Who was sanctioned, and for what?

The provider of web-based systems for sickness reporting, rehabilitation and occupational safety incidents was hacked in August 2025; the stolen personal data appeared on the dark web shortly afterwards. The Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) found that, despite the high need for protection, there were no adequate security measures and no automatic real-time monitoring for attacks, assessed this as negligent and imposed 1,800,000 SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

22 Sep 2026

Original amount 1,800,000 SEK, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From December 2012 to June 2022, the two companies allocated customers for vehicle tracking and electronic logbook services between themselves and coordinated bids, including in public tenders. At first instance, the Úřad pro ochranu hospodářské soutěže (Czech Office for the Protection of Competition, ÚOHS) fined O2 262.32 million CZK and SHERLOG 18.357 million CZK and imposed a six-month ban on public contracts; for O2, the fine was increased instead of a procurement ban.

Authority / court

Úřad pro ochranu hospodářské soutěže (ÚOHS)

Area of law

Competition law · Cartels and collusion

Legal basis

Tschechisches Wettbewerbsgesetz, Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Published

26 Aug 2026

Original amount 280,677,000 CZK, converted at the ECB reference rate of 26 Aug 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Through a software vulnerability in a mail platform developed by KDDI and provided to several internet service providers, unauthorised parties obtained the credentials (email address and password) of 12,231,954 people; 7,616,173 passwords were stored in plain text, so mailboxes could be read (discovered on 17 June 2026). The authority gave KDDI guidance (shidō) under Art. 147 APPI to improve its technical security measures because access controls against attackers spreading through the system had been inadequate, required a report by 19 October 2026 and also gave such guidance to individual providers responsible for the plain-text storage.

Authority / court

Personal Information Protection Commission (PPC, 個人情報保護委員会)

Area of law

Data protection · Data breaches and data security

Legal basis

Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律) Art. 147, Art. 146 Abs. 1

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

19 Aug 2026

Checked against the official source on 4 Oct 2026 · Direct link

The Bundeskartellamt (Federal Cartel Office) declared binding commitments by Apple on its App Tracking Transparency Framework (ATTF), closing its proceedings under Section 19a(2) of the German Competition Act (GWB) and Article 102 TFEU. According to the preliminary assessment, third-party apps had to obtain, for personalised advertising, an additional and more off-putting consent prompt prescribed by Apple, while Apple used a prompt of its own for its own services; in future the prompts will be aligned so that content, wording and design are neutral, and app providers will be able to combine the required prompts more easily.

Authority / court

Bundeskartellamt

Area of law

Competition law · Abuse of market power

Legal basis

§ 19a Abs. 2 GWB, Art. 102 AEUV (Verpflichtungszusagen, Az. B7-54/25)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

17 Aug 2026

Checked against the official source on 2 Oct 2026 · Direct link

Attackers copied certificates from lost femtocells of KT Corporation into home-made devices, stayed connected to the mobile network undetected for around eleven months, intercepted data on 16,647 subscribers (phone number, IMSI, IMEI) and used intercepted confirmation codes to trigger unauthorised mobile payments of around 240 million KRW affecting 368 people. For inadequate access control – certificates valid for ten years, no IP restriction, no detection of unknown cell IDs – the authority imposed a penalty surcharge of 53,979,000,000 KRW and ordered vulnerability checks and a stronger role for the chief privacy officer.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Sanktion nach Art. 64-2(1) Nr. 9; gesonderter Beschluss 제2026-015-094호: Art. 63(1)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for cooperation, remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years.

Liability of senior managers

The company was ordered to define the responsibility and role of its chief privacy officer (CPO) for the whole company clearly and to revise its governance.

Published

30 Jul 2026

Original amount 53,979,000,000 KRW, converted at the ECB reference rate of 29 Jul 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In two decisions, the European Commission found that Google favours its own services in search (460 million EUR) and prevents app developers on Google Play from steering customers to alternative offers (430 million EUR). Google was ordered to bring the infringements to an end.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Selbstbevorzugungsverbot und Anti-Steering-Pflicht

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Garante (Italian data protection authority) fined TIM 9,516,000 EUR because call centres outside the official sales network made promotional calls on the company's behalf using numbers not recorded in the operators' register ROC or falsified numbers (spoofing), often to lines entered in the do-not-call register, and the contacts obtained in this way reached its systems as apparently lawful leads via fictitious call-back requests on sales partners' web forms. The authority found that TIM had selected and supervised its sales partners inadequately and had systematically failed to answer, or answered late, requests for access, erasure and objection. In addition, TIM must secure its lead process, strengthen oversight of the sales chain and adapt its procedures for data subject rights.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Marketing and consent

Legal basis

Art. 5, 6, 7, 12, 15–22, 24, 25, 28 und 32 DSGVO; Art. 130 Codice in materia di protezione dei dati personali (D.Lgs. 196/2003)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Repeat case

yes

Mitigating circumstances

Taken into account as mitigating: short period and limited number of data subjects, measures taken during the proceedings (including checks on and termination of contracts with partners), a high level of cooperation, no special categories of personal data, adherence to the telemarketing code of conduct and substantial investment in controlling the sales chain.

Published

31 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

The CNIL (French data protection authority) fined the IT and engineering consultancy EXTIA EUR 300,000 because, of 265 erasure requests received in 2024 – mostly from job applicants, occasionally from former employees – 12 were not processed at all and 166 applicants were not told of the outcome; 27 received their reply only after the one-month deadline. The CNIL regarded this as particularly negligent, especially as the company had already been reminded of its obligations by the CNIL twice in 2024 (Art. 12 and 17 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 und 17 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

negligent

Repeat case

yes

Mitigating circumstances

During the proceedings the company deleted the data concerned and informed the applicants retrospectively.

Published

9 Sep 2026

Checked against the official source on 2 Oct 2026 · Direct link

A synchronisation error between two applications allowed a customer to retrieve other customers’ invoices in the mobile app; in addition, the ticketing platform, which was publicly accessible without VPN, MFA or IP restriction, was attacked and a very large data set (including copies of identity documents, card data, IBANs) was exfiltrated. The Romanian data protection authority (ANSPDCP) imposed fines of 104,780 lei (20,000 EUR, Art. 25) and 419,120 lei (80,000 EUR, Art. 32), a total of 523,900 lei, and ordered test and change management. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 25 Abs. 1, Art. 32 Abs. 1 lit. b und d, Abs. 2 und 4 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

17 Jul 2026

Original amount 523,900 RON, converted at the ECB reference rate of 17 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Germany's Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, BaFin) imposed a fine of 240,000 EUR on the software company because it had not disclosed the information about a cyberattack it had suffered as inside information without delay. The fine notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Art. 17 Abs. 1 UAbs. 1 MAR (EU) Nr. 596/2014

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Controladoria-Geral da União (CGU, Office of the Comptroller General) imposed on RSX Informática Ltda. a fine of BRL 8,794,574.67, extraordinary publication of the decision and a three-year ban on tendering for and contracting with the Federal Union, including removal from the supplier register SICAF. The case concerned fraud in a tender (pregão nº 5/2017) of the former Ministry of National Integration and in the resulting contracts; through the price registration agreement, other federal bodies, including the social security institute INSS with a software contract, contracted with the company without holding their own tender.

Authority / court

Controladoria-Geral da União (CGU)

Area of law

Bribery and corruption

Legal basis

Lei nº 12.846/2013, Art. 5 IV d, Art. 6 I und II; Lei nº 10.520/2002, Art. 7

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

10 Jul 2026

Original amount 8,794,574.67 BRL, converted at the ECB reference rate of 9 Jul 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The Garante (Italian data protection authority) fined the US operator of the generative AI service Character.AI, on which users – including minors – chat with virtual characters, 158,000 EUR, among other things for deficient privacy information, a data protection impact assessment prepared late and the late appointment of a representative in the EU. It also criticised weaknesses in the protection of minors and in age verification; within 120 days the company must ensure working age verification, an effective cooling-off period preventing blocked minors from re-registering and private-by-default profiles for minors.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 2, 12 Abs. 1, 13 Abs. 1 und 2, 14 Abs. 1 und 2, 24 Abs. 1, 25 Abs. 2, 27 Abs. 1 und 35 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Repeat case

no

Mitigating circumstances

Mitigating: progressively strengthened age checks (a dedicated service for minors, age verification by a third-party provider), no previous relevant infringements, cooperation and amendments to the privacy policy during the proceedings.

Published

9 Jul 2026

Checked against the official source on 28 Sep 2026 · Direct link

After almost four years of litigation, the federal district court for Idaho entered an order agreed between the FTC and the data broker Kochava. The FTC had alleged that Kochava sold precise location data from hundreds of millions of mobile devices without the knowledge and consent of the people concerned, revealing, for example, visits to health facilities and places of worship. Kochava and its subsidiary Collective Data Solutions, which has taken over the data broker business, may only share sensitive location data with affirmative consent and for services requested by the consumer, and must introduce, among other things, a sensitive-locations programme, checks on their data suppliers, disclosure of recipients and retention limits; no payment is provided for. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. District Court for the District of Idaho auf Klage der Federal Trade Commission (FTC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Section 5 FTC Act, 15 U.S.C. § 45 (unlautere Praktiken); Verfahren nach Section 13(b), 15 U.S.C. § 53(b)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

26 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

With the support of a consultancy, the three largest pay-TV providers agreed from 2019 to May 2025 to introduce advertising as a condition for accessing recordings and to standardise the marketing of this advertising space. The Autoridade da Concorrência (Portuguese Competition Authority, AdC) imposed 8,181,000 EUR on three companies; together with the fourth participant, already sanctioned earlier under a settlement, the fines add up to 13,351,000 EUR. Owing to ongoing court proceedings, the AdC did not publish the names in its announcement.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Lei da Concorrência (Lei n.º 19/2012), Art. 9.º (Processo PRC/2020/4)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

According to the complaint by the US Federal Trade Commission (FTC), Illuminate promised schools data security but did not adequately protect its cloud databases, even though a service provider had pointed out vulnerabilities almost two years earlier; a hacker accessed data on 10.1 million students, including health information. The order requires an information security programme, data minimisation and a public deletion schedule, and prohibits misrepresentations about security and notification deadlines.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Data breaches and data security

Legal basis

FTC Act (Verbot unlauterer und irreführender Praktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Published

5 Jun 2026

Checked against the official source on 25 Sep 2026 · Direct link

The provider of a travel booking system continued to provide services to Ural Airlines, designated in May 2022, requested payments of around 906,600 USD and, after the funds were frozen by the bank, looked for alternative payment routes, which HM Treasury's Office of Financial Sanctions Implementation (OFSI) regarded as circumvention. A lack of escalation during a change of roles, vacant leadership positions in legal and compliance, policies focused on US law and screening that did not flag the designation all contributed. According to the annual accounts filed with the UK companies register for financial year 2024, the company had around 150 employees.

Authority / court

HM Treasury, Office of Financial Sanctions Implementation (OFSI)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Russia (Sanctions) (EU Exit) Regulations 2019, regs. 13, 14, 19

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

50 to 249

Mitigating circumstances

Voluntary disclosure (31 October 2022) and full cooperation; settlement under the new settlement procedure

Published

17 Jun 2026

Original amount 1,000,920.59 GBP, converted at the ECB reference rate of 26 May 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Attackers posed as technical support, induced staff at points of sale to grant system access and obtained data on more than 365,000 customers, including payment data for 41,359 of them. The Italian data protection authority (Garante per la protezione dei dati personali) criticised deficient management of access credentials and digital certificates as well as inadequate security assessments, and imposed 1,715,600 EUR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO (Integrität und Vertraulichkeit, Art. 32)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

16 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

In its own online shop for Galaxy S25 pre-orders, KT Corporation stated that benefits would apply unless the end of the promotion was shown, but then limited them to the first 1,000 orders and unilaterally cancelled 7,127 pre-orders that had come in via a YouTube channel and Genie TV and had already been fully completed. The authority regarded this as false information on key terms and an unjustified refusal to conclude contracts under the Telecommunications Business Act (전기통신사업법), imposed a fine of 640,000,000 KRW and ordered KT to show additional pre-order benefits clearly in future.

Authority / court

Korea Media and Communications Commission (KMCC, 방송미디어통신위원회)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Telecommunications Business Act (전기통신사업법) Art. 50(1) Nr. 5 und Nr. 5-2

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

8 May 2026

Original amount 640,000,000 KRW, converted at the ECB reference rate of 8 May 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Four Australian companies of the Canva group did not lodge their financial reports for the 2024 financial year with ASIC by the due date of 30 April 2025; the consolidated report followed only on 27 March 2026. ASIC issued an infringement notice of allegedly AUD 198,000 to each company (AUD 792,000 in total); the notices were paid, which is not an admission of guilt.

Authority / court

Australian Securities and Investments Commission (ASIC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

s 319(1) Corporations Act 2001 (Cth); Bußgeldbescheide nach s 1317DAM

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

6 May 2026

Original amount 792,000 AUD, converted at the ECB reference rate of 28 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The Privacy Commissioner found that the rental application platform 2Apply collected more personal information than necessary from March 2020 to March 2025, such as gender, student status, citizenship, visa expiry and previous living arrangements, and did so unfairly through design techniques such as “confirmshaming”, biased framing and bundled consent. The determination requires IRE to stop this collection within 60 days, engage an independent reviewer and report to the OAIC within twelve months on implementing the recommendations.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

APP 3.2 und APP 3.5 (Privacy Act 1988 (Cth)); Feststellungen nach s 52(1A)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

IRE adapted its collection practices during the investigation without admitting a breach.

Published

22 Apr 2026

Checked against the official source on 3 Oct 2026 · Direct link

Singtel Optus asked customers who ported their number to Optus whether they wanted to appear in the phone directory, but between October 2015 and September 2019 it did not act on requests for an unlisted number, so that 41,278 affected customers remained published in the White Pages. The Privacy Commissioner found a breach of APP 11.1 because Optus did not remove a risk of errors it had been aware of throughout the period with reasonable steps such as regular system reconciliations, and declared that the company must not repeat this conduct. The regulator intends to decide on compensation separately in a representative complaint concerning the same conduct.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 1988 (Cth) s 13(1), APP 11.1; Erklärung nach s 52(1A)(a)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

11 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

On 19 March 2026 OFSI imposed a monetary penalty of GBP 390,000 on Ireland-based Apple Distribution International Limited by way of settlement. According to OFSI's findings, the company, which pays out revenues to software developers on an app marketplace, instructed two payments totalling GBP 635,618.75 in June and July 2022 from a UK bank account to a Russian app developer owned by a designated entity, and did not cancel the instructions. OFSI identified reliance on developers' self-declarations and on third-party data, among other things, as causes. The company had voluntarily disclosed the payments on 4 October 2022. The settlement followed a notice of intent of 11 November 2025 and was reached under the settlement process introduced in February 2026; OFSI made no findings against the parent company. Source: Office of Financial Sanctions Implementation (OFSI), HM Treasury, "Imposition of monetary penalty: Apple Distribution International Limited", 30 March 2026, https://www.gov.uk/government/publications/imposition-of-monetary-penalty-apple-distribution-international-limited. Contains public sector information licensed under the Open Government Licence v3.0 (https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/).

Authority / court

HM Treasury, Office of Financial Sanctions Implementation (OFSI)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Russia (Sanctions) (EU Exit) Regulations 2019, reg. 12; Geldbuße nach s. 146 Policing and Crime Act 2017 (Settlement)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

30 Mar 2026

Original amount 390,000 GBP, converted at the ECB reference rate of 19 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

The telecoms infrastructure company Míla hf. admitted in a settlement with Samkeppniseftirlitið (Icelandic Competition Authority) that from October 2023 to December 2024 it had breached the conditions of the September 2022 settlement on its acquisition by Ardian: the frequency and scope of its contacts with Síminn were liable to weaken Síminn's incentive to buy wholesale services from Míla's competitors beyond its contractual purchase obligation. Míla pays a fine of 200,000,000 ISK and accepts additional conditions; at the same time, some conditions were limited, owing to changed market conditions, to areas where Míla has significant market power.

Authority / court

Samkeppniseftirlitið

Area of law

Competition law · Merger control

Legal basis

Verstoß gegen Fusionsauflagen (Art. 4 und 8 eines früheren Vergleichs); Vergleich nach Art. 17f Abs. 1 Samkeppnislög Nr. 44/2005 (isländisches Wettbewerbsgesetz)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

19 Mar 2026

Original amount 200,000,000 ISK, converted at the ECB reference rate of 18 Mar 2026.

Checked against the official source on 28 Sep 2026 · Direct link

From February 2020 to May 2024, Excom Global advertised its rental of mobile Wi-Fi routers for travel abroad ('Imoto no WiFi') in travel-guide adverts and on its own websites as number one for customer satisfaction, for being chosen by overseas travellers and for customer service. The commissioned survey, without checking actual use, merely asked for impressions of the websites of the company and nine arbitrarily selected competitors and was also not reproduced accurately; a surcharge of 172,620,000 JPY was imposed.

Authority / court

Consumer Affairs Agency (消費者庁, CAA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 8 Abs. 1 i. V. m. Art. 5 Nr. 1 Act against Unjustifiable Premiums and Misleading Representations (不当景品類及び不当表示防止法, Gesetz Nr. 134/1962)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

12 Mar 2026

Original amount 172,620,000 JPY, converted at the ECB reference rate of 12 Mar 2026.

Checked against the official source on 4 Oct 2026 · Direct link

Following six complaints, the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) found that the company did not provide a copy to customers who requested recordings of their sales calls in order to dispute invoices, offering only to let them listen via customer service, and in some cases deleted recordings. In addition to a reprimand, a fine of 5,000 EUR was imposed.

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio (Datenschutzbeauftragter, Sanktionsgremium)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 15 Abs. 1 und 3

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

25 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

From 2008 to 2011, the Paris-based supplier of betting and gaming terminals made unjustified payments of 78,972 EUR to an official of a majority state-owned company in Mali, with which it had a supply contract awarded without a tender. The case was triggered by a report from TRACFIN (the French financial intelligence unit). Public interest fine of 499,150 EUR (including 335,000 EUR already seized) and a three-year AFA compliance programme.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung ausländischer Amtsträger und Geldwäsche

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

50 to 249

Culpability

intentional

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

18 Feb 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

With effect from 4 April 2022, Orange Polska unilaterally introduced a fee for keeping the phone number active in existing prepaid contracts, although neither the law nor the contract allowed this change, and it failed to disclose the fee on starter packs and on its website. UOKiK classed both as unfair practices and imposed fines of PLN 17,325,000 and PLN 7,425,000, totalling PLN 24,750,000. The decision is not final.

Authority / court

Prezes Urzędu Ochrony Konkurencji i Konsumentów (UOKiK)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 24 Abs. 2 Nr. 3 und Art. 27 ustawa o ochronie konkurencji i konsumentów i. V. m. Art. 4 und Art. 6 ustawa o przeciwdziałaniu nieuczciwym praktykom rynkowym

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Original amount 24,750,000 PLN, converted at the ECB reference rate of 30 Jan 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The provider of management software and an app for sports clubs suffered a data exfiltration by an external attacker in January 2025. The Swedish Authority for Privacy Protection (IMY) found that no appropriate technical and organisational security measures were in place before and at the time of the incident, even though the data processed related predominantly to children and also included health information (allergies, disabilities), and imposed 6 million SEK; in setting the amount it took into account the 2024 group turnover of the Lime group (around 685.7 million SEK).

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Prompt and comprehensive information of the clubs and data subjects after the incident; support for around 1,700 clubs in filing their notifications within 72 hours.

Published

26 Jan 2026

Original amount 6,000,000 SEK, converted at the ECB reference rate of 26 Jan 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Konkurences padome (Latvian Competition Council) found that SIA „Burde B.V.“, the only distributor in Latvia of software licences for Gatso RT4 speed cameras, charged the state-owned company CSDD, which operates the cameras under a state mandate and depended on these licences, excessive prices from September 2022 to July 2023; within six months the price rose by around 260 %. It treated this as an abuse of a dominant position and imposed 24,199.25 EUR. The decision is not final.

Authority / court

Konkurences padome (Lettischer Wettbewerbsrat)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 13 Abs. 1 Nr. 4 Konkurences likums (Wettbewerbsgesetz)

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Published

4 Feb 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined the time-recording system provider Timegrip AS NOK 250,000 because, after a retail chain went bankrupt, the company refused 80 former employees access to their clock-in data, which they needed to document their wage claims. The authority treated Timegrip as controller, since after the bankruptcy the company alone in fact decided on storage, use and access, and found a breach of the right of access under Art. 15(1) and (3) GDPR. A fine of NOK 750,000 had been notified; the authority took into account, among other things, the confused situation and its own long case-handling time.

Authority / court

Datatilsynet

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 15 Abs. 1 und 3, Art. 58 Abs. 2 lit. i, Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

intentional

Mitigating circumstances

The confused situation after the customer's bankruptcy (given only limited weight) and Datatilsynet's long case-handling time; NOK 750,000 had been notified.

Published

20 Jan 2026

Original amount 250,000 NOK, converted at the ECB reference rate of 16 Jan 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The Controladoria-Geral da União (CGU, Office of the Comptroller General) imposed on Linkcon Ltda. a fine of BRL 21,521,878.64, extraordinary publication of the decision and a two-year ban on tendering for and contracting with the Federal Union. According to the final report, an electronic tender of the port company Companhia Docas do Rio de Janeiro (PE 17/2016) and the resulting price registration agreement were steered in the company's favour through simulated price surveys; it also submitted a false document to be classified as a small business (EPP). The CGU rejected the request for reconsideration on 30 July 2026. The amount and the facts have not been confirmed against the primary source.

Authority / court

Controladoria-Geral da União (CGU)

Area of law

Bribery and corruption

Legal basis

Lei nº 12.846/2013, Art. 5 IV a, Art. 6 I und II; Lei nº 10.520/2002, Art. 7

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

12 Jan 2026

Original amount 21,521,878.64 BRL, converted at the ECB reference rate of 9 Jan 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Following an attack in October 2024 in which data relating to around 24 million customer contracts, including IBANs, was exfiltrated, the French data protection authority (CNIL) imposed 27 million EUR on Free Mobile and 15 million EUR on Free (42 million EUR in total). The authority objected to VPN access without adequate authentication, deficient detection of suspicious access, incomplete notification of data subjects and, at Free Mobile, excessively long retention of old contracts; orders with deadlines were also issued.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 32, Art. 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

During the proceedings, the companies introduced multi-factor authentication, a Security Operations Centre and improved logging.

Published

14 Jan 2026

Checked against the official source on 25 Sep 2026 · Direct link

The provider of cloud-based HR software received an extortion email in April 2024; an attacker had deleted databases on its AWS servers and likely exfiltrated data, and data allegedly taken was offered for sale on the dark web – data on 95,000 employees of its clients (including identity number, salary, bank account and religion) and on 24,765 emergency contacts and children was put at risk. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because, despite the HR data entrusted to it by clients, the provider had no web application firewall against existing SQL injection vulnerabilities, remote desktop access open to the internet without two-factor authentication, and vulnerability scans only every two years. It imposed 17,500 SGD, payable in twelve monthly instalments in view of the company's cash flow, and directed among other things a web application firewall, annual penetration tests, two-factor authentication and encryption of all personal data fields.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach; payment in instalments in view of cash flow, while a waiver was refused.

Published

8 Jan 2026

Original amount 17,500 SGD, converted at the ECB reference rate of 8 Jan 2026.

Checked against the official source on 4 Oct 2026 · Direct link

In February 2025 (Delibera 49/25/CONS), AGCOM (Italian communications regulator) had required Cloudflare, as a service provider involved in making unlawful content accessible, to stop DNS resolution and the routing of traffic to domains and IP addresses reported via the "Piracy Shield" platform. Because the company took no measures even after the order had been served, the authority imposed a fine of 14,247,698.56 EUR – 1% of worldwide turnover, within a statutory range of up to 2%.

Authority / court

Autorità per le garanzie nelle comunicazioni (AGCOM)

Area of law

AI and digital regulation · Platform obligations

Legal basis

Art. 1 Abs. 31 Legge 249/1997 i. V. m. Legge 93/2023 (Anti-Piraterie-Gesetz) und Anordnung Delibera 49/25/CONS

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

No previous sanctions of this kind; because the provision was being applied to the company for the first time, the authority stayed below the maximum rate.

Published

8 Jan 2026

Checked against the official source on 28 Sep 2026 · Direct link

In August 2024 an attacker encrypted a network drive shared by SESAMi and its subsidiary Abecha holding payment data (including full credit card numbers and bank account details) of around 20,471 customers of the subsidiary's fuel fleet discount programme and of up to 18,837 individuals from registrations for SESAMi's B2B platform; exfiltration could not be established. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) classified SESAMi, which ran the network for the subsidiary without a written contract, as a data intermediary in that respect and found a negligent breach of the Protection Obligation by SESAMi (including outdated firewall and VPN firmware, no patch management and unenforced password and MFA rules), and likewise by Abecha, which as controller had taken no steps to ensure adequate security at SESAMi. SESAMi received 8,750 SGD and directions, while Abecha, as the controller, received directions only, including setting out roles and data protection duties within the group in writing.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation); Section 4(3) PDPA (Pflichten bei Einsatz eines Data Intermediary); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Cooperation, prompt and effective remediation, admission under the Expedited Decision Procedure; for Abecha also lower culpability owing to its limited autonomy as a wholly owned subsidiary, one of the reasons for not imposing a fine on it.

Published

26 Feb 2026

Original amount 8,750 SGD, converted at the ECB reference rate of 29 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

As a processor, Nexpublica developed and operated the case management software ‘Public CRM’ for the disability authority MDPH Nord. Following two data breaches in 2022, audits revealed critical vulnerabilities that had existed since 2021, such as outdated SHA-1 hashing; the French data protection authority (CNIL) imposed 1.7 million EUR directly on the service provider.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data processors

Legal basis

Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

In August 2020, the operators of the electronic class registers ‘Tamo’ and ‘Eduka’ agreed to stop competing: one group kept the class register business, the other took over the digital learning content. Following acknowledgement of the infringement, the fines were reduced by 15%: 2,714,940 EUR jointly and severally for the Snowball.xyz group and 913,340 EUR for the AL holdingas group (Art. 101 TFEU). The decision can be appealed. Source: archived copy of the press release.

Authority / court

Konkurencijos taryba (Litauischer Wettbewerbsrat)

Area of law

Competition law · Cartels and collusion

Legal basis

Konkurencijos įstatymas; Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Acknowledgement of the infringement (15% reduction)

Published

18 Dec 2025

Checked against the official source on 25 Sep 2026 · Direct link

In February 2023, the IT holding company acquired a 50% stake with negative sole control in the Xiaomi distributor Mystical Hungary Zrt., but only approached the Gazdasági Versenyhivatal (Hungarian Competition Authority, GVH) after 582 days and notified the concentration thereafter. Following voluntary disclosure, acknowledgement and waiver of legal remedies, the authority imposed a significantly reduced 32.6 million HUF.

Authority / court

Gazdasági Versenyhivatal (GVH)

Area of law

Competition law · Merger control

Legal basis

Ungarisches Wettbewerbsgesetz, Vollzugsverbot

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Voluntary disclosure, acknowledgement and waiver of legal remedies.

Published

18 Dec 2025

Original amount 32,600,000 HUF, converted at the ECB reference rate of 18 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The AGCM found that Apple's App Tracking Transparency (ATT) policy, in force since 26 April 2021, constituted an exploitative abuse of a dominant position: third-party iOS app developers had to use Apple's ATT prompt in addition to their own consent request for the same purpose, a condition imposed unilaterally and disproportionately. Apple Inc., Apple Distribution International Ltd and Apple Italia S.r.l. were fined 98,635,416.67 EUR and ordered to end the conduct immediately; the authority expressly did not question Apple's aim of protecting privacy.

Authority / court

Autorità Garante della Concorrenza e del Mercato (AGCM)

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV; Art. 15 Legge n. 287/1990

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Mitigating circumstances

The AGCM did not apply an increase for the very high group turnover, which its guidelines would have allowed, in view of parallel proceedings against Apple by other competition authorities.

Published

22 Dec 2025

Checked against the official source on 28 Sep 2026 · Direct link

The telecoms provider pleaded guilty to using a prohibited clause allowing unilateral amendment of contracts without the specific conditions required by law, and to omitting mandatory information from distance contracts for successive services, such as a detailed description of the services, the price and description of devices offered as a premium, usage restrictions and geographical limits. Fines totalling CAD 210,700 including costs were imposed on 50 counts; the offences dated from 2012 and 2013.

Authority / court

Gericht in Montréal (Ermittlung: Office de la protection du consommateur (OPC); Anklage: Directeur des poursuites criminelles et pénales (DPCP))

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Loi sur la protection du consommateur (RLRQ c. P-40.1), Art. 11.2 und 214.2

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

6 Feb 2026

Original amount 210,700 CAD, converted at the ECB reference rate of 15 Dec 2025.

Checked against the official source on 3 Oct 2026 · Direct link

The CNIL (Commission nationale de l'informatique et des libertés, French data protection authority) fined MOBIUS SOLUTIONS LTD, a provider of tools for personalised advertising campaigns with no establishment in the EU, EUR 1,000,000: as a processor for Deezer, the company had kept a copy of the data of more than 46 million users after the contract ended, used the data without instructions to improve its own services and kept no record of its processing activities (Art. 28(3)(g), Art. 29, Art. 30 GDPR). Deezer had notified the CNIL in November 2022 that user data had appeared on the dark web.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data processors

Legal basis

Art. 28 Abs. 3 lit. g, Art. 29 und Art. 30 DSGVO (Délibération SAN-2025-014 vom 11.12.2025)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

19 Dec 2025

Checked against the official source on 2 Oct 2026 · Direct link

On 8 October 2024 Singtel's fixed-line voice service failed for more than four hours for around 500,000 residential and corporate users; customer service lines of government agencies, healthcare organisations and banks as well as emergency call services were also affected. The cause was that the virtualised firewalls of the voice system and of a monitoring system shared the same hardware, so that an overload of the insufficiently filtered monitoring system also disrupted the voice system and the automatic failover did not work cleanly; according to the investigation, there was no cyber-attack. The Infocomm Media Development Authority (IMDA, Singapore's telecoms and media regulator) imposed a penalty of SGD 1 million under the Telecommunications Act because the incident had been within Singtel's control to prevent.

Authority / court

Infocomm Media Development Authority (IMDA)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunications Act

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

11 Dec 2025

Original amount 1,000,000 SGD, converted at the ECB reference rate of 11 Dec 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Following proceedings brought by the Commerce Commission (New Zealand's competition and consumer regulator), the High Court ordered One New Zealand Group Limited to pay a pecuniary penalty of 1,100,000 NZD; in addition, the company is paying 100,000 NZD towards the authority's costs, which is not included in the amount. One NZ admitted ten breaches of the 111 Contact Code between 2021 and 2023 concerning information duties, record-keeping and regular contact with customers. The Code is intended to ensure that vulnerable customers whose landline does not work in a power cut receive another way of calling 111 at no cost.

Authority / court

High Court of New Zealand (Verfahren der Commerce Commission)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunications Act 2001 (Neuseeland), s 156B; 111 Contact Code

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

According to the Commerce Commission, One NZ remedied the breaches as soon as it recognised their scale and cooperated fully with the investigation; the breaches were admitted.

Published

1 Dec 2025

Original amount 1,100,000 NZD, converted at the ECB reference rate of 1 Dec 2025.

Checked against the official source on 3 Oct 2026 · Direct link

The address broker (formerly Kapitol) had passed on the complainant’s data via a media agency to an advertiser for direct marketing without being able to demonstrate valid consent. The Autorité de protection des données (Belgian Data Protection Authority, APD) imposed 40,000 EUR and ordered erasure and information of the recipients; on 3 June 2026 the Cour des marchés (Brussels Market Court) set aside these parts and itself set the fine at 5,000 EUR.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse; Cour des marchés

Area of law

Data protection · Marketing and consent

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, Art. 6 Abs. 1, Art. 24

Action

Fine

Status of proceedings

reduced

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

In 2022, an attacker first compromised an employee's company laptop and then the personal laptop of a senior employee, whose master password he captured using a keylogger. Because the personal and business password vaults were linked via the same master password, he obtained the access and decryption keys stored there and stole data on up to 1.6 million UK users from the backup database. According to the annual accounts filed with the UK companies register for financial year 2025, the company had around 35 employees.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1 lit. f

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

Under 50

Culpability

negligent

Published

11 Dec 2025

Original amount 1,228,283 GBP, converted at the ECB reference rate of 20 Nov 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

The telecommunications provider allowed a software service provider belonging to the group in Serbia to access the entire SAP CRM customer database with administrator rights, from the end of 2022 without standard contractual clauses and without clear information to customers. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) also sanctioned the copying of employees’ identity cards and criminal records certificates and the failure to vet a telemarketing service provider; 4.5 million EUR in total.

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · International data transfers

Legal basis

Art. 44, 46, 12 Abs. 1, 13 Abs. 1 lit. f, 5, 6 Abs. 1, 28 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

14 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

From 2012 to 2018, the Guatemalan mobile network operator made monthly cash payments to members of Congress or their security staff in order to obtain legislative support; part of the funds came from laundered drug money. Two-year Deferred Prosecution Agreement with a criminal penalty of 60 million USD and administrative forfeiture of 58,198,343 USD.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section; USAO Southern District of Florida)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA, 15 U.S.C. § 78dd-3 (Verschwörung, 18 U.S.C. § 371); Deferred Prosecution Agreement

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure by the parent company Millicom in 2015; subsequently extensive cooperation and remediation (including dismissals of staff and an 800 % increase in compliance personnel).

Published

12 Dec 2025

Original amount 118,198,343 USD, converted at the ECB reference rate of 12 Nov 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Texas, represented by the Office of the Attorney General, had sued Google for unlawfully collecting location data, activity in incognito mode and biometric identifiers. Google signed a settlement of $1.375 billion, concluding two sets of proceedings.

Authority / court

Office of the Attorney General of Texas

Area of law

Data protection · Cookies and tracking

Action

Other

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

31 Oct 2025

Original amount 1,375,000,000 USD, converted at the ECB reference rate of 31 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

In inspections in 2021/22, the RDI (Rijksinspectie Digitale Infrastructuur, the Dutch Authority for Digital Infrastructure) found that the mobile operator had no mandatory security plan for its system for lawful interception of telecommunications, that employees with access had not been adequately screened (missing job descriptions, confidentiality declarations, certificates of conduct), that unauthorised persons had access to interception data and that suppliers could access the system digitally. The RDI imposed 1,518,750 EUR; Odido has since renewed the system.

Authority / court

Rijksinspectie Digitale Infrastructuur (RDI)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

System renewed, risk of unauthorised access eliminated.

Published

17 Oct 2025

Checked against the official source on 28 Sep 2026 · Direct link

During ongoing tenders for school equipment, Smart Soft sent dozens of identical letters to schools in the Plovdiv/Pazardzhik/Panagyurishte region containing untrue or distorted statements about a competitor. The Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found damage to reputation (Art. 30 ZZK – Bulgarian Protection of Competition Act) over around two months and imposed 3% of 2024 turnover, i.e. 37,410 leva. An appeal has been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 30 ZZK (Schädigung des guten Rufs eines Wettbewerbers)

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Original amount 37,410 BGN, converted at the ECB reference rate of 25 Sep 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

According to the FTC complaint, the education provider hid the cancellation option for its automatically renewing subscriptions on its website and, since October 2020, continued to charge almost 200,000 customers even after they had cancelled. Under the settlement, Chegg is paying 7.5 million USD for refunds and must offer simple cancellation.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Information duties in online retail

Legal basis

Restore Online Shoppers' Confidence Act (ROSCA); Section 5 FTC Act

Action

Disgorgement of profits

Status of proceedings

final

Sector

Telecoms, IT and software

Repeat case

yes

Published

15 Sep 2025

Original amount 7,500,000 USD, converted at the ECB reference rate of 18 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Unknown persons accessed the system operator’s databases via several websites and obtained personal data. The Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) initially imposed 400,000 EUR; in the objection procedure, the director set aside the allegation relating to the company’s role as controller because ZZ Dats was a processor, and set the fine at 300,000 EUR for insufficient security measures under Art. 32 GDPR. The company has brought an action.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und d, Abs. 2, Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

Attackers who had planted malware in systems of SK Telecom Co., Ltd. since August 2021 took 9.82 GB of data on around 23 million subscribers from the home subscriber server in April 2025, including USIM authentication keys and IMSI. The authority found a lack of network segregation and access controls, authentication data not securely encrypted, missing security updates, an inadequate set-up of the chief privacy officer function and late notification of those affected. It imposed a penalty surcharge of 134,791,000,000 KRW and an administrative fine of 9,600,000 KRW (134,800,600,000 KRW in total) and issued orders on security, governance and oversight of service providers and sales partners.

Authority / court

Personal Information Protection Commission (PIPC, 개인정보보호위원회)

Area of law

Data protection · Data breaches and data security

Legal basis

Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 31(1) und (3), Art. 34(1); Sanktion nach Art. 64-2(1) Nr. 9

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Mitigating circumstances

Reduction of 30% because no benefit was derived and a further 50% for completed remediation, compensation of those affected and protective efforts; increase of 50% because the infringement lasted more than two years. Cooperation was not taken into account because documents were submitted late.

Liability of senior managers

There was no chief privacy officer (CPO) with overall responsibility; the company was ordered to define the CPO’s responsibility and role clearly and to rebuild its governance.

Published

28 Aug 2025

Original amount 134,800,600,000 KRW, converted at the ECB reference rate of 27 Aug 2025.

Checked against the official source on 4 Oct 2026 · Direct link

From 2015 to 2021, the San José provider of chip design software supplied hardware, software and semiconductor IP at least 59 times to the National University of Defense Technology (NUDT), a military university on the Entity List, disguised under the alias Central South CAD Center. Cadence pleaded guilty before the US Department of Justice to conspiracy to commit export control violations; criminal penalties of almost 118 million USD and civil penalties of more than 95 million USD imposed by the Bureau of Industry and Security (BIS) result, after crediting, in a net total of more than 140 million USD.

Authority / court

U.S. Department of Justice; Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

Export Administration Regulations (Entity List); ECRA; Verschwörung zu Exportkontrollverstößen

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

intentional

Published

28 Jul 2025

Original amount 140,000,000 USD, converted at the ECB reference rate of 28 Jul 2025.

Checked against the official source on 25 Sep 2026 · Direct link

According to VARA's enforcement list, The Open Network Foundation breached the VARA Marketing Regulations. The list records a cease-and-desist order, a fine of an undisclosed amount and a public statement as the measures taken.

Authority / court

Virtual Assets Regulatory Authority (VARA), Dubai

Area of law

Capital markets and financial supervision

Legal basis

VARA Marketing Regulations

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 3 Oct 2026 · Direct link

The Comisión Nacional de los Mercados y la Competencia (CNMC, Spanish competition and markets authority) fined Telefónica de España 20,000,000 EUR because from August 2021 to April 2023 it tied its Movistar Fusión and MiMovistar bundles including pay TV and device rental to minimum contract periods and early termination penalties. This breached the commitments under which the acquisition of DTS had been cleared in 2015; the CNMC treated the repeated breaches of these commitments as an aggravating factor.

Authority / court

Comisión Nacional de los Mercados y la Competencia (CNMC)

Area of law

Competition law · Merger control

Legal basis

Art. 62.4.c) und Art. 64.2.a) Ley 15/2007 de Defensa de la Competencia; Zusagen 1.1 und 1.1.2 einer früheren Fusionsfreigabe

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Published

30 Jul 2025

Checked against the official source on 28 Sep 2026 · Direct link

The Nasjonal kommunikasjonsmyndighet (Nkom, Norwegian Communications Authority) imposed an administrative penalty (overtredelsesgebyr) of 50,000,000 NOK on Telenor Norge because, on four occasions in autumn 2024 (29 August, 16 September, 17/18 October, 13 November), emergency calls over its network failed entirely or intermittently or were misrouted. The inspection found 22 breaches of ekomloven (Electronic Communications Act), sikkerhetsloven (National Security Act) and several regulations, including inadequate risk assessments, planned work not carried out securely, insufficient redundancy, inadequate auditing of a subcontractor and late notification of the authority. In its final decision Nkom maintained the amount announced in February 2025; the deadline for an administrative appeal ran until 8 September 2025.

Authority / court

Nasjonal kommunikasjonsmyndighet (Nkom)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

ekomloven (lov 4. juli 2003 nr. 83), sikkerhetsloven (lov 1. juni 2018 nr. 24), ekomforskriften, nummerforskriften, klassifiseringsforskriften, virksomhetssikkerhetsforskriften

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Published

3 Jul 2025

Original amount 50,000,000 NOK, converted at the ECB reference rate of 3 Jul 2025.

Checked against the official source on 28 Sep 2026 · Direct link

The SaaS provider operates a system for licensed moneylenders that is linked to the Moneylenders Credit Bureau and into which its clients enter data on loan applicants and borrowers; in June 2024 an attacker used a vulnerable web application to take over the SQL server's system administrator account, which was protected only by an easily guessed password, deleted databases and exfiltrated data on 190,589 individuals including credit report data, which was offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation (inadequate access control, no vulnerability assessments or penetration tests) and, given the company's role as a provider processing client data entrusted to it, considered a fine of 17,500 SGD appropriate; it rejected the request for a waiver or reduction. In addition, the company must obtain the Cyber Trust mark certification of the Cyber Security Agency of Singapore (CSA) for its new network within nine months.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

3 Jul 2025

Original amount 17,500 SGD, converted at the ECB reference rate of 3 Jul 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Using a customer’s identity card, an unknown person registered at least 15 prepaid numbers in her name at a Vodafone partner shop. By Decision 27/2025, the Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority) imposed on Vodafone 350,000 EUR (processing by a processor, Art. 28), 200,000 EUR (accuracy of data) and 150,000 EUR under the Greek ePrivacy law, and issued a reprimand requiring the company to secure the activation of new numbers technically within three months (for example by sending an SMS to the existing customer); the shop (partnership, anonymised) received 40,000 EUR.

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data processors

Legal basis

Art. 5 Abs. 1 lit. d, Art. 28 Abs. 1 und 3 DSGVO; Art. 12 Gesetz 3471/2006

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2021, a whistleblower reported payments by subsidiaries in Indonesia, Malaysia, Vietnam, Thailand and India to contractual partners; the investigation concerned private-sector bribery and bribery of foreign public officials. The CJIP provides for a public interest fine of 16,074,511 EUR (including 1 million EUR already seized) and a three-year AFA compliance programme.

Authority / court

Parquet national financier (PNF); Validierung durch das Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); Bestechung im privaten Sektor und ausländischer Amtsträger

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Culpability

intentional

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

The Autorité de la concurrence (French Competition Authority) sanctioned two agreements not to poach each other’s staff: between Alten and Ausy (now Randstad Digital) for business managers from 16 November 2007 to 26 September 2016, and between Expleo and Bertrandt from 6 February to 21 September 2018. It fined Alten EUR 24 million, Bertrandt EUR 3.6 million and Expleo EUR 1.9 million; Randstad Digital received full immunity as leniency applicant. By contrast, the authority did not find non-solicitation clauses in partnership contracts or the allegations against Atos to be infringements.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Cartels and collusion

Legal basis

Art. L. 420-1 Code de commerce; Art. 101 Abs. 1 AEUV

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Mitigating circumstances

Leniency: full immunity from fines for Randstad Digital (formerly Ausy).

Published

11 Jun 2025

Checked against the official source on 2 Oct 2026 · Direct link

Malicious employees in partner agencies that broker contracts for Vodafone had created fictitious contracts and contract changes to the detriment of customers. The German Federal Commissioner for Data Protection and Freedom of Information (BfDI) imposed 15 million EUR for inadequate vetting and monitoring of the partner agencies (Art. 28) and 30 million EUR for authentication deficiencies in ‘MeinVodafone’ in combination with the hotline, through which unauthorised persons were able, among other things, to retrieve eSIM profiles; in addition, a reprimand was issued under Art. 32.

Authority / court

Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)

Area of law

Data protection · Data processors

Legal basis

Art. 28 Abs. 1 S. 1, Art. 32 Abs. 1 DSGVO

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

Full cooperation including self-incrimination, modernisation of systems, separation from fraudulent partners; fines accepted and paid, plus donations amounting to millions.

Published

3 Jun 2025

Checked against the official source on 25 Sep 2026 · Direct link

A customer's mobile number was ported to MásMóvil without the customer having requested it; the new SIM card was handed over to a third party who did not identify themselves. The Spanish data protection authority (Agencia Española de Protección de Datos, AEPD) found processing without a legal basis, imposed 200,000 EUR and ordered measures against such incidents; the company's request for reconsideration was unsuccessful.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

According to the Federal Trade Commission (FTC, the US consumer protection authority), the web host did not use multi-factor authentication for its hosting services, monitored security threats inadequately and did not secure connections to customer data, yet advertised “award-winning security”. The final order prohibits false statements about security and requires a comprehensive information security programme and regular reviews by independent assessors.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

21 May 2025

Checked against the official source on 28 Sep 2026 · Direct link

SAP had not published an announcement stating from when and at which internet address the 2022 annual financial report was publicly available in addition to the company register (Hinweisbekanntmachung). BaFin imposed a fine of 1.75 million EUR; the notice is final.

Authority / court

Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

§ 114 Abs. 1 Satz 2 WpHG

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

27 May 2025

Checked against the official source on 25 Sep 2026 · Direct link

In one of the first non-compliance decisions under the Digital Markets Act (DMA), the European Commission found that Apple prevents app developers from informing customers free of charge about cheaper offers outside the App Store and steering them there. In addition to a fine of 500 million EUR, the removal of the restrictions within 60 days was ordered, failing which periodic penalty payments may be imposed.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Verordnung (EU) 2022/1925 (DMA), Anti-Steering-Pflicht

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Apr 2025

Checked against the official source on 25 Sep 2026 · Direct link

The US operator of the Replika chatbot had not determined a legal basis for the processing, had an inadequate privacy notice and, despite declaring that minors were excluded, had no age verification. Italy's data protection authority (Garante per la protezione dei dati personali) imposed 5 million EUR and opened further proceedings concerning the training of the underlying language model.

Authority / court

Garante per la protezione dei dati personali

Area of law

AI and digital regulation · AI systems

Legal basis

DSGVO (Rechtmäßigkeit, Transparenz, Schutz Minderjähriger)

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Published

19 May 2025

Checked against the official source on 25 Sep 2026 · Direct link

In two decisions under Section 19a of the German Competition Act (GWB), the Bundeskartellamt (Federal Cartel Office) declared commitments by Google binding: the services in Google Automotive Services (Maps, Play, Assistant) will in future also be licensed to car manufacturers individually, incentive clauses such as advertising revenue sharing and default settings will be dropped, and interoperability with other providers will be ensured. For the Google Maps Platform, contractual restrictions on combining it with other providers' map services are lifted; the commitments on Automotive Services apply to cars registered in Germany and, owing to uniform EU registration rules, to the European market, while those on the Maps Platform apply at least to licensees with a billing address in the EEA.

Authority / court

Bundeskartellamt

Area of law

Competition law · Abuse of market power

Legal basis

§ 19a GWB (für bindend erklärte Verpflichtungszusagen; Az. B7-25/22)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

9 Apr 2025

Checked against the official source on 2 Oct 2026 · Direct link

The provider of point-of-sale and CRM software for small and medium-sized enterprises reported two attacks in 2024 in which perpetrators used SQL injection, among other methods, to extract files with data on a total of 698,112 individuals, including health information (skin conditions and treatments) of 9,122 individuals; the data was likely posted on a hacking forum. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) stressed that the SaaS provider holds large volumes of data on behalf of its clients and found a breach of the Protection Obligation: publicly accessible servers, no network firewall, no security testing before releases, unsupported operating system and PHP versions, and credentials left unprotected in source code and configuration files. Alongside 17,500 SGD it directed a package of measures ranging from network segmentation and patch management to vulnerability assessments and penetration tests at least once a year.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24(a) PDPA 2012 (Protection Obligation)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

8 Jan 2026

Original amount 17,500 SGD, converted at the ECB reference rate of 7 Apr 2025.

Checked against the official source on 4 Oct 2026 · Direct link

From 26 April 2021 to 25 July 2023, Apple abused its dominant position in the distribution of apps on iOS and iPadOS devices by designing the App Tracking Transparency consent prompt for the use of data for advertising purposes in a discriminatory, non-objective and non-transparent way. In the view of the Autorité de la concurrence (French Competition Authority), the mechanism was neither necessary nor proportionate for protecting privacy: it multiplied the consent windows in third-party apps and disadvantaged small, advertising-funded providers in particular. In addition to the fine of EUR 150 million, Apple must publish a summary of the decision.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 420-2 Code de commerce; Art. 102 AEUV

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

31 Mar 2025

Checked against the official source on 2 Oct 2026 · Direct link

Advanced, a processor for the NHS and care providers, was attacked with ransomware in August 2022 via a customer account without multi-factor authentication; services such as NHS 111 were disrupted. Data on 79,404 people was stolen, including instructions on how to gain entry to the homes of 890 people receiving care at home.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data processors

Legal basis

UK GDPR Art. 32 Abs. 1 (als Auftragsverarbeiter)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Provisionally £6.09 million; reduced, among other things, for proactive cooperation with the NCSC and the National Crime Agency.

Published

27 Mar 2025

Original amount 3,076,320 GBP, converted at the ECB reference rate of 26 Mar 2025.

Checked against the official source on 25 Sep 2026 · Direct link

In a cyberattack on the IT service provider's infrastructure, data of a significant number of people was exfiltrated, including copies of identity documents, financial and employment data and health data of employees. The ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, Romanian data protection authority) found a lack of appropriate security measures and of their regular testing and imposed RON 124,432.50; for failing to notify within 72 hours it issued a reprimand. The company has paid the fine.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 lit. b und d, Abs. 2, Art. 33 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

25 Mar 2025

Original amount 124,432.5 RON, converted at the ECB reference rate of 25 Mar 2025.

Checked against the official source on 28 Sep 2026 · Direct link

In two specification decisions under the Digital Markets Act, the European Commission set out which interoperability measures Apple must take: access for manufacturers of connected devices to nine iOS features (such as notifications on smartwatches, peer-to-peer Wi-Fi, NFC, pairing) and a more transparent and faster procedure for developers’ interoperability requests.

Authority / court

Europäische Kommission

Area of law

AI and digital regulation · Platform obligations

Legal basis

Digital Markets Act (Verordnung (EU) 2022/1925): Interoperabilitätspflicht, Spezifizierungsbeschlüsse

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

According to the KFTC (Korea Fair Trade Commission, Korea's competition authority), the three mobile network operators agreed in November 2015 to balance net gains and losses of new subscribers porting their numbers so that they would not concentrate on one operator, and implemented this until the end of September 2022 by coordinating their sales incentives for dealers with one another; they exchanged the information in a joint market monitoring group with the industry association KAIT. The KFTC issued cease-and-desist orders and provisionally set fines totalling KRW 114,026 million (SK Telecom KRW 42,662 million, KT KRW 33,029 million, LG Uplus KRW 38,334 million).

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 40 Abs. 1 Nr. 3 MRFTA (Monopoly Regulation and Fair Trade Act)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

12 Mar 2025

Original amount 114,026,000,000 KRW, converted at the ECB reference rate of 12 Mar 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Following an inspection, Datatilsynet (Norwegian Data Protection Authority) fined Telenor ASA NOK 4,000,000 because the group parent had not put in place appropriate organisational measures and policies for the position of its data protection officer (Art. 24(1) and (2) GDPR). The authority also issued a reprimand because for about one year there was no reporting line from the data protection officer to the highest management level, and ordered the company to carry out a documented assessment of whether it must designate a data protection officer and to revise its record of processing activities. According to Datatilsynet, the decision has been appealed and a ruling by the Personvernnemnda (Privacy Appeals Board) is expected in autumn 2026. The decision is not final.

Authority / court

Datatilsynet

Area of law

Data protection

Legal basis

Art. 24 Abs. 1 und 2, Art. 30, Art. 37 Abs. 7, Art. 38 Abs. 2 und 3, Art. 58 Abs. 2 lit. b, d und i DSGVO; § 26 personopplysningsloven

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

No specific harm to data subjects was identified; the long case-handling time was taken into account when setting the amount.

Published

14 Mar 2025

Original amount 4,000,000 NOK, converted at the ECB reference rate of 10 Mar 2025.

Checked against the official source on 28 Sep 2026 · Direct link

From 2014 to 2021, the IT consultancy group participated in bilateral agreements not to poach competitors’ employees. The Autoridade da Concorrência (Portuguese Competition Authority, AdC) imposed 3,092,000 EUR on three companies; in March 2026, the Competition, Regulation and Supervision Court (TCRS) upheld the fine in full – the first judicial confirmation of a labour market cartel fine in Portugal.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Lei da Concorrência (Lei n.º 19/2012), Art. 9.º

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

19 Feb 2025

Checked against the official source on 25 Sep 2026 · Direct link

After the Chinese providers had declared that they did not operate in Italy and were not subject to the GDPR, Italy's data protection authority (Garante per la protezione dei dati personali) ordered, as a matter of urgency and with immediate effect, the limitation of the processing of Italian users' data and opened an investigation.

Authority / court

Garante per la protezione dei dati personali

Area of law

AI and digital regulation · AI systems

Legal basis

DSGVO, Art. 58 Abs. 2 lit. f (Beschränkung der Verarbeitung)

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

30 Jan 2025

Checked against the official source on 25 Sep 2026 · Direct link

Russia's largest mobile and fixed-line operator challenged its inclusion on the Canadian Russia sanctions list directly in court. The Federal Court (2025 FC 181) upheld the striking out of the application, sought by the Attorney General of Canada, without leave to amend, because MTS should first have used the delisting procedure before the Minister provided for in the Regulations.

Authority / court

Federal Court (2025 FC 181); Attorney General of Canada

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Special Economic Measures Act; Regulations Amending the Special Economic Measures (Russia) Regulations, SOR/2023-163, s. 8

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 25 Sep 2026 · Direct link

After a failed attempt to take out a mobile contract, a person asked for their data to be erased; the provider requested further data and did not reply in full. It had also kept scanned identity documents although they were no longer needed for identification. The ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, Romanian data protection authority) imposed two fines of RON 99,510 each (RON 199,020 in total) and ordered, among other things, training of the staff concerned and deletion of the documents.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12 Abs. 3 und 4 i. V. m. Art. 17, Art. 5, 6 und 7 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

27 Jan 2025

Original amount 199,020 RON, converted at the ECB reference rate of 27 Jan 2025.

Checked against the official source on 28 Sep 2026 · Direct link

Several reported incidents were attributable to employees or service providers: a photo of an invoice sent to third parties, open e-mail distribution lists instead of BCC, a screenshot from the customer application shared via WhatsApp and misdirected invoices. The Romanian data protection authority (ANSPDCP) found insufficient measures to ensure that employees processed data in accordance with instructions and imposed 74,526 lei (15,000 EUR); the company paid. Date = publication of the press release; according to the authority, the investigation was concluded in the previous month.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 4 i. V. m. Abs. 1 lit. b DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

20 Jan 2025

Original amount 74,526 RON, converted at the ECB reference rate of 20 Jan 2025.

Checked against the official source on 25 Sep 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), DoNotPay advertised its AI chatbot as “the world’s first robot lawyer” that could replace a human lawyer, without ever having tested its performance against lawyers or having it reviewed by legal professionals. The final settlement order (5–0 vote) prohibits such claims without evidence and requires 193,000 USD and notification of subscribers from 2021 to 2023 about the limitations of the legal features.

Authority / court

Federal Trade Commission (FTC)

Area of law

AI and digital regulation · AI systems

Legal basis

Section 5 FTC Act (irreführende Geschäftspraktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

11 Feb 2025

Original amount 193,000 USD, converted at the ECB reference rate of 16 Jan 2025.

Checked against the official source on 28 Sep 2026 · Direct link

According to the Securities and Exchange Commission (SEC, the US securities regulator), the restaurant technology company, which was listed at the time, made misleading statements about its voice AI product “Presto Voice” from 2021 to 2023: it concealed that the speech recognition initially belonged to a third party and claimed that the AI eliminated the need for human order-taking, although the vast majority of orders required human intervention. The SEC issued a cease-and-desist order without a fine.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

AI and digital regulation · AI systems

Legal basis

Section 17(a)(2) Securities Act 1933; Section 13(a) Securities Exchange Act 1934

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

No fine owing to cooperation and remedial measures.

Published

14 Jan 2025

Checked against the official source on 28 Sep 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), the provider of AI facial recognition claimed without sufficient evidence that its software was among the most accurate on the market and performed without gender or skin-colour bias; contrary to its advertising, it had not been trained on millions of faces, and there was no evidence for the claim that it could not be fooled by photos or videos. The final settlement order prohibits false statements on accuracy, demographic performance and spoofing detection, as well as such statements without reliable testing.

Authority / court

Federal Trade Commission (FTC)

Area of law

AI and digital regulation · AI systems

Legal basis

Section 5 FTC Act (irreführende Geschäftspraktiken)

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

13 Jan 2025

Checked against the official source on 28 Sep 2026 · Direct link

Following an investigation of the iris-scanning service begun in 2023, the BayLDA (Bavarian data protection authority for the private sector) issued a decision agreed at European level against the Worldcoin Foundation: a reprimand because iris codes had for a time been stored in plain text, and orders to erase certain iris codes and SMPC shares collected without an adequate legal basis, to provide a GDPR-compliant erasure procedure and to obtain explicit consent. The company has challenged the decision in court; a fine is to be decided separately.

Authority / court

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 58 Abs. 2 lit. b, d, f, g DSGVO i. V. m. Art. 5 Abs. 1 lit. a, Art. 9 Abs. 1, Art. 17 Abs. 1 und Art. 32 DSGVO

Action

Order

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Published

19 Dec 2024

Checked against the official source on 2 Oct 2026 · Direct link

From 2010 to 2015, the suppliers of Ericsson/Aastra/Mitel telephone systems (PBX) allocated customers among themselves so as not to undercut each other. The Agencija za zaštitu tržišnog natjecanja (Croatian Competition Agency, AZTN) imposed a total of 1,170,968.24 EUR, of which 785,570.58 EUR on Ericsson Nikola Tesla; one leniency applicant (Steiner) was not penalised, and Kodeks received a reduction.

Authority / court

Agencija za zaštitu tržišnog natjecanja (AZTN)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 8 Zakon o zaštiti tržišnog natjecanja (ZZTN)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Leniency programme for two participants

Published

5 Mar 2025

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), the AI writing service offered a “Testimonial & Review” feature that generated detailed customer reviews with entirely invented details from brief, generic input; individual users produced hundreds to tens of thousands of reviews with it. With the final settlement order (3–2 vote), the FTC prohibited Rytr from offering any service for generating reviews. On 22 December 2025, the FTC set the order aside again with Rytr’s consent (2–0 vote): the facts alleged in the complaint did not support a violation of Section 5 of the FTC Act, and the order unduly burdened AI innovation, contrary to the Trump Administration’s AI Executive Order and AI Action Plan.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act (Mittel zur Täuschung bereitgestellt)

Action

Order

Status of proceedings

overturned

Sector

Telecoms, IT and software

Published

18 Dec 2024

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The CNIL (French data protection authority) fined Kaspr, provider of a paid Chrome extension that displays business contact details for LinkedIn profiles, EUR 240,000 and issued an order subject to a penalty payment of EUR 10,000 per day. The company had also collected contact details of users who had restricted their visibility, restarted the five-year retention period with every profile update, informed data subjects only from 2022 and only in English, and answered access requests inadequately (Art. 5(1)(e), 6, 12, 14 and 15 GDPR).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. e, 6, 12, 14 und 15 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Employees

Under 50

Culpability

negligent

Published

19 Dec 2024

Checked against the official source on 2 Oct 2026 · Direct link

Following an investigation opened on its own initiative, the Litigation Chamber found that Freedelity, a provider of shared customer data for retailers, could not demonstrate valid consent, did not sufficiently facilitate its withdrawal and collected more data from consumers' electronic identity cards than necessary. Instead of a fine, it ordered, among other things, valid consent procedures, an end to the collection of unnecessary identity card data together with its erasure and a maximum retention period of three years after the last activity, each backed by a penalty payment of 1,000 EUR per day of delay (5,000 EUR if none of the orders is complied with), capped at 100,000 EUR in total. The Market Court upheld the decision on 18 June 2025 except for the compliance deadlines; Freedelity has lodged an appeal in cassation. The decision is not final. The amount and the facts have not been confirmed against the primary source.

Authority / court

Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Marketing and consent

Legal basis

Art. 4 Nr. 11, Art. 5, 6, 7, 24 und 25 DSGVO; Art. 100 § 1 9°, 10° und 12° LCA

Action

Order

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Checked against the official source on 4 Oct 2026 · Direct link

The CNIL (French data protection authority) fined Orange SA EUR 50,000,000 because the group displayed adverts looking like genuine e-mails in the inbox of its e-mail service without consent, seen by more than 7.8 million users (Art. L. 34-5 CPCE, the French Post and Electronic Communications Code). In addition, cookies already placed on orange.fr continued to be read after consent had been withdrawn (Art. 82 of the Loi Informatique et Libertés, the French Data Protection Act); for this the CNIL ordered remedial action within three months, subject to a penalty payment of EUR 100,000 per day. Orange has challenged the decision before the Conseil d'État (French supreme administrative court), which on 17 April 2026 referred to the Conseil constitutionnel (French Constitutional Council) the question whether Art. L. 34-5 CPCE is constitutional.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Marketing and consent

Legal basis

Art. L. 34-5 Code des postes et des communications électroniques (CPCE); Art. 82 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Employees

10,000 or more

Culpability

negligent

Mitigating circumstances

Orange had discontinued the criticised ad format in November 2023; the new format clearly distinguishes adverts from e-mails.

Published

10 Dec 2024

Checked against the official source on 2 Oct 2026 · Direct link

As processor for a chiropractic practice, the IT service provider had encrypted backups without securing the key; after a ransomware attack in 2020, patient data including health information and CPR numbers could not be restored. The Danish data protection authority (Datatilsynet) reported the company to the police and proposed 50,000 DKK; the court sentenced it to a fine of 40,000 DKK on 12 November 2024.

Authority / court

Dänisches Gericht auf Anzeige der Datatilsynet

Area of law

Data protection · Data processors

Legal basis

Art. 32 DSGVO; Auftragsverarbeitungsvertrag

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Original amount 40,000 DKK, converted at the ECB reference rate of 12 Nov 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Venezuelan subsidiary of Spain's Telefónica S.A. entered into a DPA and pays a penalty of USD 85,260,000. To be allowed to exchange bolívares for US dollars in a state currency auction in 2014, it had two suppliers pay about USD 28.9 million to an intermediary, part of which went to Venezuelan officials, and covered the cost through overpriced equipment purchases from those suppliers. It received more than USD 110 million from the auction, over 65% of the funds awarded. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section; USAO Southern District of New York)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Foreign Corrupt Practices Act (FCPA): Verschwörung zum Verstoß gegen die Anti-Bribery-Vorschriften (Criminal Information, Southern District of New York)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

Cooperation (initially diminished by late production of records) and remediation were credited: disciplinary action including dismissals, an independent compliance function with a Chief Compliance Officer, review of all non-standard pricing transactions, tighter third-party controls; 20% reduction.

Published

8 Nov 2024

Original amount 85,260,000 USD, converted at the ECB reference rate of 8 Nov 2024.

Checked against the official source on 3 Oct 2026 · Direct link

Italy's data protection authority (Garante per la protezione dei dati personali) imposed 15 million EUR because OpenAI trained ChatGPT with user data without an appropriate legal basis, breached transparency obligations, failed to report a data breach from March 2023 and did not provide for age verification; in addition, a six-month information campaign was ordered. The Rome Court (Tribunale di Roma) upheld OpenAI's action in judgment no. 4153/2026 (published on 18 March 2026); the Garante subsequently removed the decision from its website.

Authority / court

Garante per la protezione dei dati personali

Area of law

AI and digital regulation · AI systems

Legal basis

DSGVO (Rechtsgrundlage, Transparenz, Meldung von Datenpannen, Schutz Minderjähriger)

Action

Fine

Status of proceedings

overturned

Sector

Telecoms, IT and software

Published

20 Dec 2024

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

As part of a settlement, the Bureau of Industry and Security imposed a civil penalty of USD 500,000 on GlobalFoundries U.S. Inc. and its subsidiary GlobalFoundries U.S. 2 LLC. Between February 2021 and October 2022 the company sent semiconductor wafers worth around USD 17.1 million in 74 shipments without authorisation to SJ Semiconductor, a company on the Entity List; owing to a data entry error, the service provider designated by the customer had not been screened in the screening system. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Department of Commerce, Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

15 C.F.R. § 764.2(a) (Export Administration Regulations)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

According to BIS, voluntary self-disclosure, cooperation and remedial measures led to a significant reduction of the penalty.

Published

1 Nov 2024

Original amount 500,000 USD, converted at the ECB reference rate of 1 Nov 2024.

Checked against the official source on 3 Oct 2026 · Direct link

According to the CFPB, Apple in some cases failed to forward Apple Card users' disputes to the issuing bank Goldman Sachs and designed advertising and the checkout process so that customers wrongly assumed device purchases would automatically be split into interest-free instalments (Apple Card Monthly Installments). The order imposed a fine of 25 million USD; in September 2025 the CFPB terminated it early after the fine had been paid. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Consumer Financial Protection Bureau (CFPB)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Consumer Financial Protection Act of 2010, §§ 1031, 1036 (12 U.S.C. §§ 5531, 5536) – unlautere, irreführende und missbräuchliche Praktiken

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

23 Oct 2024

Original amount 25,000,000 USD, converted at the ECB reference rate of 23 Oct 2024.

Checked against the official source on 3 Oct 2026 · Direct link

In mandatory disclosures, Unisys presented cyber risks as hypothetical, although it had suffered two intrusions with data exfiltration connected with the SolarWinds compromise. On the same day, the US Securities and Exchange Commission (SEC) also imposed penalties on Avaya ($1 million), Check Point ($995,000) and Mimecast ($990,000).

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Securities Act of 1933, Securities Exchange Act of 1934 (inkl. Disclosure Controls)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

negligent

Mitigating circumstances

Cooperation in the proceedings and improvement of cybersecurity controls.

Published

22 Oct 2024

Original amount 4,000,000 USD, converted at the ECB reference rate of 22 Oct 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A telecommunications provider issued a duplicate of a customer's SIM card that she had not requested. The Spanish data protection authority AEPD imposed 200,000 EUR for processing without a legal basis (Art. 6) and 1,000,000 EUR because the procedure lacked suitable safeguards against such errors from the outset (Art. 25), 1,200,000 EUR in total, and ordered measures ensuring that duplicates can only be requested by the line holder; the company announced an action before the administrative courts. The decision is not final.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6, Art. 25 DSGVO

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Published

13 May 2025

Checked against the official source on 28 Sep 2026 · Direct link

Through an employee portal of a Spanish telecommunications company that was reachable from the internet and protected only by username and password, unauthorised persons used an employee's user account to retrieve customer data on a large scale; landline numbers and technical and configuration data of customer equipment relating to around 1.4 million people were affected. According to the reasoning of the decision, the Spanish data protection authority AEPD imposed 800,000 EUR for breaching Art. 5(1)(f) GDPR and 500,000 EUR under Art. 32 GDPR, 1,300,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

26 Dec 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 26 Sep 2026 · Direct link

The provider of property management software had employees waive potential awards for reports to authorities in two employment agreements and one settlement agreement; 68 consulting agreements (January 2020 to October 2023) prohibited voluntary disclosures to authorities. As part of a sweep against seven listed companies, the provider paid 692,250 US dollars to the U.S. Securities and Exchange Commission (SEC); the contract templates were amended.

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Employees

1,000 to 9,999

Mitigating circumstances

Amendment of the templates after contact by the SEC, information provided to those affected, and cooperation

Published

9 Sep 2024

Original amount 692,250 USD, converted at the ECB reference rate of 9 Sep 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 Sep 2026 · Direct link

In its own online shop, the manufacturer set a 'WEB price', at which the devices had never been sold there, against a reduced 'campaign price' for seven notebook models, and announced deadlines after which the discounts still applied (example from October 2022: 187,880 JPY reduced to 148,425 JPY, 21% off). A surcharge of 42,230,000 JPY was imposed for this.

Authority / court

Consumer Affairs Agency (消費者庁, CAA)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 8 Abs. 1 i. V. m. Art. 5 Nr. 2 Act against Unjustifiable Premiums and Misleading Representations (不当景品類及び不当表示防止法, Gesetz Nr. 134/1962)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Culpability

negligent

Published

2 Aug 2024

Original amount 42,230,000 JPY, converted at the ECB reference rate of 2 Aug 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 2 Aug 2026 · Direct link

The Secretaria Nacional do Consumidor (Senacon, National Consumer Secretariat) fined a mobile operator 2,000,000 BRL for misleading 5G advertising. According to the decision, the advertising messages did not disclose the limitations of the DSS technology used clearly and adequately and thereby misled consumers. Separate fining decisions were issued against three other telecommunications operators for the same advertising practice.

Authority / court

Secretaria Nacional do Consumidor (Senacon), Departamento de Proteção e Defesa do Consumidor (DPDC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 6 III und IV, Art. 30, Art. 31 und Art. 37 § 1 Código de Defesa do Consumidor (Lei nº 8.078/1990); Art. 13 I und VI und Art. 14 Decreto nº 2.181/1997

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

23 Jul 2024

Original amount 2,000,000 BRL, converted at the ECB reference rate of 23 Jul 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 23 Jul 2026 · Direct link

In its 2018 half-yearly report, the drone manufacturer disseminated misleading information on the absence of impairment indicators for the drone division, on goodwill and on earnings. Sanction imposed on the company: 150,000 EUR.

Authority / court

Autorité des marchés financiers (AMF), Commission des sanctions

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Art. 12 Abs. 1 lit. c, Art. 15 MAR; Art. 8 und 14 MAR

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Liability of senior managers

Measures against individuals are not reported here.

Checked against the official source on 28 Sep 2026 · Version 6 · Company name anonymised since 19 Jul 2026 · Direct link

In August 2023 an Italian service provider notified a ransomware attack that blocked servers and workstations and affected data of around 25,000 people. The Garante (Italian data protection authority) found that the vulnerabilities exploited had been publicly known since September 2022 and flagged by the software vendor and by the Italian National Cybersecurity Agency (ACN), but the systems had not been updated for almost a year; it imposed a fine of EUR 900,000 and ordered formalised vulnerability management with target values for detection and response times. It dropped the allegation of an infringement of Art. 28 GDPR.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, 25, 32 und 33 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Mitigating: cooperation with the authority, updating of the systems and an improvement plan for handling security-critical alerts.

Published

22 Oct 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 4 Jul 2026 · Direct link

The FTC issued its final order against a British software maker, its Czech subsidiary and its former data subsidiary. According to the authority, the software maker collected detailed browsing data through browser extensions and antivirus software, stored it indefinitely and sold it via the data subsidiary to more than 100 third parties without adequate notice and consent, even though the products were marketed as protecting against online tracking. The software maker must pay 16,500,000 USD for consumer redress, may no longer sell or license browsing data for advertising purposes, must delete the data transferred to the data subsidiary together with any products and algorithms derived from it, and must set up a privacy programme.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Cookies and tracking

Legal basis

Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Telecoms, IT and software

Published

27 Jun 2024

Original amount 16,500,000 USD, converted at the ECB reference rate of 26 Jun 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 26 Jun 2026 · Direct link

The Bundeskartellamt (Federal Cartel Office) fined a German network equipment manufacturer and one responsible individual a total of almost 16 million EUR for resale price maintenance: the manufacturer's staff coordinated increases in consumer prices for its products with six electronics retailers, in some cases demanded target prices, monitored prices with dedicated software and in some cases threatened supply stops or reduced terms. The case began with an anonymous tip-off to the whistleblowing system and further market information; the decisions are final following a settlement, and no fines were imposed on the retailers.

Authority / court

Bundeskartellamt

Area of law

Competition law · Cartels and collusion

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Mitigating circumstances

Expedited settlement.

Published

2 Jul 2024

Checked against the official source on 2 Oct 2026 · Company name anonymised since 10 Jun 2026 · Direct link

According to the Dutch Authority for Digital Infrastructure (RDI), a Dutch telecommunications provider did not take the necessary measures from October 2021 to December 2022 to protect data from lawful interception of telecommunications against unauthorised persons: the security plan was inadequate, staff with access had not been sufficiently screened (missing job descriptions, confidentiality declarations, certificates of conduct), and logical and physical access controls were deficient. No actual unauthorised access was found; the fine amounts to 2.25 million EUR.

Authority / court

Rijksinspectie Digitale Infrastructuur (RDI)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Telecommunicatiewet Art. 15.4; Besluit beveiliging gegevens telecommunicatie (Bbgt) Art. 2, 3, 4, 8

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Mitigating circumstances

Deficiencies remedied after they were identified; no actual unauthorised access found.

Published

22 Oct 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 21 May 2026 · Direct link

The consumer protection department of Senacon fined a mobile operator 922,869.00 BRL because its advertising for "5G" misled consumers: it did not clearly and adequately point out the limitations of the DSS technology used. The Senacon Secretary rejected the appeal in December 2024.

Authority / court

Secretaria Nacional do Consumidor (Senacon), Departamento de Proteção e Defesa do Consumidor (DPDC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 6 III, IV, 30, 31, 37 § 1 Lei nº 8.078/1990 (Código de Defesa do Consumidor); Art. 13 I, VI und 14 Decreto nº 2.181/1997

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 May 2024

Original amount 922,869 BRL, converted at the ECB reference rate of 20 May 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 20 May 2026 · Direct link

According to the complaint of the Federal Trade Commission (FTC, the US consumer protection authority), an attacker exploited weaknesses in the network of the data services provider for companies and non-profit organisations in early 2020 and stole large amounts of unencrypted data, including Social Security and bank account numbers of millions of people; the attack went undetected for three months, the provider informed its customers only after almost two months and misrepresented the extent. The final order requires a comprehensive security programme, a data retention schedule, deletion of data no longer needed and notification of future reportable incidents to the FTC.

Authority / court

Federal Trade Commission (FTC)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

Section 5 FTC Act

Action

Order

Status of proceedings

final

Sector

Telecoms, IT and software

Published

20 May 2024

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 20 May 2026 · Direct link

The provider processes biometric data of people in the Netherlands without a legal basis for a facial recognition database compiled from the internet, did not inform data subjects, did not respond to access requests and did not designate an EU representative. In addition to a fine of 30.5 million EUR, the Dutch data protection authority (Autoriteit Persoonsgegevens, AP) imposed four orders subject to penalty payments.

Authority / court

Autoriteit Persoonsgegevens

Area of law

AI and digital regulation · AI systems

Legal basis

DSGVO Art. 5 Abs. 1 lit. a, 6 Abs. 1, 9 Abs. 1, 12, 14, 15, 27

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

3 Sep 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 16 May 2026 · Direct link

Following the hacker attack on an IT service provider, the Swiss Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) found that personal data of two federal offices had reached the service provider via support processes without the necessary data protection safeguards. The service provider subsequently retained the data in breach of data protection law and partly in breach of contract.

Authority / court

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)

Area of law

Data protection · Data processors

Legal basis

Datenschutzgesetz (DSG)

Action

Other

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

1 May 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 May 2026 · Direct link

Using a compromised user account, an attacker gained remote desktop access to servers of the payroll service provider between December 2022 and January 2023 and exfiltrated data; data on employees of one client, including name, identity number, bank account and salary, appeared on a leak site. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found a breach of the Protection Obligation because the sensitive data was stored on unsecured internal drives, staff had local administrator rights and there was no multi-factor authentication. Given the company's role as a payroll provider and the type of data, it considered a fine appropriate and set it at 4,000 SGD.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Employee data

Legal basis

Section 24 PDPA 2012 (Protection Obligation); Section 48J PDPA (Financial Penalty)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

no

Mitigating circumstances

Cooperation, admission under the Expedited Decision Procedure and first breach of the PDPA.

Published

22 Apr 2024

Original amount 4,000 SGD, converted at the ECB reference rate of 22 Apr 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 22 Apr 2026 · Direct link

In 2019, the antivirus manufacturer passed pseudonymised browsing histories of around 100 million users to its subsidiary, which sold insights into online behaviour to marketing clients. The data declared as anonymous allowed re-identification and users were misinformed; the Úřad pro ochranu osobních údajů (Czech data protection authority, ÚOOÚ) imposed a final fine of 351 million CZK.

Authority / court

Úřad pro ochranu osobních údajů (ÚOOÚ)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO (unrechtmäßige Verarbeitung, Transparenz), One-Stop-Shop-Verfahren

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Published

15 Apr 2024

Original amount 351,000,000 CZK, converted at the ECB reference rate of 15 Apr 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 15 Apr 2026 · Direct link

As an urgent measure, the data protection authority ordered the foundation to suspend the collection of biometric data (iris, eyes, face) throughout Portugal within 24 hours for 90 days. It acted on complaints about the enrolment of minors, the lack of ways to erase data and withdraw consent, and inadequate information, with more than 300,000 people already enrolled.

Authority / court

Comissão Nacional de Proteção de Dados (CNPD)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 58 Abs. 2 lit. f DSGVO; Art. 6 Abs. 1 lit. b Lei n.º 58/2019

Action

Order

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

26 Mar 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 25 Mar 2026 · Direct link

The data broker processed data obtained from third-party sources (including the companies register) on a large scale and over a long period without proactively informing the data subjects; access requests were answered incompletely and the record of processing activities had gaps. The Autorité de protection des données (Belgian Data Protection Authority, APD) imposed three fines totalling 174,640 EUR and prohibited, among other things, one of the broker’s services for checking the quality of data until data subjects had been informed; on 4 September 2024 the Brussels Market Court set aside the orders and reduced the fines by 10% to a total of 157,176 EUR.

Authority / court

Autorité de protection des données (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO – Rechtmäßigkeit, Fairness und Transparenz, Auskunftsrecht, Verzeichnis von Verarbeitungstätigkeiten

Action

Fine

Status of proceedings

reduced

Sector

Telecoms, IT and software

Mitigating circumstances

Discontinuation of a service for supplying data and destruction of a consumer database.

Published

16 Jan 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 16 Jan 2026 · Direct link

The KFTC (Korea Fair Trade Commission, Korea's competition and consumer authority) found that the games company had changed the probabilities of paid random items (loot boxes) in two of its online games to the players' disadvantage and had failed to disclose this or disclosed it falsely. It treated this as deceiving consumers under the E-Commerce Act and, in addition to a cease-and-desist order, provisionally set fines totalling KRW 11,642 million (KRW 11,593 million for one game, KRW 49 million for the other), according to the KFTC the highest amount under that Act at the time.

Authority / court

Korea Fair Trade Commission (KFTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 21 Abs. 1 Nr. 1 Act on the Consumer Protection in Electronic Commerce (E-Commerce-Gesetz)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Repeat case

yes

Published

3 Jan 2024

Original amount 11,642,000,000 KRW, converted at the ECB reference rate of 3 Jan 2024.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 3 Jan 2026 · Direct link

The CNIL (Commission nationale de l'informatique et des libertés, French data protection authority) fined an unnamed IT consultancy (systems and software) EUR 100,000 because, as a processor, it engaged another processor without the controller's authorisation and failed to ensure data security. The decision appears only in the CNIL's list of sanctions, with date, type of organisation, infringements and amount.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data processors

Legal basis

DSGVO – laut CNIL-Liste Verbot für Auftragsverarbeiter, ohne Genehmigung des Verantwortlichen einen weiteren Auftragsverarbeiter einzusetzen, sowie mangelnde Datensicherheit (Artikel in der Liste nicht angegeben)

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 29 Dec 2025 · Direct link

The competition authority concluded a settlement procedure with two Portuguese companies of the IT consulting group, imposing a fine of 2,481,000 EUR, because between January 2014 and January 2022 the consulting group and a software maker excluded each other's employees from their recruitment processes for specialists in that maker's software or did not hire them (no-poach). The fine was reduced by 30% in the settlement; the software maker's Portuguese company, a company of an audit and consulting network and later an IT services group were also sanctioned in the same proceedings.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 9 Abs. 1 lit. c Lei n.º 19/2012 (Lei da Concorrência); Art. 101 Abs. 1 lit. c AEUV

Action

Fine

Status of proceedings

final

Sector

Telecoms, IT and software

Culpability

intentional

Mitigating circumstances

Settlement procedure (transação) at the investigation stage with evidence contributed and voluntary payment; 30% reduction.

Published

25 Jan 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 22 Dec 2025 · Direct link

From November 2015 to April 2020, the group abused its dominant position in controllers for its fourth-generation games console: updates disconnected controllers without a licence from the group from the console, while the criteria for the licensing programme remained non-transparent. The Autorité de la concurrence (French Competition Authority) found the measures, justified by the fight against counterfeiting, to be disproportionate and imposed EUR 13,527,000 jointly on four companies of the group.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 420-2 Code de commerce; Art. 102 AEUV

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Employees

10,000 or more

Published

20 Dec 2023

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 20 Dec 2025 · Direct link

UOKiK found that a security technology supplier and its distributors fixed prices for products of its brand (video surveillance, access control, accessories) and allocated sales to customers among the distributors. The fines on the limited companies total PLN 32,538,257.41 (the supplier 22,191,472.31, three distributors 6,716,275.63, 1,880,340.62 and 1,750,168.85 PLN). Fines on natural persons are not included in the amount. The decision is not final.

Authority / court

Prezes Urzędu Ochrony Konkurencji i Konsumentów (UOKiK)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 6 Abs. 1 Nr. 1 und 3 ustawa o ochronie konkurencji i konsumentów; Art. 101 Abs. 1 lit. a und c AEUV

Action

Fine

Status of proceedings

under appeal

Sector

Telecoms, IT and software

Liability of senior managers

Measures against individuals are not reported here.

Original amount 32,538,257.41 PLN, converted at the ECB reference rate of 20 Dec 2023.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 20 Dec 2025 · Direct link

The operator of a nationwide school administration system, which acts as processor for the schools, had not configured the security settings of its internal development environment in line with the risks; an attacker gained access to data through it. The company also failed to notify the responsible schools of the incident without undue delay. The NAIH (Nemzeti Adatvédelmi és Információszabadság Hatóság, Hungarian data protection authority) imposed HUF 110,000,000 and ordered the company to inform the schools of the findings.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data processors

Legal basis

Art. 32 Abs. 1 lit. b und Abs. 2, Art. 33 Abs. 2 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Telecoms, IT and software

Published

20 Dec 2023