Who was sanctioned, and for what?

Attackers obtained the credentials of a user account with administrator rights through phishing and accessed customer data. The Romanian data protection authority (ANSPDCP) criticised the lack of technical and organisational measures and of regular effectiveness testing, imposed 15,728 lei (3,000 EUR) and ordered regular employee training, including on recognising phishing e-mails. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

19 Aug 2026

Original amount 15,728 RON, converted at the ECB reference rate of 19 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following several complaints, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romanian data protection authority, ANSPDCP) found that current and former employees, untrained and without procedural rules, had access to extensive data (including health, family and income data), that data subjects were not informed under Art. 14 GDPR, that excessive data were collected and that automated advertising calls were made without consent. Fines: 78,465 lei (15,000 EUR, Art. 32(4)), 52,310 lei (10,000 EUR, Art. 14), 104,620 lei (20,000 EUR, Art. 5/9 GDPR) and 50,000 lei (Law 506/2004); in addition, an order to provide regular employee training. Date = publication of the press release; according to the authority, the investigation was concluded in June 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5 Abs. 1 lit. c i. V. m. Art. 9, Art. 14, Art. 32 Abs. 4 DSGVO; Art. 12 Abs. 1 Gesetz 506/2004

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

6 Aug 2026

Original amount 285,395 RON, converted at the ECB reference rate of 6 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The U.S. Forced Labor Enforcement Task Force (FLETF) added the cotton and textile producer to the Uyghur Forced Labor Prevention Act (UFLPA) Entity List because it sources cotton from Xinjiang. The company's goods are therefore presumed to have been produced with forced labour on import into the US unless the importer rebuts this.

Authority / court

U.S. Department of Homeland Security (Forced Labor Enforcement Task Force)

Area of law

Supply chain and human rights · Forced and child labour

Legal basis

Uyghur Forced Labor Prevention Act, Section 2(d)(2)(B)(v)

Action

Order

Status of proceedings

unknown

Sector

Other

Published

3 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed 231,826 CAD on the Halifax gaming corporation (casino sector) because it failed to file suspicious transaction reports on attempted transactions despite reasonable grounds for suspicion, did not keep its compliance policies up to date and approved by a senior officer, and did not assess the money laundering risk as required. The penalty was paid in full.

Authority / court

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Proceeds of Crime (Money Laundering) and Terrorist Financing Act, Part 1, und zugehörige Verordnungen

Action

Fine

Status of proceedings

final

Sector

Other

Published

3 Sep 2026

Original amount 231,826 CAD, converted at the ECB reference rate of 23 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On the confirmation page of its online cancellation process, a gym operator displayed a highlighted notice with the button "Pause contract via self-service"; in addition, the confirmation button was labelled "Find contract", which the defendant had already acknowledged. In an action brought by the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband), the BGH ruled that the confirmation page may only contain the information required for the cancellation and the confirmation button, set aside the judgment of the Higher Regional Court of Düsseldorf (OLG Düsseldorf) dismissing the action to that extent and ordered the operator to cease and desist.

Authority / court

Bundesgerichtshof (I. Zivilsenat), Az. I ZR 200/25

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

§ 312k Abs. 1 Satz 1, Abs. 2 BGB (Kündigungsbutton)

Action

Order

Status of proceedings

final

Sector

Other

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The 2022 examination revealed that for more than two years the remote gaming operator had had no proper customer risk assessment for almost its entire player base; the assessments submitted had been prepared specifically for the examination. In addition, once players reached the deposit threshold of 2,000 EUR, it did not check in good time whether they were politically exposed persons. The Financial Intelligence Analysis Unit (FIAU) imposed 80,907 EUR; the fine was still open to appeal at the time of publication.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 5(5)(a)(ii), 11(5), 21 PMLFTR; FIAU Implementing Procedures Part I und II (Remote Gaming)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employee of the Dundee-based electrical services provider for gyms (around 140 employees) had pointed out that the technicians' holiday pay was being calculated incorrectly; a few days later her home working arrangement was withdrawn, and on 11 June 2025 she was dismissed. The Employment Tribunal upheld her claims for automatically unfair dismissal (s. 103A) and detriment (s. 47B); compensation will be decided separately.

Authority / court

Employment Tribunal

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Employment Rights Act 1996, ss. 43B, 47B, 103A

Action

Other

Status of proceedings

unknown

Sector

Other

Employees

50 to 249

Published

23 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The company had stored statistically calculated ‘party affinities’ for around 2.2 million people and in some cases sold them to advertising clients – special categories of personal data without consent; in addition, parcel frequency data was further processed for incompatible purposes. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) had imposed 18 million EUR in 2019 and the Federal Administrative Court (Bundesverwaltungsgericht, BVwG) 16 million EUR in 2024; Austria's Supreme Administrative Court (Verwaltungsgerichtshof, VwGH) has now set the fine with final effect at 13 million EUR (plus 100,000 EUR in procedural costs).

Authority / court

Verwaltungsgerichtshof (Ausgangsbescheid: Datenschutzbehörde)

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a und b, Art. 6 Abs. 4, Art. 9 Abs. 1 (VwGH Ro 2025/04/0007)

Action

Fine

Status of proceedings

reduced

Sector

Other

Culpability

negligent

Mitigating circumstances

Comprehensive cooperation, deletion of the party affinities, settlements with data subjects, long duration of proceedings (5 years, 10 months).

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

U.S. Customs and Border Protection (CBP) issued a Withhold Release Order: clothing from Needle Craft Ltd.; Casual Wear Apparel LLC (Jordan) is being detained at all US ports of entry because there are indications of forced labour (ILO indicators including physical and sexual violence, retention of identity documents, restriction of movement and withholding of wages). These are two parallel orders against both manufacturers.

Authority / court

U.S. Customs and Border Protection

Area of law

Supply chain and human rights · Forced and child labour

Legal basis

19 U.S.C. § 1307 (Tariff Act of 1930, Section 307)

Action

Order

Status of proceedings

unknown

Sector

Other

Published

23 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employee of the service provider acting as processor for Kaufland România let a third party into a store’s video surveillance room; that person filmed the images and distributed them on social media. Kaufland reported the incident. The Romanian data protection authority (ANSPDCP) imposed 10,200 lei (2,000 EUR) on the processor and ordered additional checks of the work instructions; the fine has been paid. Date = publication of the press release; according to the authority, the investigation was concluded in April 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Video surveillance

Legal basis

Art. 29, Art. 32 Abs. 1 lit. b, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

15 Jun 2026

Original amount 10,200 RON, converted at the ECB reference rate of 15 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The listed hotel group did not publish its 2024 annual financial report on time; the Cyprus Securities and Exchange Commission (CySEC) imposed a total of 16,500 EUR. At the same meeting, eleven other issuers were fined between 1,500 and 17,000 EUR for the same reason; a fine of 13,500 EUR had already been imposed on the company under the same law in 2025.

Authority / court

Cyprus Securities and Exchange Commission (CySEC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Sec. 9(1), 37(2)(a) Transparency Requirements (Securities Admitted to Trading on a Regulated Market) Law 2007

Action

Fine

Status of proceedings

unknown

Sector

Other

Repeat case

yes

Published

7 Aug 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The PR agency, which did not appear, lost on all claims: detriment on grounds of whistleblowing (£20,000 for injury to feelings), wrongful termination without notice pay (£3,547.60) and constructive unfair dismissal (basic and compensatory award including a 25 % ACAS uplift). A total of £71,051.82 was awarded.

Authority / court

Employment Tribunal

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Employment Rights Act 1996, s. 47B (Benachteiligung wegen geschützter Offenlegung); konstruktive unfaire Kündigung; wrongful dismissal

Action

Other

Status of proceedings

unknown

Sector

Other

Published

22 Jul 2026

Original amount 71,051.82 GBP, converted at the ECB reference rate of 3 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following complaints, the labour inspectorate found, among other things, outstanding minimum wages at the temporary staffing agency in Leamington; an audit for 2022 showed that hundreds of employees were owed a total of CA$234,212 in regular wages, public holiday pay and vacation pay. The company and its director did not comply with the 2023 orders to pay; in proceedings held in their absence, the court imposed CA$100,000 on the company and CA$50,000 on the director (plus victim fine surcharge).

Authority / court

Provincial Offences Court Windsor (Ermittlung: Ontario Ministry of Labour, Immigration, Training and Skills Development)

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Employment Standards Act, 2000 (Ontario), ss. 103(8), 106, 132, 136

Action

Fine

Status of proceedings

unknown

Sector

Other

Liability of senior managers

Director Son-Van Duong personally fined CA$50,000.

Published

3 Jun 2026

Original amount 150,000 CAD, converted at the ECB reference rate of 23 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For online bookings, the driving schools only showed a mandatory booking fee at checkout instead of in the initial price. Following an admission and settlement, the CMA imposed a penalty of 4.2 million GBP (40 % discount on 7 million GBP) and ordered refunds of more than 760,000 GBP to more than 80,000 customers.

Authority / court

Competition and Markets Authority (CMA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Digital Markets, Competition and Consumers Act 2024

Action

Fine

Status of proceedings

final

Sector

Other

Mitigating circumstances

Admission and early settlement (40 % discount).

Published

15 Apr 2026

Original amount 4,200,000 GBP, converted at the ECB reference rate of 15 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

An employer installed the software Spyrix Employee Monitoring on the work computers of individual employees, which for months recorded screen content, audio and even private e-mails and conversations without informing the employees. The supervisory authority, the Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia, IP), imposed 71,474 EUR on the company and 4,000 EUR on the responsible person.

Authority / court

Informacijski pooblaščenec Republike Slovenije (IP)

Area of law

Data protection · Employee data

Legal basis

Art. 5 und Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Liability of senior managers

Additional fine of 4,000 EUR on the responsible person.

Published

9 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2022 to 2025, the company exported containers of supposedly clean plastic that was in fact contaminated with electronic waste such as cables and circuit boards; in some cases, the waste was hidden at the back of the container, and further containers were shipped despite prohibition notices from August 2024. The company and its director pleaded guilty to 16 counts: a fine of 80,000 GBP, 45,000 GBP in costs and a 2,000 GBP surcharge for the company; 120 hours of community service, 15,000 GBP in costs and a 114 GBP surcharge for the director.

Authority / court

Preston Magistrates' Court (Anklage: Environment Agency)

Area of law

Environment and sustainability · Waste and hazardous substances

Legal basis

Vorschriften zur grenzüberschreitenden Abfallverbringung (Notifizierung und Zustimmung); Verstoß gegen Untersagungsverfügungen

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Repeat case

yes

Mitigating circumstances

Guilty plea.

Liability of senior managers

Director Yulin Wang personally sentenced to 120 hours of community service, 15,000 GBP in costs and a 114 GBP surcharge.

Published

2 Apr 2026

Original amount 142,114 GBP, converted at the ECB reference rate of 24 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A person complained that Fitsypro had not responded to their request for access, rectification and erasure of November 2023. Three requests for information from the Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) between 2024 and 2026 went unanswered, and nobody attended the hearing. The DVI imposed 1,500 EUR and requested the information by 21 April 2026.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 58 Abs. 1 lit. e, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

intentional

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Malta's Financial Intelligence Analysis Unit (FIAU) imposed 225,730 EUR, a penalty payment of 2,000 EUR per day and a follow-up directive on the licensed gambling operator, which works through a network of independently operated betting shops in an EU member state. The company was unable to link customers' cumulative deposits across different shops and only checked customers from a single deposit of 2,000 EUR upwards, so the threshold could be circumvented. The company has appealed.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Regulation 21 PMLFTR; Verstöße gegen Regulations 5(5)(a)(ii), 7, 9(1) PMLFTR und FIAU Implementing Procedures

Action

Fine

Status of proceedings

under appeal

Sector

Other

Published

16 Apr 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 1987 to March 2025, the association of temporary work agencies (around 40 members) obliged its members in its code of ethics not to poach each other’s temporary workers. The Autoridade da Concorrência (Portuguese Competition Authority, AdC) regarded this as an anticompetitive decision by an association in the labour market and imposed 4,519,000 EUR, calculated on the basis of the members’ turnover; the decision can be appealed (date = press release).

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Lei da Concorrência (Lei n.º 19/2012), Art. 9.º

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

12 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Despite repeated follow-ups by the trade union, the cleaning company did not respond to a union member’s access request and also failed to comply with the order of the Danish Data Protection Agency (Datatilsynet) to decide on the request. Datatilsynet reported the company; the case was closed on 2 March 2026 with a fine notice of 60,000 DKK.

Authority / court

Anklagemyndigheden (Bødeforelæg) auf Anzeige der Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15; Nichtbefolgung einer Anordnung der Datatilsynet; databeskyttelsesloven

Action

Fine

Status of proceedings

final

Sector

Other

Original amount 60,000 DKK, converted at the ECB reference rate of 2 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Since 2020, the only association of tour guides in the Azores (57 active members, around 43% of active guides) had recommended a fee table to its members by e-mail as minimum prices. Following a complaint, the Autoridade da Concorrência (Portuguese Competition Authority, AdC) imposed 8,200 EUR, taking the economic situation into account (date = press release).

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Lei da Concorrência (Lei n.º 19/2012), Art. 9.º; Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

29 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The agency conducted telephone pre-screening interviews with applicants on behalf of client companies, recorded them without valid consent, stored them indefinitely and presented itself as the client company in doing so. The Austrian Data Protection Authority (Datenschutzbehörde, DSB) imposed 25,500 EUR (plus 2,550 EUR in costs) for lack of a legal basis and transparency; the company has lodged an appeal against the amount of the fine with the Federal Administrative Court (Bundesverwaltungsgericht).

Authority / court

Datenschutzbehörde

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, c und e, Art. 6 Abs. 1, Art. 12, 13

Action

Fine

Status of proceedings

under appeal

Sector

Other

Employees

Under 50

Mitigating circumstances

No relevant previous violations, cooperation in the proceedings; adjustment of the starting amount to the company's small size.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following numerous complaints about marketing calls for the gas supplier ZENITH, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) found that the call centre engaged had insufficient security measures and called persons without valid consent. By Decision 44/2025, One Way received 40,000 EUR each as processor and as controller, together with an order to delete the data of persons without valid consent; ZENITH and two other service providers were also held liable (10,000, 10,000 and 5,000 EUR).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 29, 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Repeat case

yes

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Without registering as a data broker, the Texas reseller traded in the names and contact details of millions of people, sorted by illnesses such as Alzheimer's or addiction, by age, presumed ethnicity and political views. In addition to the fine, the California Privacy Protection Agency (CPPA) requires it to stop selling data on all Californians.

Authority / court

California Privacy Protection Agency (CPPA)

Area of law

Data protection · Marketing and consent

Legal basis

California Delete Act (Registrierungspflicht für Datenhändler)

Action

Fine

Status of proceedings

final

Sector

Other

Published

8 Jan 2026

Original amount 45,000 USD, converted at the ECB reference rate of 30 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On 13 November 2025, the Nevada Gaming Control Board (NGCB) filed a disciplinary complaint for unsuitable methods of operation in connection with the illegal bookmaker Mathew Bowyer and at the same time concluded a settlement of 7.8 million USD with conditions attached to the gaming licences. The conditions relate primarily to improving the AML programme and to additional training and awareness-raising for employees; the Nevada Gaming Commission (NGC) adopted the settlement as its order on 20 November 2025 (Case No. 25-03).

Authority / court

Nevada Gaming Commission (NGC) auf Beschwerde des Nevada Gaming Control Board (NGCB)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Glücksspielrecht Nevada (unsuitable methods of operation)

Action

Fine

Status of proceedings

final

Sector

Other

Employees

10,000 or more

Mitigating circumstances

Numerous remedial measures already implemented

Published

13 Nov 2025

Original amount 7,800,000 USD, converted at the ECB reference rate of 20 Nov 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

U.S. Customs and Border Protection (CBP) issued a Withhold Release Order: clothing and textiles from Firemount Group Ltd. (Mauritius) are being detained at all US ports of entry because there are indications of forced labour (ILO indicators including abuse of vulnerability, debt bondage, deception, and intimidation and threats).

Authority / court

U.S. Customs and Border Protection

Area of law

Supply chain and human rights · Forced and child labour

Legal basis

19 U.S.C. § 1307 (Tariff Act of 1930, Section 307)

Action

Order

Status of proceedings

unknown

Sector

Other

Published

18 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

More than 90 cleaners in industrial, laboratory and healthcare facilities often worked beyond scheduled hours without overtime pay, received no compensation for split shifts and travel time and were unable to take breaks because of excessive workloads. A web of companies owned by the Hong family concealed the employer; the Notice of Final Findings of 21 October 2025 established 438,204 USD, with OptumCare jointly liable as the client.

Authority / court

California Labor Commissioner's Office (Division of Labor Standards Enforcement)

Area of law

Health and safety and employment law · Working time

Legal basis

California Labor Code § 2810.3; Overtime, Split Shift, Meal and Rest Periods, Mindestlohn

Action

Other

Status of proceedings

unknown

Sector

Other

Liability of senior managers

Members of the owning family and an acquaintance cited personally.

Published

24 Nov 2025

Original amount 438,204 USD, converted at the ECB reference rate of 21 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In March 2023, an employee unintentionally downloaded malicious files; although an alert was triggered after ten minutes, the device was only isolated after 58 hours. Attackers stole around one terabyte of data on 6.6 million people (including pension data and criminal record information). Fines imposed by the UK Information Commissioner's Office (ICO): £8 million against Capita plc and £6 million against Capita Pension Solutions.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32

Action

Fine

Status of proceedings

final

Sector

Other

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

£45 million had provisionally been proposed; reduced, among other things, for security improvements, credit monitoring for those affected and cooperation with authorities and the NCSC.

Published

15 Oct 2025

Original amount 14,000,000 GBP, converted at the ECB reference rate of 15 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The operator of a sports facility rented a Bluetooth system with which swimmers were located in the pool via tags and their training was recorded. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) imposed 8,000 EUR for the processing of special categories of data and – after a 20% reduction for immediate payment – 4,000, 2,400 and 3,200 EUR for lack of a legal basis, insufficient information and a deficient impact assessment (17,600 EUR in total); the request for reconsideration was unsuccessful.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 6 Abs. 1, Art. 9 Abs. 1, Art. 13, Art. 35 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Mitigating circumstances

Partial immediate payment (20% reduction under Art. 85 LPACAP).

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The company had used an automated script to carry out mass queries in the electronic land register and stored data of natural persons without demonstrating a legal basis; it did not respond to requests from the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered erasure with proof or a statement of a legal basis with a balancing of interests; a penalty payment of 2,000 EUR was threatened.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d, Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2013, SURYS supplied security holograms for Ukrainian passports to the state-owned company Polygraph via an interposed Estonian company; the investigation (following a request for mutual legal assistance from Ukraine's National Anti-Corruption Bureau, NABU) concerned misappropriation of public funds, bribery of foreign public officials and money laundering. Public interest fine of 18,363,007 EUR, plus 3,770,000 EUR in damages to the Ukrainian state and a three-year AFA compliance programme.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger, Geldwäsche

Action

Fine

Status of proceedings

final

Sector

Other

Employees

250 to 999

Culpability

intentional

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

3 Sep 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed 72,750 CAD on the auditing and accountancy firm with four offices in British Columbia: approved written compliance policies, a documented risk assessment and the prescribed two-yearly effectiveness review were all lacking. The penalty was paid.

Authority / court

Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Proceeds of Crime (Money Laundering) and Terrorist Financing Act, Part 1, und zugehörige Verordnungen

Action

Fine

Status of proceedings

final

Sector

Other

Published

9 Oct 2025

Original amount 72,750 CAD, converted at the ECB reference rate of 25 Jul 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2022, attackers used brute force to penetrate the law firm's network via a rarely used administrator account without MFA and stole 32 GB of highly sensitive data, which appeared on the dark web. The firm only learned of this from the National Crime Agency and reported the incident to the UK Information Commissioner's Office (ICO) only 43 days later.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 und 2, Art. 33 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Other

Culpability

negligent

Published

16 Apr 2025

Original amount 60,000 GBP, converted at the ECB reference rate of 14 Apr 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Two gym operators announced a fee increase of 6 EUR a month and treated silence or the failure to exercise a special right of termination as consent. In an action brought by the Austrian Federal Chamber of Labour (Bundesarbeitskammer), the OGH upheld the prohibition of such increases without express agreement and the publication of the judgment; it dismissed claims for repayment and information.

Authority / court

Oberster Gerichtshof (OGH), GZ 4 Ob 51/25s

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

§ 6 Abs. 1 Z 2, § 28a KSchG; §§ 1a, 14 UWG

Action

Order

Status of proceedings

final

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The college failed to pay 14 employees wages of almost CA$185,000 and ignored the labour inspectorate's orders to pay from 2019/2020; the director did not pay either. The court imposed CA$270,000 on the company and CA$140,000 on the director, in addition to the outstanding wages.

Authority / court

Provincial Offences Court Toronto (Ermittlung: Ontario Ministry of Labour, Immigration, Training and Skills Development)

Area of law

Health and safety and employment law · Minimum wage and undeclared work

Legal basis

Employment Standards Act, 2000 (Ontario), ss. 103(8), 106, 132, 136

Action

Fine

Status of proceedings

unknown

Sector

Other

Liability of senior managers

Director Anchuan Jiang personally fined CA$140,000.

Published

28 May 2025

Original amount 410,000 CAD, converted at the ECB reference rate of 28 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Colosseum's ticketing service provider did not prevent tour operators from buying up basic tickets in bulk using bots, and itself reserved large allocations for more expensive packages; as a result, visitors could hardly find regular tickets. The AGCM imposed a fine of 7 million EUR on CoopCulture and further fines on six tour providers (including Tiqets, GetYourGuide, Musement), almost 20 million EUR in total.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 20, comma 2 Codice del Consumo (CoopCulture); Artt. 24, 25, 23 comma 1 lett. bb-bis (Touranbieter)

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

8 Apr 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2020, Synot and a sole trader jointly acquired control of the gambling operator SLOV-MATIC, transferred shares and replaced corporate bodies before notifying the concentration. Under a settlement, the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 400,000 EUR on Synot and 28,500 EUR on the entrepreneur; final since 7 March 2025.

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Merger control

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Anmeldepflicht und Vollzugsverbot)

Action

Fine

Status of proceedings

final

Sector

Other

Mitigating circumstances

Voluntary subsequent notification, admission and settlement (50% reduction).

Published

10 Mar 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From 2022 to March 2024, the Croatian Hunting Association offered hunter training below cost and financed this from areas in which it holds a statutory monopoly in order to drive out competitors. The Agencija za zaštitu tržišnog natjecanja (Croatian Competition Agency, AZTN) imposed 89,935.20 EUR and ordered separate cost accounting; the High Administrative Court dismissed the action on 17 December 2025.

Authority / court

Agencija za zaštitu tržišnog natjecanja (AZTN)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 13 Nr. 1 Zakon o zaštiti tržišnog natjecanja (ZZTN)

Action

Fine

Status of proceedings

final

Sector

Other

Published

10 Feb 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a complaint – one of several complaints about cookie banners lodged with European data protection authorities – the Swedish Authority for Privacy Protection (IMY) found that the betting operator did not make withdrawing consent as easy as giving it and, through the misleading design of the banner (choice of colours, contrast, rejection only as a link), made informed, freely given consent more difficult. IMY issued a reprimand; ATG had since changed the banner.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 6, Art. 7 Abs. 3

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Without informing them, the residence permit consultancy sent a client couple’s marriage certificate and proof of salary to a sister company in Georgia for translation; the documents subsequently appeared publicly on the Scribd platform. The Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection) imposed 2,000 EUR each for an impermissible transfer to a third country and for lack of security measures, as well as a reprimand for insufficient cooperation.

Authority / court

Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Commissioner for Personal Data Protection)

Area of law

Data protection · International data transfers

Legal basis

Art. 5 Abs. 1 lit. f, Art. 31, Art. 44 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found that three suppliers had fixed prices and shared markets in public tenders by various contracting authorities for professional work shoes (Art. 15 ZZK – Bulgarian Protection of Competition Act, Art. 101 TFEU). Sanctions: 1,678,897 leva (Technomat-Merkuriy), 657,675 leva (disabled persons’ cooperative Zdravohod) and 409,424 leva (Kavaler Union 2001), a total of 2,745,996 leva. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 15 Abs. 1 Nr. 1 und 2 ZZK; Art. 101 Abs. 1 lit. a und c AEUV

Action

Fine

Status of proceedings

under appeal

Sector

Other

Original amount 2,745,996 BGN, converted at the ECB reference rate of 21 Nov 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The corporate services provider did not question why a client company that had been dormant for seven years suddenly received over 4 million EUR and passed almost identical amounts on to its shareholder, and did not keep customer information up to date. The Financial Intelligence Analysis Unit (FIAU) imposed 66,504 EUR; remediation was no longer possible because the firm had surrendered its licence and is being wound up.

Authority / court

Financial Intelligence Analysis Unit (FIAU)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Reg. 7(2)(a), 7(2)(b), 11(9), 15(3) PMLFTR

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

13 Nov 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Untold SRL left an access request and an erasure request from a data subject unanswered, even though the data subject had provided all contact details. The Romanian data protection authority (ANSPDCP) imposed 49,741 lei (10,000 EUR) in respect of access and 24,870.5 lei (5,000 EUR) in respect of erasure and ordered staff training. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 Abs. 3 und 4, Art. 15, Art. 17 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

30 Oct 2024

Original amount 74,611.5 RON, converted at the ECB reference rate of 30 Oct 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The US Financial Crimes Enforcement Network (FinCEN) imposed 900,000 USD on the Californian card club, which admitted wilful infringements over more than four and a half years: no effective AML programme, missing currency transaction reports (CTR) and suspicious activity reports (SAR), and record-keeping deficiencies. The infringements stemmed from decisions by management.

Authority / court

Financial Crimes Enforcement Network (FinCEN)

Area of law

Money laundering and terrorist financing · Suspicious activity reports

Legal basis

Bank Secrecy Act (BSA) und Durchführungsbestimmungen

Action

Fine

Status of proceedings

final

Sector

Other

Culpability

intentional

Liability of senior managers

According to FinCEN, the infringements were based on decisions by management

Published

23 Oct 2024

Original amount 900,000 USD, converted at the ECB reference rate of 22 Oct 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A textile company started operations with a joint venture (H* GmbH) for the production of protective masks on 24 April 2020, before the notifiable concentration had been cleared; the infringement lasted until 25 May 2020. The Cartel Court imposed a fine of 5,000 EUR; the OGH increased the fine to 100,000 EUR.

Authority / court

Oberster Gerichtshof als Kartellobergericht (Antrag der Bundeswettbewerbsbehörde)

Area of law

Competition law · Merger control

Legal basis

§ 29 Z 1 lit a iVm § 17 Abs 1 KartG 2005

Action

Fine

Status of proceedings

final

Sector

Other

Culpability

intentional

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a tip-off that at the Wasa Resort Spa filming was also taking place in the treatment area and for monitoring work discipline, and that cameras captured the neighbouring property, the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered the hotel to suspend video surveillance until a sound balancing of interests had been submitted, to stop recording the neighbouring property and to correct the camera information on the website. The hotel had repeatedly let the supervisory authority’s deadlines lapse.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Video surveillance

Legal basis

§ 56 Abs. 1, § 58 Abs. 1 IKS; Art. 58 Abs. 2 lit. d und f, Art. 5 Abs. 1, Art. 6 Abs. 1 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Other

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

At the end of 2021, a company based in Amsterdam paid out a dividend of around 18 million EUR to a Russian shareholder behind which there was a sanctioned person, repaid a loan to a listed Russian company in 2019 and did not freeze shares and voting rights; in addition, a gatekeeper was misinformed. In a settlement (transactie) with the Dutch Public Prosecution Service (Openbaar Ministerie), the company paid 195,000 EUR and the managing director, as de facto manager, 20,000 EUR.

Authority / court

Openbaar Ministerie (Staatsanwaltschaft der Niederlande)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Sanctiewet 1977 i. V. m. EU-Finanzsanktionen gegen Russland (seit 2014)

Action

Fine

Status of proceedings

final

Sector

Other

Liability of senior managers

The managing director paid 20,000 EUR as de facto manager.

Published

23 Sep 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The company gave universities and schools the impression of many years of experience with international education fairs and of supposedly upcoming tours, although it had not actually held any such events; in doing so, it relied on the relationships of the applicant SRT International. The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) regarded this conduct over more than one and a half years as seriously misleading (Art. 31 ZZK – Bulgarian Protection of Competition Act) and imposed 8% of 2023 turnover (17,000 leva), i.e. 1,360 leva, plus reimbursement of costs of 6,000.26 leva.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 31 ZZK (Irreführung)

Action

Fine

Status of proceedings

unknown

Sector

Other

Original amount 1,360 BGN, converted at the ECB reference rate of 19 Sep 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A cyber attack on the server paralysed the company for several weeks and allowed access to customer data. The Romanian data protection authority (ANSPDCP) imposed 24,884.50 lei (5,000 EUR) for insufficient security measures and ordered access logging with a retention period of at least 30 days as well as backups. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 24 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Other

Published

5 Mar 2024

Original amount 24,884.5 RON, converted at the ECB reference rate of 5 Mar 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report