioner's Office (ICO) ordered improvements within 3 and 12 months, including in data protection training completion rates.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Data Protection Act 2018, Section 40

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Culpability

negligent

Published

5 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

In September 2022 the public TVET college mistakenly emailed reports verifying the qualifications and criminal records of three employees to other staff, informed neither the regulator nor those affected, and had not registered an information officer. Departing from the view of its Enforcement Committee, the regulator also treated this as impermissible further processing and found breaches of accountability, purpose limitation, security safeguards and the notification duty; on 22 May 2026 it ordered, among other things, registration, notification of the breach, a written apology, a compliance framework and POPIA training for all staff.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Employee data

Legal basis

Sections 8, 15(1), 19(1) und 22(1) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA

Action

Order

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The college recalled the email two days later, informed staff of the error and took action against those responsible; according to the regulator, this did not relieve it of the duty to notify.

Published

2 Jun 2026

Checked against the official source on 4 Oct 2026 · Direct link

Since 2020, the Canada Revenue Agency (CRA) has experienced more than 42,000 individual breaches in which unauthorised persons accessed tax accounts or changed data in order to redirect benefits. In a special report to Parliament, the Privacy Commissioner of Canada criticised, among other things, the delayed introduction of mandatory MFA and incomplete incident recording, and made nine recommendations, eight of which were accepted in full and one in part.

Authority / court

Office of the Privacy Commissioner of Canada (OPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act (Kanada)

Action

Other

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

7 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Cardiff University was fined £280,000 and ordered to pay £11,745 in costs after two employees developed occupational asthma from exposure to animal allergens. According to the Health and Safety Executive, the university failed from 2008 to 2025 to identify and implement suitable controls against allergen exposure, although the COSHH regulations and relevant guidance had long been in place.

Authority / court

Cardiff Magistrates' Court (Anklage: Health and Safety Executive)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 2(1) Health and Safety at Work etc. Act 1974

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

Guilty plea.

Published

1 May 2026

Original amount 280,000 GBP, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

In December 2024 the Kolding City Court fined the Region Syddanmark (Region of Southern Denmark) 1,000,000 DKK for two breaches of the duty to ensure appropriate data security. On 23 March 2026 the Vestre Landsret (Western High Court) upheld only the first charge – in a research and clinical database, logged-in users could access PDF documents of more than 23,000 registered persons, including health data of minors in psychiatric care, by changing the URL – and reduced the fine to 500,000 DKK; it acquitted the region of the charge concerning patient data in a presentation on its website.

Authority / court

Retten i Kolding; Vestre Landsret (auf Anzeige der Datatilsynet)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1, Art. 83 Abs. 4 lit. a und Abs. 9 DSGVO; databeskyttelseslovens § 41 stk. 1 nr. 1, stk. 3 og 6

Action

Fine

Status of proceedings

reduced

Sector

Public sector

Culpability

negligent

Repeat case

yes

Original amount 500,000 DKK, converted at the ECB reference rate of 23 Mar 2026.

Checked against the official source on 28 Sep 2026 · Direct link

In June and July 2020 contractors of the state-owned forestry corporation felled six giant trees and three hollow-bearing trees in Wild Cattle Creek State Forest near Coffs Harbour that should have been retained under the Coastal Integrated Forestry Operation Approval. On the EPA’s prosecution, the Land and Environment Court convicted the corporation and found harm to koala habitat and cultural harm to the Gumbaynggirr people; following a restorative justice conference, the AUD 450,000 penalty goes to the Yurruungga Aboriginal Corporation for remediation projects. The corporation must also commission an independent audit of its procedures and publish the conviction.

Authority / court

NSW Environment Protection Authority (EPA NSW) / Land and Environment Court of NSW

Area of law

Environment and sustainability · Emissions and permits

Legal basis

Coastal Integrated Forestry Operation Approval (NSW)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Repeat case

yes

Published

16 Mar 2026

Original amount 450,000 AUD, converted at the ECB reference rate of 16 Mar 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The ICO issued a reprimand to the City of London Police. The ICO found that between 1 April 2023 and 31 July 2025 the police force had failed to answer subject access requests within the statutory deadline. The ICO found this breached Article 12(3) UK GDPR and section 45(3) of the Data Protection Act 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 45(3) DPA 2018; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Ten municipalities (Delft, Ede, Eindhoven, Gooise Meren, Haarlemmermeer, Hilversum, Huizen, Tilburg, Veenendaal and Zoetermeer) had received, stored and used analyses of the local Islamic community prepared by an external research firm (mostly so-called power-field analyses, in Haarlemmermeer a quick scan), which also contained information on the religion and other sensitive characteristics of individuals. On 3 February 2026 the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed 25,000 EUR on each board in separate decisions (250,000 EUR in total); for seven municipalities it also restricted further processing of the analyses to handling data subject rights and court proceedings.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection

Legal basis

Art. 5 Abs. 1 lit. a i. V. m. Art. 6 Abs. 1 und Art. 9 Abs. 1 DSGVO (AVG); Verarbeitungsbeschränkung nach Art. 58 Abs. 2 DSGVO (sieben Bescheide)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

5 Feb 2026

Checked against the official source on 2 Oct 2026 · Direct link

In early 2024, attackers used social engineering to take over accounts of Cap Emploi advisers and accessed data on jobseekers from the last 20 years, including social security numbers. The French data protection authority (CNIL) criticised weak authentication, insufficient logging and overly broad access rights, and imposed 5 million EUR together with an order carrying a penalty payment of 5,000 EUR per day of delay.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Published

29 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

During a public order training exercise in February 2021, police officers wearing flame-retardant protective clothing had petrol bombs thrown at them; four officers suffered burns with permanent scarring. There was no information on the service life and testing of the PPE, no risk assessment for the manufacture and use of the petrol bombs, and no safe systems of work. The Health and Safety Executive (HSE) prosecution resulted in a fine of 60,000 GBP plus 9,470 GBP in costs.

Authority / court

Health and Safety Executive (Sheffield Magistrates' Court)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Health and Safety at Work etc. Act 1974, s. 2(1)

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

20 Jan 2026

Original amount 60,000 GBP, converted at the ECB reference rate of 19 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In June 2023, a lamp post dating from the 1950s/60s, whose steel at the base was at least 60 % rusted through, fell over and seriously injured a pedestrian. The post had been rated as poor in 2022 but was not scheduled for replacement until 2024; the council's visual inspections did not identify the acute risk of collapse. The Health and Safety Executive (HSE) prosecution resulted in a fine of 80,000 GBP.

Authority / court

Health and Safety Executive (Glasgow Sheriff Court)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Health and Safety at Work etc. Act 1974, s. 3(1)

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

12 Jan 2026

Original amount 80,000 GBP, converted at the ECB reference rate of 8 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In a daily orders book of a fire service unit that was accessible to staff, not only the transfer of a female officer to light duties was recorded, but also her illness, the treatment and the medication prescribed. The Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found a breach of lawfulness and data minimisation and, by Decision 1/2026, imposed a fine of 10,000 EUR on the Fire Service Headquarters.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a und c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

In 2021, a hacker gained access via a web form to a web server and a database server of the university, obtained, among other things, names with passwords and citizen service numbers of students and staff, and unsuccessfully demanded a ransom. According to the Dutch data protection authority (Autoriteit Persoonsgegevens, AP), security was not aligned with the risks, and the rights of a database account were not restricted.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32

Action

Fine

Status of proceedings

final

Sector

Public sector

Culpability

negligent

Mitigating circumstances

Settlement without objection; active damage limitation, strengthened resilience and sharing of lessons learned with other organisations.

Published

17 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

The ICO fined the Police Service of Scotland £66,000 and also issued a reprimand. The ICO found that, during a criminal investigation, the police carried out a bulk download of data from the mobile phone of an employee who had made a complaint, without ensuring that this was lawful, fair and limited to what was necessary; it found infringements for the period 18 January to 5 April 2021. For this the ICO issued the reprimand under sections 35 and 37 DPA 2018 (Part 3). The ICO also found that the Professional Standards Department later disclosed this data without authorisation to the person accused, in an internal misconduct investigation. Appropriate technical and organisational measures for compiling such misconduct packs were missing, and the breach was only reported to the ICO on 30 June 2022, although the police had known of it since 17 June 2022. For these infringements the ICO imposed the fine. The combined notice relies, among other provisions, on Articles 5(1)(f) and 32(1) UK GDPR (security of processing), Articles 5(1)(c) and 25 UK GDPR (data minimisation, data protection by design) and Article 33(1) UK GDPR (breach notification).

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(c), 5(1)(f), 25(1)-(2), 32(1) und 33(1) UK GDPR; section 155 DPA 2018 (Geldbuße); sections 35 und 37 DPA 2018 (Part 3), Verwarnung nach Schedule 13 para 2(c) DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 66,000 GBP, converted at the ECB reference rate of 12 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Between 2018 and 2020 the university notified twelve personal data breaches, six of which involved unauthorised persons gaining access to staff email accounts through phishing and in some cases setting up forwarding rules. The DPC found infringements of Art. 5(1)(f), 30(1), 32(1), 33(1) and 34(1) GDPR, issued a reprimand and imposed fines of €45,000, €3,000, €35,000 and €15,000, totalling €98,000.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 30(1), 32(1), 33(1), 34(1) DSGVO; ss. 110–111 Data Protection Act 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The university accepted most of the findings, acknowledged responsibility and improved its systems, training and policies; the fines are well below those in the draft and no remedial order was made.

Checked against the official source on 2 Oct 2026 · Direct link

The municipality had processed personal information of a former employee which was exposed on the internet; the Information Regulator treated this as a gross violation of privacy and issued an enforcement notice. Because the municipality did not implement the corrective instructions, an administrative fine of ZAR 500,000 followed; as it did not pay, the Regulator has initiated court proceedings to recover the amount.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Employee data

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Nov 2025

Original amount 500,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Checked against the official source on 4 Oct 2026 · Direct link

The municipality in the province of Padua monitored public streets and work areas without a sound legal basis, without adequate information and without a data protection impact assessment; recordings were used for disciplinary purposes, and an employee was secretly filmed while on sick leave. Italy's data protection authority (Garante per la protezione dei dati personali) imposed a fine of 15,000 EUR (5,000 EUR for public surveillance, 10,000 EUR for workplace surveillance).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

DSGVO Art. 5, 6, 12, 13, 35, 88

Action

Fine

Status of proceedings

final

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

In October 2023, an uninvolved person received a debtor’s enforcement documents containing name, address, date of birth, PESEL number, amount of the claim and employer. The bailiff’s office neither notified the supervisory authority nor informed the data subject; the UODO (Poland’s data protection authority) imposed 7,700 PLN for the failure to notify and 13,200 PLN for the failure to inform the data subject, and ordered the data subject to be informed within three days.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

Art. 33 Abs. 1, Art. 34 Abs. 1 und 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 20,900 PLN, converted at the ECB reference rate of 23 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The Slovak Whistleblower Protection Office again fined the Ministry of Interior, this time 70,000 EUR. From the end of August 2024 the ministry had issued personnel orders, without the Office's consent, against five protected whistleblowers in the police service, transferring them and removing them from their posts. The President of the Office dismissed the appeal on 24 November 2025.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

§ 7 Abs. 1, § 19 Abs. 3 Zákon č. 54/2019 Z. z. (Hinweisgeberschutzgesetz)

Action

Fine

Status of proceedings

final

Sector

Public sector

Repeat case

yes

Liability of senior managers

The fine was imposed on the body as employer.

Checked against the official source on 28 Sep 2026 · Direct link

The ICO issued an enforcement notice to South Wales Police over serious delays in handling subject access requests. The ICO found that from April 2023 to March 2024 the force answered only 29% of requests on time; in August 2025, 352 requests were overdue, one of them by almost two years. The ICO ordered the force to clear the backlog by June 2026. The legal basis is Articles 12(3), 15(1) and 15(3) UK GDPR and section 45 of the Data Protection Act 2018. According to the notice, the force employs almost 3,000 police officers and over 2,200 other staff.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; section 45 DPA 2018; section 149 DPA 2018

Action

Order

Status of proceedings

unknown

Sector

Public sector

Employees

1,000 to 9,999

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Single Resolution Board (SRB) passed on pseudonymised comments from former Banco Popular shareholders to Deloitte without informing the data subjects; the European Data Protection Supervisor (EDPS) considered this an infringement of the duty to inform. The Court of Justice of the European Union (Case C-413/23 P) set aside the judgment of the General Court and clarified that the duty to inform is to be assessed from the controller's perspective at the time of collection; the case was referred back to the General Court.

Authority / court

Gerichtshof der Europäischen Union, Rs. C-413/23 P

Area of law

Data protection · Data subject rights and transparency

Legal basis

Verordnung (EU) 2018/1725 (Informationspflicht)

Status of proceedings

under appeal

Sector

Public sector

Published

4 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued an enforcement notice to Bristol City Council because it found that the council had not responded to subject access requests as required by law. The notice relies on Articles 12(3), 15(1) and 15(3) UK GDPR and examines, among other things, the period from 1 April 2023 to 31 March 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; section 149 DPA 2018

Action

Order

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The state land fund examined a report from September 2022 only after 128 days and, until November 2024, did not sufficiently inform employees about the reporting procedure, protection options and the responsible person. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 6,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakei)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

§ 10 Abs. 5 und 8, § 19 Gesetz Nr. 54/2019 über den Schutz von Hinweisgebern

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Culpability

negligent

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

For months, the central authority failed to perform the tasks of the reporting office for three centres for children and families under its authority and did not make the responsible person known to employees. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 5,000 EUR; the appeal decision of 12 September 2025 reworded the operative part but left the fine at 5,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 3 und 5, § 19 Abs. 3

Action

Fine

Status of proceedings

final

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

For registration for the Public Services Card, the ministry created biometric facial templates of a large part of the population without a sufficiently clear legal basis, with deficient information and an incomplete data protection impact assessment. Ireland's Data Protection Commission (DPC) issued a reprimand, imposed 550,000 EUR and ordered the biometric processing to be stopped within nine months if no valid legal basis is found.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und e, Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 Abs. 7 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

No deficiencies were found in the technical and organisational security measures.

Published

12 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

During mowing work in the municipal Parc des Sorbiers in July 2024, at least one nest of the protected bobolink was destroyed; a citizen reported the find. The city pleaded guilty under the Species at Risk Act and is paying 30,000 CAD.

Authority / court

Court of Québec (Anklage: Environment and Climate Change Canada)

Area of law

Environment and sustainability

Legal basis

Species at Risk Act, s. 33

Action

Fine

Status of proceedings

final

Sector

Public sector

Published

12 Jun 2025

Original amount 30,000 CAD, converted at the ECB reference rate of 12 Jun 2025.

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to South Yorkshire Police. The ICO found that during a data transfer in July 2023, carried out by a third-party supplier within the digital evidence management system, 96,174 original body-worn video recordings were accidentally deleted. The ICO found that the force lacked appropriate technical and organisational security measures and could not demonstrate compliance. The action was based on the law-enforcement processing rules in Part 3 of the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

section 34(3) und section 40 DPA 2018 (Part 3)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the London Borough of Hammersmith and Fulham. The ICO found that, in answering a Freedom of Information request, the council released a spreadsheet that contained hidden data. This exposed personal data of 6,528 people, 2,342 of them children. The ICO criticised inadequate security measures and a failure to demonstrate compliance.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 5(2), 24(1), 32(1)(b) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the Chief Constable of Greater Manchester Police. The ICO found that, because of a persistent backlog of historic requests, the force repeatedly failed to answer subject access requests on time. The ICO found infringements of both the UK GDPR and the law-enforcement provisions of the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) und Art. 15 UK GDPR; section 45 und section 54 DPA 2018 (Part 3); Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The museum published no information on the protection options or on the external reporting channel and could not prove that employees were familiar with the internal reporting rules – there were no signature lists and no proof of intranet access. The Úrad na ochranu oznamovateľov (Slovak Whistleblower Protection Office) imposed 7,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 5, § 19 Abs. 3

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to the Chief Constable of Greater Manchester Police. The ICO found that CCTV footage from a police station custody suite in 2021, which was to be retained because of serious allegations against officers, was not checked for completeness when it was preserved and was partly lost. In addition, the individual concerned did not receive their data on time after a subject access request. The action was based on the law-enforcement processing rules in the DPA 2018.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

section 45(3)(a) und (b) DPA 2018; sechster Datenschutzgrundsatz (section 40 DPA 2018, Part 3)

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The municipality did not publish any information on the protection available to whistleblowers and at times had two valid, contradictory sets of rules on the internal reporting procedure online without stating which applied. The Office imposed a fine of 200 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 5, § 19 Abs. 2

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 25 Sep 2026 · Direct link

The ICO issued a reprimand to Glasgow City Council. The ICO found that between April 2023 and March 2024 the council answered only 45% of subject access requests within the statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to the City of Edinburgh Council. The ICO found that in 2023 the council failed to answer 40% of subject access requests within the one-month statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Employees

10,000 or more

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

An employee accidentally attached an Excel file containing data of 29,636 clients, including health data, to an e-mail sent to 292 clients. The Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found that measures to prevent data leakage had not been sufficiently tested and that the employee had not been involved in data classification and had been insufficiently instructed; fine of 9,000 EUR. Date = publication; source: archived copy.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 24 Abs. 1, Art. 32 Abs. 1 lit. b und d DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

21 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

Through a port between the internal and external networks that had been opened for convenience, attackers entered the e-litigation server of the National Court Administration and took 1,014 GB of case documents; the 4.7 GB that were recovered contained data on 17,998 people, including resident registration numbers. The authority criticised unencrypted documents, unchanged, easily guessed initial passwords on administrator accounts, missing security software on one server and a report only in December 2023, although there had been indications of the leak since April 2023. It imposed a penalty surcharge of 207,000,000 KRW and an administrative fine of 6,000,000 KRW (213,000,000 KRW in total), recommended disciplinary action and improvements and is publishing the imposition of the administrative fine on its website for one year.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 24(3), Art. 24-2(2), Art. 29, Art. 34(1) und (3); Sanktion nach Art. 34-2 a. F.

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Culpability

negligent

Mitigating circumstances

After an increase of 20%, the amount was reduced by 25%, taking into account protective efforts such as an ISMS certification (2020–2023).

Liability of senior managers

Measures against individuals are not set out here.

Published

9 Jan 2025

Original amount 213,000,000 KRW, converted at the ECB reference rate of 8 Jan 2025.

Checked against the official source on 4 Oct 2026 · Direct link

At least 1,000 former employees retained access after leaving to the KMD Nexus specialist system containing data on around 30,000 citizens; one former employee viewed 1,022 citizen records. In addition, an unauthorised person used an employee's login credentials for Office services containing information on around 5,000 people – both systems had been accessible from the internet for years without multi-factor authentication. The Danish data protection authority (Datatilsynet) reported the municipality to the police and proposed a fine of 350,000 to 400,000 DKK; the case is still pending before the courts, and no fine has been imposed so far.

Authority / court

Datatilsynet

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, Art. 32

Action

Other

Status of proceedings

unknown

Sector

Public sector

Published

27 Nov 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Nationaal Archief (Dutch National Archives) planned to publish the archive of the post-war special jurisdiction (CABR), with some 485,000 files on suspected collaboration, online and full-text searchable for everyone from January 2025. Because, in the AP's assessment, this would have disclosed special category and criminal data of people still alive without any statutory exemption, the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) issued a formal warning to the Minister of Education, Culture and Science as controller.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection

Legal basis

DSGVO (AVG), insbesondere Art. 9 und 10; förmliche Warnung vor einer voraussichtlich rechtswidrigen Verarbeitung

Action

Reprimand or warning

Status of proceedings

final

Sector

Public sector

Published

6 Dec 2024

Checked against the official source on 2 Oct 2026 · Direct link

After candidate lists for the 2024 elections were released without authorisation, the Information Regulator found inadequate organisational safeguards and issued an enforcement notice on 10 September 2024. Because the Electoral Commission did not demonstrate compliance within the deadline (31 days), an infringement notice with an administrative fine of ZAR 100,000 followed.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data breaches and data security

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice und Infringement Notice

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Nov 2024

Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2024.

Checked against the official source on 4 Oct 2026 · Direct link

Instead of designating its own responsible person, the body subordinate to the Ministry of Foreign Affairs, with at least 50 employees, had named the ministry’s secretary general and had not published the reporting channels in a way accessible to all employees. The Office imposed 2,000 EUR.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 1 und 5, § 19 Abs. 2

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Following a break-in into the district administration’s servers in which data were encrypted, services failed and social benefits were delayed. The Valstybinė duomenų apsaugos inspekcija (Lithuanian State Data Protection Inspectorate, VDAI) found insufficient malware protection, deficient management of rights and passwords, a lack of recovery and insufficient information of data subjects and imposed 9,000 EUR. Date = publication; source: archived copy.

Authority / court

Valstybinė duomenų apsaugos inspekcija (VDAI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 lit. b, c und d, Art. 34 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

18 Oct 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to Southend-on-Sea City Council. The ICO found that in a Freedom of Information response published on a public platform in May 2023, a spreadsheet contained hidden personal data of current and former staff, including contact, pay and health details. The error was only noticed months later. The ICO found a breach of the requirement for appropriate data security.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

In its response to a freedom of information request, a UK police service published an Excel file whose hidden worksheet contained the surnames, initials, rank and role of all its employees. The file was visible for just over two hours and was deleted after almost three hours; the police service assumed that it had fallen into the hands of militant groups.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 und 2

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Employees

1,000 to 9,999

Culpability

negligent

Mitigating circumstances

Application of the public sector approach; without it, the fine would have been £5.6 million.

Published

3 Oct 2024

Original amount 750,000 GBP, converted at the ECB reference rate of 26 Sep 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Sep 2026 · Direct link

The ANPD issued two reprimands to a Brazilian federal ministry because, through a vulnerability in an application programming interface of its access and permissions system, personal data such as name, date of birth, mother's name and address could be retrieved when valid CPF numbers were queried: one for inadequately informing data subjects about the security incident (Art. 48 LGPD) and one for insufficient security of the systems (Art. 49 LGPD). Corrective measures were attached, including correcting the notice on the website regarding data categories, risks and the reasons for the delayed information, and a timetable for technical measures; the Board of Directors rejected the appeal in December 2025 and confirmed the final implementation deadline of 31 December 2025 set by the enforcement unit.

Authority / court

Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 48 und 49 Lei nº 13.709/2018 (LGPD); Art. 55 § 2 I Regulamento de Fiscalização (Resolução CD/ANPD nº 1/2021)

Action

Reprimand or warning

Status of proceedings

final

Sector

Public sector

Published

9 Aug 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 9 Aug 2026 · Direct link

The ICO issued a reprimand to an academy in Essex with around 1,200 pupils aged 11 to 18. According to the ICO's findings, the school introduced facial recognition for cashless catering in March 2023 without first carrying out the required data protection impact assessment, which was only completed in November 2023. Until then it assumed consent unless parents had opted their children out, which in the ICO's view is not valid consent, and it did not seek advice from its data protection officer. The reprimand is based on an infringement of Article 35(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 35(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 22 Jul 2026 · Direct link

On 5 July 2024 the ICO issued an (updated) reprimand to a London borough council. According to the reprimand, it followed a ransomware attack that the council became aware of on 11 October 2020: the attacker was able to access and encrypt 440,000 files containing personal data, including special category data, relating to at least 280,000 residents and other people, including staff. According to the ICO's findings, patch management and user account management were inadequate, in breach of Articles 5(1)(f) and 32(1)(b) UK GDPR. The ICO had initially considered a fine but, taking into account its approach to the public sector and the circumstances of the case, decided on a reprimand.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Jul 2026 · Direct link

The Slovak Whistleblower Protection Office fined a ministry of the Slovak Republic 90,000 EUR. In October and November 2023 the ministry issued personnel orders against protected whistleblowers in the police service without the statutory consent of the Office, ten persons in the first-instance decision, such as temporary suspensions from service, transfers and removals from senior posts. The President of the Office upheld the fine in full on 23 October 2024 and discontinued the proceedings only for one individual act.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

§ 7 Abs. 1, § 19 Abs. 3 Zákon č. 54/2019 Z. z. (Hinweisgeberschutzgesetz)

Action

Fine

Status of proceedings

final

Sector

Public sector

Liability of senior managers

The fine was imposed on the body as employer.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 24 Jun 2026 · Direct link

Following a system change, both parents with custody gained access to letters from the municipal dental care service and automatically received letters containing, in some cases, protected addresses of the children – without any check as to whether the disclosure was permissible. The Danish Data Protection Agency (Datatilsynet) criticised the lack of change management; the municipality accepted a fine notice of 200,000 DKK.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32

Action

Fine

Status of proceedings

final

Sector

Public sector

Original amount 200,000 DKK, converted at the ECB reference rate of 27 May 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 May 2026 · Direct link

The ICO issued a reprimand to a UK public body. According to the ICO's findings, unknown attackers got into the body's on-premises email server from 24 August 2021 via a chain of known vulnerabilities; the data affected came mainly from the electoral register, with the names and home addresses of around 40 million people. The security patches for these vulnerabilities had been released in April and May 2021 but had not been applied. In addition, an audit found that 178 active accounts could be cracked quickly because their passwords were identical or similar to the initial passwords issued by the service desk. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 May 2026 · Direct link

The Archi Prostasias Dedomenon (Hellenic Data Protection Authority) examined on its own initiative a digital security monitoring system (including video surveillance and drones) and an access control system using fingerprints in reception and closed controlled facilities for third-country nationals. In a 2024 decision it imposed EUR 100,000 because no complete data protection impact assessment and no data protection by design were in place before procurement and deployment, and EUR 75,000 for unclear, incomplete and contradictory information and missing documents provided to the authority. The ministry must also achieve GDPR compliance within three months.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Video surveillance

Legal basis

Art. 25, 31, 35, 58 Abs. 2 lit. d und i DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Company name anonymised since 2 Apr 2026 · Direct link

After a ransomware attack in August 2023 on the technology park company, which is wholly owned by the Hong Kong government, data of 13,632 individuals were affected; data samples appeared on the dark web. On 2 April 2024 the PCPD (Privacy Commissioner for Personal Data, Hong Kong's data protection authority) found breaches of the data security duty (DPP 4(1)) and the retention limit (DPP 2(2)): brute-force attacks went undetected, remote access ran without multi-factor authentication, security audits were insufficient, the security policy lacked specificity, and data of 5,292 unsuccessful job applicants and former employees had been kept beyond the retention period. By enforcement notice, the company must among other things introduce multi-factor authentication, commission independent security audits every year and delete data held beyond the retention periods.

Authority / court

Privacy Commissioner for Personal Data (PCPD), Hongkong

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Data (Privacy) Ordinance (Cap. 486), Data Protection Principles 4(1) und 2(2); Enforcement Notice nach s. 50(1)

Action

Order

Status of proceedings

unknown

Sector

Public sector

Published

2 Apr 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 2 Apr 2026 · Direct link

The ICO issued a reprimand to a children's services company owned by an English city council but operating independently of it. According to the ICO's findings, on 10 November 2022 the trust sent a family a child protection plan that wrongly included information about another person, including a child's data and criminal offence data. Among other things, the ICO criticised the trust for being unable to show clear, role-specific procedures or policies explaining how staff in the department concerned should apply data protection in practice. It found infringements of Articles 5(1)(f), 32(1)(b) and 32(2) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1)(b) und 32(2) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Mar 2026 · Direct link

The ICO issued a reprimand to the body that oversees policing in London. According to the ICO's findings, a permissions error at its processor between 11 and 14 November 2022 made two web forms public, including a form for contacting the London Victims' Commissioner. Only on 23 February 2023 did a member of the public tell the body that users could view every query submitted through the form; 394 people were later notified. According to the ICO, there is no evidence that the data was ever accessed. The ICO found infringements of Articles 5(1)(f) and 32(1) UK GDPR. The published document is partly worded as a provisional decision ("provisionally decided"); the ICO lists the reprimand as issued on its case page and confirmed it in a press release of 14 March 2024. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 13 Mar 2026 · Direct link

The ICO issued a reprimand to the chief constable of an English police force. According to the ICO's findings, in February 2021 an officer photographed a person's identity document on her personal mobile phone and uploaded the image to a messaging app group used by several UK police forces and international law enforcement agencies to tackle vehicle crime; the person was not told about this. The ICO was concerned that the sustained use of the group went unnoticed by supervisors, which it saw as a sign of a lack of data protection awareness. It found an infringement of section 40 DPA 2018 (the security principle for law enforcement processing). The reprimand is dated 5 March 2024; the ICO case page lists the case under 15 March 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 40 DPA 2018; Verwarnung nach Art. 58(2)(b) UK GDPR/Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Mar 2026 · Direct link

The ICO issued a reprimand to the chief constable of an English police force. According to the ICO's findings, since at least January 2020 the force repeatedly linked and merged the records of two people with the same name and date of birth. This led to several incidents in which officers went to the wrong address, once when there were serious safeguarding concerns relating to domestic violence, and in which personal data was actually or potentially disclosed inappropriately. The ICO found infringements of sections 34(3), 38(1), 38(3), 40 and 57(1) DPA 2018. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Section 34(3), 38(1), 38(3), 40 und 57(1) DPA 2018; Verwarnung nach Art. 58(2)(b) UK GDPR/Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 Mar 2026 · Direct link

On 28 February 2024 the ICO served an enforcement notice on a UK government department and issued a warning at the same time. The case concerned a pilot in which up to 600 people who had arrived in the UK by irregular routes and were on immigration bail were monitored with GPS ankle tags. According to the ICO's findings, the department had not carried out a data protection impact assessment that met the legal requirements and could not demonstrate that the processing complied with the data protection principles, for example why less intrusive options would not have been enough (Articles 35 and 5(2) UK GDPR). The notice requires the department to update its policies, access guidance and privacy information for the data kept from the pilot; the warning under Article 58(2)(a) UK GDPR states that future processing on the same basis would be likely to infringe the law. The ICO published the case on 21 March 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Art. 35 und 5(2) UK GDPR; Enforcement Notice nach section 149 DPA 2018; Warnung nach Art. 58(2)(a) UK GDPR

Action

Order

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 28 Feb 2026 · Direct link

In an investigation into an online platform used by the local authority to collect personal data, the authority did not answer the requests for information of the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, Romanian data protection authority) despite a reprimand and a fine of RON 10,000. The ANSPDCP then set a periodic penalty payment of RON 159,000 for 53 days of delay by decision.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 18 Abs. 2 Legea nr. 102/2005 (Gesetz über die ANSPDCP)

Action

Other

Status of proceedings

unknown

Sector

Public sector

Published

6 Mar 2024

Original amount 159,000 RON, converted at the ECB reference rate of 20 Feb 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 20 Feb 2026 · Direct link

The ICO issued a reprimand to the chief constable of a police force in south-west England. According to the ICO's findings, the force had had a subject access backlog since 2018, so that for more than four years a large number of requests were not answered within the statutory one month, or three months where an extension was properly applied. Data protection is handled jointly with a neighbouring force through an alliance of the two forces set up in 2017; a reprimand in the same terms was issued to that force on the same day. The ICO found infringements of Article 12(3) UK GDPR and section 54 DPA 2018 (Part 3). The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 54 DPA 2018; Verwarnung nach Art. 58(2)(b) UK GDPR/Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Feb 2026 · Direct link

The ICO issued a reprimand to the chief constable of a police force in south-west England. According to the ICO's findings, the force had had a subject access backlog since 2018, so that for more than four years a large number of requests were not answered within the statutory one month, or three months where an extension was properly applied. Data protection is handled jointly with a neighbouring force through an alliance of the two forces set up in 2017; a reprimand in the same terms was issued to that force on the same day. The ICO found infringements of Article 12(3) UK GDPR and section 54 DPA 2018 (Part 3). The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) UK GDPR; section 54 DPA 2018; Verwarnung nach Art. 58(2)(b) UK GDPR/Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Feb 2026 · Direct link

The ANPD issued four reprimands to a regional education authority, among other things because it had not notified the persons affected by a security incident (Art. 48 LGPD), and for breaches of Arts. 37 and 38 LGPD and of the supervision regulation. On appeal, the Board of Directors upheld the reprimand for failure to notify in August 2024 and replaced the other three with a single reprimand for obstructing supervision, because the authority had not produced the requested evidence of its security measures.

Authority / court

Autoridade Nacional de Proteção de Dados (ANPD), Coordenação-Geral de Fiscalização

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 37, 38 und 48 Lei nº 13.709/2018 (LGPD); Art. 5 I Regulamento de Fiscalização (Resolução CD/ANPD nº 1/2021)

Action

Reprimand or warning

Status of proceedings

reduced

Sector

Public sector

Published

31 Jan 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 31 Jan 2026 · Direct link

From February 2021 to July 2023, the ministry had designated as the office responsible for reports an ‘anti-corruption unit’ that did not even exist in the organisational structure. A report from April 2022 had still not been examined at the time of the inspection in May 2023; the ministry’s appeal was unsuccessful on 22 April 2024.

Authority / court

Úrad na ochranu oznamovateľov (Slowakisches Amt für Hinweisgeberschutz)

Area of law

Whistleblower protection · Missing or inadequate reporting channel

Legal basis

Zákon č. 54/2019 Z. z. o ochrane oznamovateľov protispoločenskej činnosti, § 10 Abs. 1, 4, 5 und 7, § 19 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Jan 2026 · Direct link

In two EU-funded research projects, the city analysed footage from existing surveillance cameras, audio from microphones in public spaces and posts from social networks using AI methods, without any legal basis for this processing, and shared the data with project partners. The Garante (Italian data protection authority) imposed a fine of 50,000 EUR, prohibited further processing of the collected data and ordered its erasure.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Video surveillance

Legal basis

Art. 5 Abs. 1 lit. a, 6, 9, 10, 13, 14 und 35 DSGVO; Art. 2-ter, 2-sexies und 2-octies Codice privacy (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

Mitigating: video footage recorded only for a limited number of hours, action in good faith owing to an error of law (relying in part on the assessment of the city's own data protection officer) and public information about the projects.

Published

25 Jan 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 11 Jan 2026 · Direct link

On 20 December 2023 the ICO served an enforcement notice on a UK prosecuting authority. According to the ICO's findings, on 18 March 2018 a member of staff copied a case file concerning historic child abuse from one of its systems onto a personal, unencrypted USB stick in order to pass it to a colleague; the device later ended up with an unauthorised third party. The ICO treated this as a breach of the sixth data protection principle (security) under section 40 DPA 2018 and required the authority to take remedial steps. The ICO published the case on 18 January 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 40 DPA 2018; Enforcement Notice nach section 149(2)(a) DPA 2018

Action

Order

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Dec 2025 · Direct link

Following a cyber attack in 2019, data on millions of people from the IT system of the authority was published on the internet. The Court of Justice of the European Union ruled that the controller must prove the adequacy of its protective measures, can be liable even for attacks by third parties, and that the mere fear of misuse of data can constitute non-material damage.

Authority / court

Gerichtshof der Europäischen Union

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 24, Art. 32, Art. 82

Status of proceedings

unknown

Sector

Public sector

Published

14 Dec 2023

Checked against the official source on 28 Sep 2026 · Version 5 · Company name anonymised since 14 Dec 2025 · Direct link

The ICO fined a UK government department GBP 350,000. According to the ICO's findings, the handling of personal data by the ARAP team responsible for relocations from Afghanistan suffered from serious technical and organisational shortcomings. On 20 September 2021 the email addresses of 245 people were placed in the "To" field instead of BCC, putting their lives at risk; together with two similar incidents earlier in September 2021, 265 email addresses were disclosed. The ICO found an infringement of Article 5(1)(f) UK GDPR. It set the penalty at GBP 700,000 before halving it in line with its approach to public sector bodies. The notice is dated 7 December 2023; the ICO enforcement list shows it under 26 February 2024.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Geldbuße nach section 155 DPA 2018

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Original amount 350,000 GBP, converted at the ECB reference rate of 7 Dec 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link

The ICO issued a reprimand to an English multi-academy trust, which runs schools. According to the ICO, an unauthorised third party used compromised credentials to access and encrypt the trust's systems. According to the ICO's findings, appropriate technical measures were missing: the account lockout policy was inadequate and reversible password encryption was enabled, contrary to National Cyber Security Centre recommendations. The ICO found infringements of Articles 5(1)(f) and 32(1)(b) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 5(1)(f) und 32(1)(b) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Dec 2025 · Direct link

The ICO issued a reprimand to an English local council. According to the ICO's findings, a resident phoned the council with her new address, but a member of staff recorded it only in the notes rather than in the address field. The council then sent a letter containing the new address to her previous address, which she had shared with her ex-partner, even though it knew of domestic abuse allegations against him; he opened the letter. The ICO criticised the lack of a written process for address changes, the absence of alerts for vulnerable service users and incomplete data protection training. It found an infringement of Article 5(1)(f) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 29 Nov 2025 · Direct link

Using chips in residual waste bins and access tokens for underground containers, the municipality stored for a long time when each household disposed of waste, although this was not necessary for its waste collection, which does not use volume-based charging, and it did not inform residents about these data, their purpose or the legal basis. Following an enforcement request, the AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed a fine of 30,000 EUR on the board of mayor and aldermen.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a i. V. m. Art. 6 Abs. 1 lit. e sowie Art. 14 Abs. 1 lit. c und d DSGVO (AVG)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Mitigating circumstances

The board accepted all findings, had the software adapted, informed residents again and deleted the historical data; given the low seriousness, the AP set the fine below the minimum of the fining range of 120,000 EUR.

Published

17 Nov 2023

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 2 Nov 2025 · Direct link

The ICO issued a reprimand to a UK police service. According to the ICO's findings, from 2016 until 15 October 2020 the force's extradition unit shared personal data of 174 people with the US Department of Homeland Security (DHS) outside the established procedures, including identifiers, information from ESTA (US electronic travel authorisation) and visa applications, information on missing persons, criminal conviction data and biometric data. The ICO criticised the lack of managerial oversight and insufficiently regulated access to systems. It found infringements of sections 34(3), 35(1), 40, 42(1) and 73(1) DPA 2018 (Part 3). The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · International data transfers

Legal basis

Section 34(3), 35(1), 40, 42(1) und 73(1) DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 26 Oct 2025 · Direct link

The ICO issued reprimands to the chief constables of two neighbouring English police forces. According to the ICO's findings, on 21 June 2021 the two forces' shared IT service, while carrying out security clean-up work, mistakenly decommissioned a server holding an application of one of the forces with data from November 2001 to early 2014; the data, including unsanitised records with details of sources, allegations and previous convictions, cannot be recovered. The ICO regarded both forces as joint controllers and found infringements of sections 40 and 66(1) DPA 2018 (Part 3). The reprimands are undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 40 und 66(1) DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 6 Oct 2025 · Direct link

The CNPD (Luxembourg data protection authority) fined two public bodies acting as joint controllers EUR 2,500 over their geolocation system in service vehicles and construction machinery. One of the purposes stated to employees, the monitoring of goods of a particular nature, did not reflect the actual activity and was therefore not a legitimate purpose; employees were also insufficiently informed. Within two months the bodies had to inform every person concerned individually, fully and clearly about the tracking.

Authority / court

Commission nationale pour la protection des données (CNPD), formation restreinte

Area of law

Data protection · Employee data

Legal basis

Art. 5(1)(b) und 13 DSGVO; Art. 58(2)(d) und 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 21 Sep 2025 · Direct link

The ICO issued a reprimand to a UK government department. According to the ICO's findings, details of the parties to an adoption case were disclosed to the birth father, even though a judge had excluded him from the proceedings because he posed a risk to the family. According to the ICO, the cause was an unwritten local practice of removing the cover sheet recording sharing restrictions from the file, combined with inadequate checks of the file; in addition, the electronic filing system could hold only one note at a time, so the restriction note had been overwritten. The ICO found no mitigating factors. It found an infringement of Article 5(1)(f) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 8 Sep 2025 · Direct link

On 23 August 2023 the ICO issued a reprimand to an English city council. According to the ICO's findings, before a ransomware attack the council had no centralised logging or SIEM system; the attacker was able to delete logs, which hampered detection and investigation. After the attack the council did not restore access to personal data in a timely manner, could not identify which individuals were at risk and relied on ad hoc processes to analyse the data, such as downloads over employees' home Wi-Fi networks. The ICO found infringements of Article 32(1)(b), 32(1)(c) and 32(1)(d) UK GDPR. The ICO enforcement list shows the case under 1 September 2023.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Art. 32(1)(b), 32(1)(c) und 32(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Aug 2025 · Direct link

The ICO issued a reprimand to a London borough council. According to the ICO's findings, between 3 January 2022 and 3 January 2023 the council failed to respond to 35 per cent of subject access requests within the statutory time limits of one and three months. As a mitigating factor, the ICO took into account a backlog that built up during the Covid-19 pandemic, particularly for requests involving paper records about children and young people. The ICO found infringements of Articles 12(3) and 15(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3) und 15(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 16 Aug 2025 · Direct link

The ICO issued a reprimand to an English county council. According to the ICO's findings, a social worker sent copies of a child and family assessment report to the mother and her two former partners without redacting sensitive information from the partners' copies; the report had been signed off by a team manager beforehand. According to the ICO case page, the disclosed information concerned previous domestic violence against the mother and the children. The ICO traced the failure to a lack of training and clear rules on redaction; detailed guidance only became available in April 2022. It found an infringement of Article 32(1) UK GDPR. The reprimand is dated 11 August 2023; the ICO case page lists the case under 27 September 2023.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 11 Aug 2025 · Direct link

The ICO issued a reprimand to a government department in Northern Ireland. According to the ICO, on 22 May 2020 the Interim Advocate's Office for victims and survivors of historical institutional childhood abuse, which formed part of the department, sent a newsletter to 251 subscribers whose email addresses were visible to all recipients; the addresses of 209 individuals were disclosed, 110 of them containing full names. According to the ICO's findings, there was no technical solution for group emails, no documented process, no staff training and no adequate data protection policies. The ICO found infringements of Articles 5(1)(f), 24(1) and (2) and 32(1) and (2) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 24(1) und (2), 32(1) und (2) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Jul 2025 · Direct link

The ICO issued a reprimand to an English police force. According to the ICO's findings, personal data of witnesses reached the Crown Prosecution Service's digital case management system through a police officer's unredacted statement, because the data had not been adequately redacted before disclosure; the cause was a lack of redaction and disclosure training. The force had no oversight of whether policies were read or training completed; the completion rate for data protection training between December 2020 and December 2022 was 15.85 per cent. The ICO found infringements of sections 40, 56, 57(1) and 66(1) DPA 2018 (Part 3). The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 40, 56, 57(1) und 66(1) DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 Jun 2025 · Direct link

The ICO issued a reprimand to an English police force. According to the ICO's findings, in response to a request from a housing authority the force disclosed contextual information that allowed suspected criminals to learn the address of a witness; the person had to move house and, according to the ICO, the risk to them remains high. The cause was a lack of organisational measures: the officer concerned was unaware of the redaction policies, training could not be evidenced and there was no oversight of the redaction. The ICO found an infringement of section 40 DPA 2018 (Part 3). The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Section 40 DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 May 2025 · Direct link

The ICO issued a reprimand to an English primary school. According to the ICO's findings, the school disclosed sensitive personal data, including special category data, in a classroom, affecting four people, three of them children. The ICO criticised inadequate policies on sharing and opening emails containing personal data, the lack of rules for the case management system used for safeguarding and wellbeing matters, the absence of labels on sensitive emails and the lack of guidance on screen sharing safely on electronic whiteboards. The ICO found infringements of Articles 5(1)(f), 24(1) and 32 UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 24(1) und 32 UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 May 2025 · Direct link

The ICO issued a reprimand to an English county council. According to the ICO's findings, between 6 April 2021 and 6 April 2022 the council responded to only 260 of 511 subject access requests within the statutory period of one or three months. As a mitigating factor the ICO took into account that the Covid-19 pandemic had restricted access to paper records; the council increased its staffing and brought the work together in a dedicated team. The ICO found infringements of Articles 12(3), 15(1) and 15(3) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 May 2025 · Direct link

The ICO issued a reprimand to an English city council. According to the ICO's findings, compliance with subject access request deadlines had been inadequate for three years: the highest rate within the one-month deadline was 45 per cent (2021/2022); 18 requests took up to two years, eight requests up to two years old were still outstanding and, as of 31 January 2023, a further 20 requests up to one year old had not been completed. According to the ICO, the council had increased the team from 2.6 to 5.6 full-time equivalents. The ICO found infringements of Articles 12(3), 15(1) and 15(3) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 28 Apr 2025 · Direct link

The ICO issued a reprimand to a UK government department. According to the ICO's findings, on 26 February 2022, 14 bags of confidential waste were found in an unsecured area of a prison to which prisoners and staff had access; because the shredding contractor did not collect them on time, they were left unsecured for 18 days in total. Some bags were not sealed and contained information about staff and prisoners, including health data and security vetting details; according to the ICO, 44 individuals potentially viewed the documents. The ICO criticised the lack of specific instructions on secure storage areas and inadequate disposal processes, and found infringements of Articles 5(1)(f) and 32(1)(d) and (2) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1)(d) und (2) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 27 Apr 2025 · Direct link

The ICO issued a reprimand to the chief constable of an English police force. According to the ICO's findings, the force made available to all staff an app that recorded all incoming and outgoing calls on work mobile phones; according to the reprimand, 1,015 staff members had downloaded the app and, as at 27 April 2021, more than 202,000 recordings of calls had been saved. According to the ICO, these figures relate to both forces together. The ICO considered the collection unfair and unlawful: there was no risk assessment, no documented approval, no guidance and no review when the DPA 2018 came into force; the people recorded were unaware and could not exercise their rights. The ICO found infringements of sections 35(1) and 45(1) DPA 2018 (Part 3). An identically worded reprimand was issued to a neighbouring force. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Section 35(1) und 45(1) DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 3 Apr 2025 · Direct link

The ICO issued a reprimand to the chief constable of an English police force. According to the ICO's findings, the force made available to all staff an app that recorded all incoming and outgoing calls on work mobile phones; according to the reprimand, 1,015 staff members had downloaded the app and, as at 27 April 2021, more than 202,000 recordings of calls had been saved. According to the ICO, these figures relate to both forces together. The ICO considered the collection unfair and unlawful: there was no risk assessment, no documented approval, no guidance and no review when the DPA 2018 came into force; the people recorded were unaware and could not exercise their rights. The ICO found infringements of sections 35(1) and 45(1) DPA 2018 (Part 3). An identically worded reprimand was issued to a neighbouring force. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Section 35(1) und 45(1) DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 3 Apr 2025 · Direct link

The ICO issued a reprimand to a large UK police force. According to the ICO's findings, the force was unable to ensure that sensitive criminal records on organised crime groups were correctly uploaded to, amended on or deleted from the Police National Database; this situation had gone unnoticed for a considerable time and, although the database had been operating since 2011, there were no automated checks. The force did not inform partner agencies until December 2020, more than six months after the first issue was discovered. The ICO found an infringement of section 38(4) DPA 2018 (Part 3); the reprimand refers to alleged infringements. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection

Legal basis

Section 38(4) DPA 2018; Verwarnung nach Schedule 13(2)(c) DPA 2018

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Mar 2025 · Direct link

The social insurance agency did not adequately secure telephone contact with people insured under the state pension; among other things, its work instructions did not clearly set out which and how many security questions had to be asked to verify identity. The AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed a fine of 150,000 EUR for infringing Art. 32(1) and (2) GDPR.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 und 2 DSGVO (AVG)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Published

13 Apr 2023

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 19 Jan 2025 · Direct link

In April and May 2020 the police deployed two mobile camera cars in Rotterdam to monitor compliance with the COVID-19 emergency ordinance without first carrying out the data protection impact assessment required under the Police Data Act. The AP (Autoriteit Persoonsgegevens, Dutch data protection authority) imposed 50,000 EUR on the chief of police and rejected the objection on 6 November 2023. On 8 October 2024 the Rechtbank Den Haag (The Hague District Court) upheld the infringement but found it established for one day only and reduced the fine to 30,000 EUR; no appeal was lodged.

Authority / court

Autoriteit Persoonsgegevens (AP)

Area of law

Data protection · Video surveillance

Legal basis

Art. 4c Abs. 1 Wet politiegegevens (Wpg)

Action

Fine

Status of proceedings

reduced

Sector

Public sector

Mitigating circumstances

The AP reduced the base amount of 56,500 EUR to 50,000 EUR because the deployment took place under severe time pressure in the crisis at the start of the COVID-19 pandemic; the court reduced it further to 30,000 EUR because the infringement was established for one day only and a repetition is very unlikely.

Published

21 Dec 2022

Checked against the official source on 2 Oct 2026 · Company name anonymised since 17 Nov 2024 · Direct link

The Portuguese statistics office had the online collection for the 2021 census handled via a US CDN provider; the contract allowed processing on servers worldwide and relied on standard contractual clauses without supplementary measures against access by authorities in the USA. The Comissão Nacional de Proteção de Dados (Portuguese data protection authority, CNPD) sanctioned five infringements – including impermissible third-country transfer, deficient selection of the processor, unclear voluntary nature of questions on health and religion, missing DPIA – with a total fine of 4.3 million EUR.

Authority / court

Comissão Nacional de Proteção de Dados (CNPD)

Area of law

Data protection · International data transfers

Legal basis

Art. 44, Art. 46 Abs. 2, Art. 28 Abs. 1 und 3, Art. 9, Art. 35 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Nov 2024 · Direct link

The data protection authority imposed a combined fine of 170,000 EUR and two reprimands on the municipality for processing data of Ukrainian refugees via the municipal support service set up in 2022. The fine covered the breach of integrity and confidentiality, because there was neither a processing agreement nor minimum controls against outsiders accessing devices containing personal data, and the failure to designate a data protection officer; the reprimands concerned storage limitation and information duties. The authority also found staff data protection training clearly insufficient.

Authority / court

Comissão Nacional de Proteção de Dados (CNPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 37 Abs. 1 und 7, Art. 83 DSGVO; Verwarnungen nach Art. 58 Abs. 2 lit. b DSGVO (Art. 5 Abs. 1 lit. e, Art. 13 DSGVO)

Action

Fine

Status of proceedings

unknown

Sector

Public sector

Culpability

negligent

Mitigating circumstances

The humanitarian emergency in which the processing was set up was taken into account; this did not apply to the failure to designate a DPO.

Published

16 Nov 2022

Checked against the official source on 28 Sep 2026 · Company name anonymised since 2 Nov 2024 · Direct link

On 2 November 2022 the ICO issued a reprimand to a UK government department. According to the ICO's findings, the department allowed a third party access to the Learning Records Service database, which then held 28 million records, including records of children aged 14 and over; the data was further processed for age verification without appropriate controls and without the data subjects' knowledge. The ICO found infringements of Articles 5(1)(a) and 5(1)(f) GDPR. According to the letter, the ICO had considered a fine of GBP 10,030,000 but, because of its revised approach to the public sector, issued a reprimand only.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(a) und 5(1)(f) GDPR; Verwarnung nach Art. 58 GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 2 Nov 2024 · Direct link

On 31 October 2022 the ICO issued a reprimand to a UK government department. According to the ICO's findings, the department introduced a reprographics application in Child Maintenance Appeals without prior testing and without a data protection impact assessment, because it was already used in other service areas; however, the application was not compatible with the existing tool used to compile appeal bundles, so redactions made in the online versions were not carried over to the printed copies sent out. As a result, personal data of 16 people was disclosed to third parties, including one person's address, which reached a former partner with a history of domestic violence. Although an affected person had alerted the department on 24 August 2021, the ICO found that the breach was not reported until 10 September 2021. The ICO found infringements of Articles 5(1)(f), 32(1)(b) and (d) and 33(1) UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1)(b) und (d) sowie 33(1) UK GDPR; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 31 Oct 2024 · Direct link

On 5 October 2022 the ICO issued a reprimand to a UK government department. According to the ICO's findings, on 5 September 2021 an envelope containing four reports classified 'Official Sensitive' was found at a venue in London; the reports contained personal data, including special category data, about three people. Venue staff handed them to the police, who passed them to the department the following day. There was no specific sign-out process for removing such documents from the premises. Although the department became aware of the incident on 6 September 2021, it did not report it to the ICO until 4 April 2022. The ICO found infringements of Articles 5(1)(f) and 33(1) UK GDPR. The ICO published the case on 7 October 2022.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 33(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 5 Oct 2024 · Direct link

On 23 September 2022 the ICO issued a reprimand to a London borough council. According to the ICO's findings, between 1 August 2020 and 11 August 2021 the borough answered only 74 per cent of subject access requests on time (268 requests, according to the ICO); between March and August 2022 the rate was still only 75 per cent. The ICO also criticised communication problems with the data protection officer and recommended a review of the obligations under Articles 37 to 39 UK GDPR. The ICO found infringements of Articles 12(3), 15(1) and 15(3) UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Sep 2024 · Direct link

On 23 September 2022 the ICO issued a reprimand to an English police force. According to the ICO's findings, between 1 April 2020 and 29 April 2021 the force answered only 60 per cent of subject access requests on time; the backlog persisted and, according to the ICO, appeared to be worsening, as only 22 per cent were answered within the deadline between January and June 2022. The ICO found infringements of Articles 12(3), 15(1) and 15(3) UK GDPR and section 45 (Part 3) DPA 2018 and asked for a detailed improvement plan and progress updates after three and six months.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; section 45 Part 3 DPA 2018; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Public sector

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Sep 2024 · Direct link